Edit tour

Windows Analysis Report
aS39AS7b0P.exe

Overview

General Information

Sample name:	aS39AS7b0P.exe renamed because original name is a hash value
Original sample name:	de7e8561b2cf84f247a1f76a1fb4f1a53b5fd18b093d880bf563fd1b55a97d71.exe
Analysis ID:	1589073
MD5:	10f089d7b9e39a47f1ba6e9ca2086d25
SHA1:	9fd173cf8141ed645d09cf87ccd569994c926eff
SHA256:	de7e8561b2cf84f247a1f76a1fb4f1a53b5fd18b093d880bf563fd1b55a97d71
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

aS39AS7b0P.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\aS39AS7b0P.exe" MD5: 10F089D7B9E39A47F1BA6E9CA2086D25)

RegSvcs.exe (PID: 7364 cmdline: "C:\Users\user\Desktop\aS39AS7b0P.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7591642187:AAF3F6-zxp3HwWsP9s4_QJW4W-aEGhjsvDI/sendMessage?chat_id=6557702940", "Token": "7591642187:AAF3F6-zxp3HwWsP9s4_QJW4W-aEGhjsvDI", "Chat_id": "6557702940", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14adf:$a1: get_encryptedPassword 0x14dcb:$a2: get_encryptedUsername 0x148eb:$a3: get_timePasswordChanged 0x149e6:$a4: get_passwordField 0x14af5:$a5: set_encryptedPassword 0x1617c:$a7: get_logins 0x160df:$a10: KeyLoggerEventArgs 0x15d4a:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c426:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b658:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba8b:$a4: \Orbitum\User Data\Default\Login Data 0x1caca:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156c4:$s1: UnHook 0x156cb:$s2: SetHook 0x156d3:$s3: CallNextHook 0x156e0:$s4: _hook
00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a70:$x1: $%SMTPDV$ 0x18454:$x2: $#TheHashHere%& 0x19a18:$x3: %FTPDV$ 0x183f4:$x4: $%TelegramDv$ 0x15d4a:$x5: KeyLoggerEventArgs 0x160df:$x5: KeyLoggerEventArgs 0x19a3c:$m2: Clipboard Logs ID 0x19c7a:$m2: Screenshot Logs ID 0x19d8a:$m2: keystroke Logs ID 0x1a064:$m3: SnakePW 0x19c52:$m4: \SnakeKeylogger\
00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x148df:$a1: get_encryptedPassword 0x14bcb:$a2: get_encryptedUsername 0x146eb:$a3: get_timePasswordChanged 0x147e6:$a4: get_passwordField 0x148f5:$a5: set_encryptedPassword 0x15f7c:$a7: get_logins 0x15edf:$a10: KeyLoggerEventArgs 0x15b4a:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19870:$x1: $%SMTPDV$ 0x18254:$x2: $#TheHashHere%& 0x19818:$x3: %FTPDV$ 0x181f4:$x4: $%TelegramDv$ 0x15b4a:$x5: KeyLoggerEventArgs 0x15edf:$x5: KeyLoggerEventArgs 0x1983c:$m2: Clipboard Logs ID 0x19a7a:$m2: Screenshot Logs ID 0x19b8a:$m2: keystroke Logs ID 0x19e64:$m3: SnakePW 0x19a52:$m4: \SnakeKeylogger\
00000001.00000002.4161350398.0000000002883000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.4161350398.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: aS39AS7b0P.exe PID: 7344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aS39AS7b0P.exe PID: 7344	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: aS39AS7b0P.exe PID: 7344	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf4918:$a1: get_encryptedPassword 0xf4bfa:$a2: get_encryptedUsername 0xf472e:$a3: get_timePasswordChanged 0xf4829:$a4: get_passwordField 0xf492e:$a5: set_encryptedPassword 0xf6e0d:$a7: get_logins 0xf6d70:$a10: KeyLoggerEventArgs 0xf69db:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: aS39AS7b0P.exe PID: 7344	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf69db:$x5: KeyLoggerEventArgs 0xf6d70:$x5: KeyLoggerEventArgs 0xf7346:$x5: KeyLoggerEventArgs 0xf76a7:$x5: KeyLoggerEventArgs 0xf8f9e:$m2: Clipboard Logs ID 0xf90a4:$m2: Screenshot Logs ID 0xf90fa:$m2: keystroke Logs ID 0xf922f:$m3: SnakePW 0xf9090:$m4: \SnakeKeylogger\
Process Memory Space: RegSvcs.exe PID: 7364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7364	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 7364	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a7dd:$a1: get_encryptedPassword 0x1aabf:$a2: get_encryptedUsername 0x1a5f3:$a3: get_timePasswordChanged 0x1a6ee:$a4: get_passwordField 0x1a7f3:$a5: set_encryptedPassword 0x1ccd2:$a7: get_logins 0x1cc35:$a10: KeyLoggerEventArgs 0x1c8a0:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 7364	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1c8a0:$x5: KeyLoggerEventArgs 0x1cc35:$x5: KeyLoggerEventArgs 0x1d20b:$x5: KeyLoggerEventArgs 0x1d56c:$x5: KeyLoggerEventArgs 0x1ee63:$m2: Clipboard Logs ID 0x1ef69:$m2: Screenshot Logs ID 0x1efbf:$m2: keystroke Logs ID 0x1f0f4:$m3: SnakePW 0x1ef55:$m4: \SnakeKeylogger\
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.700000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.700000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.700000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RegSvcs.exe.700000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14adf:$a1: get_encryptedPassword 0x14dcb:$a2: get_encryptedUsername 0x148eb:$a3: get_timePasswordChanged 0x149e6:$a4: get_passwordField 0x14af5:$a5: set_encryptedPassword 0x1617c:$a7: get_logins 0x160df:$a10: KeyLoggerEventArgs 0x15d4a:$a11: KeyLoggerEventArgsEventHandler
1.2.RegSvcs.exe.700000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c426:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b658:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba8b:$a4: \Orbitum\User Data\Default\Login Data 0x1caca:$a5: \Kometa\User Data\Default\Login Data
1.2.RegSvcs.exe.700000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156c4:$s1: UnHook 0x156cb:$s2: SetHook 0x156d3:$s3: CallNextHook 0x156e0:$s4: _hook
1.2.RegSvcs.exe.700000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a70:$x1: $%SMTPDV$ 0x18454:$x2: $#TheHashHere%& 0x19a18:$x3: %FTPDV$ 0x183f4:$x4: $%TelegramDv$ 0x15d4a:$x5: KeyLoggerEventArgs 0x160df:$x5: KeyLoggerEventArgs 0x19a3c:$m2: Clipboard Logs ID 0x19c7a:$m2: Screenshot Logs ID 0x19d8a:$m2: keystroke Logs ID 0x1a064:$m3: SnakePW 0x19c52:$m4: \SnakeKeylogger\
0.2.aS39AS7b0P.exe.1230000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.aS39AS7b0P.exe.1230000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.aS39AS7b0P.exe.1230000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12cdf:$a1: get_encryptedPassword 0x12fcb:$a2: get_encryptedUsername 0x12aeb:$a3: get_timePasswordChanged 0x12be6:$a4: get_passwordField 0x12cf5:$a5: set_encryptedPassword 0x1437c:$a7: get_logins 0x142df:$a10: KeyLoggerEventArgs 0x13f4a:$a11: KeyLoggerEventArgsEventHandler
0.2.aS39AS7b0P.exe.1230000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a626:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19858:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c8b:$a4: \Orbitum\User Data\Default\Login Data 0x1acca:$a5: \Kometa\User Data\Default\Login Data
0.2.aS39AS7b0P.exe.1230000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x138c4:$s1: UnHook 0x138cb:$s2: SetHook 0x138d3:$s3: CallNextHook 0x138e0:$s4: _hook
0.2.aS39AS7b0P.exe.1230000.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c70:$x1: $%SMTPDV$ 0x16654:$x2: $#TheHashHere%& 0x17c18:$x3: %FTPDV$ 0x165f4:$x4: $%TelegramDv$ 0x13f4a:$x5: KeyLoggerEventArgs 0x142df:$x5: KeyLoggerEventArgs 0x17c3c:$m2: Clipboard Logs ID 0x17e7a:$m2: Screenshot Logs ID 0x17f8a:$m2: keystroke Logs ID 0x18264:$m3: SnakePW 0x17e52:$m4: \SnakeKeylogger\
0.2.aS39AS7b0P.exe.1230000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.aS39AS7b0P.exe.1230000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.aS39AS7b0P.exe.1230000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.aS39AS7b0P.exe.1230000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14adf:$a1: get_encryptedPassword 0x14dcb:$a2: get_encryptedUsername 0x148eb:$a3: get_timePasswordChanged 0x149e6:$a4: get_passwordField 0x14af5:$a5: set_encryptedPassword 0x1617c:$a7: get_logins 0x160df:$a10: KeyLoggerEventArgs 0x15d4a:$a11: KeyLoggerEventArgsEventHandler
0.2.aS39AS7b0P.exe.1230000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c426:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b658:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba8b:$a4: \Orbitum\User Data\Default\Login Data 0x1caca:$a5: \Kometa\User Data\Default\Login Data
0.2.aS39AS7b0P.exe.1230000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156c4:$s1: UnHook 0x156cb:$s2: SetHook 0x156d3:$s3: CallNextHook 0x156e0:$s4: _hook
0.2.aS39AS7b0P.exe.1230000.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a70:$x1: $%SMTPDV$ 0x18454:$x2: $#TheHashHere%& 0x19a18:$x3: %FTPDV$ 0x183f4:$x4: $%TelegramDv$ 0x15d4a:$x5: KeyLoggerEventArgs 0x160df:$x5: KeyLoggerEventArgs 0x19a3c:$m2: Clipboard Logs ID 0x19c7a:$m2: Screenshot Logs ID 0x19d8a:$m2: keystroke Logs ID 0x1a064:$m3: SnakePW 0x19c52:$m4: \SnakeKeylogger\
Click to see the 15 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:12:39.326128+0100	2803305	3	Unknown Traffic	192.168.2.4	49732	104.21.112.1	443	TCP
2025-01-11T09:12:46.406487+0100	2803305	3	Unknown Traffic	192.168.2.4	49742	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:12:37.633234+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	158.101.44.242	80	TCP
2025-01-11T09:12:38.726915+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	158.101.44.242	80	TCP
2025-01-11T09:12:40.105937+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7591642187:AAF3F6-zxp3HwWsP9s4_QJW4W-aEGhjsvDI/sendMessage?chat_id=6557702940", "Token": "7591642187:AAF3F6-zxp3HwWsP9s4_QJW4W-aEGhjsvDI", "Chat_id": "6557702940", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: aS39AS7b0P.exe	ReversingLabs: Detection: 71%
Source: aS39AS7b0P.exe	Virustotal: Detection: 70%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: aS39AS7b0P.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: aS39AS7b0P.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49731 version: TLS 1.0

Source:	Binary string: wntdll.pdbUGP source: aS39AS7b0P.exe, 00000000.00000003.1701416100.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, aS39AS7b0P.exe, 00000000.00000003.1702728769.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aS39AS7b0P.exe, 00000000.00000003.1701416100.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, aS39AS7b0P.exe, 00000000.00000003.1702728769.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007E6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007E6CA9
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007E60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_007E60DD
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007E63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_007E63F9
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007EEB60
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EF56F FindFirstFileW,FindClose,	0_2_007EF56F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007EF5FA
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007F1B2F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007F1C8A
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007F1F94

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00C1F1F6h	1_2_00C1F007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00C1FB80h	1_2_00C1F007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_00C1E528

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.4:64920 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49742 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49731 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007F4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_007F4EB5

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comh
Source: RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000276F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000001.00000002.4161350398.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: aS39AS7b0P.exe, 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000001.00000002.4161350398.0000000002794000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000001.00000002.4161350398.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: aS39AS7b0P.exe, 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007F6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_007F6B0C

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007F6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_007F6D07

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

0_2_007F6B0C

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007E2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_007E2B37

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_0080F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0080F7FF

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: aS39AS7b0P.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: aS39AS7b0P.exe PID: 7344, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 7364, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7364, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: This is a third-party compiled AutoIt script.	0_2_007A3D19
Source: aS39AS7b0P.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: aS39AS7b0P.exe, 00000000.00000000.1690678508.000000000084E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6402740f-2
Source: aS39AS7b0P.exe, 00000000.00000000.1690678508.000000000084E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: }SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_aadd8a01-3
Source: aS39AS7b0P.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5e153ab8-b
Source: aS39AS7b0P.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1d4f7b29-9

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007E6606: CreateFileW,DeviceIoControl,CloseHandle,

0_2_007E6606

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007DACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_007DACC5

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007E79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_007E79D3

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007CB043	0_2_007CB043
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007D410F	0_2_007D410F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007C02A4	0_2_007C02A4
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007AE3B0	0_2_007AE3B0
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007D038E	0_2_007D038E
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007D467F	0_2_007D467F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007C06D9	0_2_007C06D9
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_0080AACE	0_2_0080AACE
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007D4BEF	0_2_007D4BEF
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007CCCC1	0_2_007CCCC1
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007AAF50	0_2_007AAF50
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007A6F07	0_2_007A6F07
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_008031BC	0_2_008031BC
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007BB11F	0_2_007BB11F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007CD1B9	0_2_007CD1B9
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007D724D	0_2_007D724D
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007C123A	0_2_007C123A
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007B3200	0_2_007B3200
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007A93F0	0_2_007A93F0
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007E13CA	0_2_007E13CA
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007BF563	0_2_007BF563
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EB6CC	0_2_007EB6CC
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007A96C0	0_2_007A96C0
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_0080F7FF	0_2_0080F7FF
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007A77B0	0_2_007A77B0
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007D79C9	0_2_007D79C9
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007BFA57	0_2_007BFA57
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007B3B70	0_2_007B3B70
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007A9B60	0_2_007A9B60
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007A7D19	0_2_007A7D19
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007BFE6F	0_2_007BFE6F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007C9ED0	0_2_007C9ED0
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007A7FA3	0_2_007A7FA3
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_01563068	0_2_01563068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1F007	1_2_00C1F007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1C190	1_2_00C1C190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C16108	1_2_00C16108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1B328	1_2_00C1B328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1C470	1_2_00C1C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C19540	1_2_00C19540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1C752	1_2_00C1C752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C16730	1_2_00C16730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C14AD9	1_2_00C14AD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1CA32	1_2_00C1CA32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1BBD2	1_2_00C1BBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1BEB0	1_2_00C1BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1B4F2	1_2_00C1B4F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C13572	1_2_00C13572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1E517	1_2_00C1E517
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00C1E528	1_2_00C1E528

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: String function: 007CF8A0 appears 35 times
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: String function: 007C6AC0 appears 42 times
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: String function: 007BEC2F appears 68 times

Source: aS39AS7b0P.exe, 00000000.00000003.1701416100.0000000003D9D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs aS39AS7b0P.exe
Source: aS39AS7b0P.exe, 00000000.00000003.1703083099.0000000003BF3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs aS39AS7b0P.exe
Source: aS39AS7b0P.exe, 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs aS39AS7b0P.exe

Source: aS39AS7b0P.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: aS39AS7b0P.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: aS39AS7b0P.exe PID: 7344, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RegSvcs.exe PID: 7364, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7364, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@3/2

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007ECE7A GetLastError,FormatMessageW,

0_2_007ECE7A

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007DAB84 AdjustTokenPrivileges,CloseHandle,		0_2_007DAB84
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007DB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007DB134

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007EE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007EE1FD

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007E6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_007E6532

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007FC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_007FC18C

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007A406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_007A406B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

File created: C:\Users\user\AppData\Local\Temp\autFFFD.tmp

Jump to behavior

Source: aS39AS7b0P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4161350398.00000000028F6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002914000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002906000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: aS39AS7b0P.exe	ReversingLabs: Detection: 71%
Source: aS39AS7b0P.exe	Virustotal: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\aS39AS7b0P.exe "C:\Users\user\Desktop\aS39AS7b0P.exe"
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\aS39AS7b0P.exe"
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\aS39AS7b0P.exe"	Jump to behavior

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: aS39AS7b0P.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: aS39AS7b0P.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: aS39AS7b0P.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: aS39AS7b0P.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: aS39AS7b0P.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: aS39AS7b0P.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: aS39AS7b0P.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: aS39AS7b0P.exe, 00000000.00000003.1701416100.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, aS39AS7b0P.exe, 00000000.00000003.1702728769.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aS39AS7b0P.exe, 00000000.00000003.1701416100.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, aS39AS7b0P.exe, 00000000.00000003.1702728769.0000000003AD0000.00000004.00001000.00020000.00000000.sdmp

Source: aS39AS7b0P.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: aS39AS7b0P.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: aS39AS7b0P.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: aS39AS7b0P.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: aS39AS7b0P.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007BE01E LoadLibraryA,GetProcAddress,

0_2_007BE01E

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007CC09E push esi; ret	0_2_007CC0A0
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007CC187 push edi; ret	0_2_007CC189
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_0080C8BC push esi; ret	0_2_0080C8BE
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007C6B05 push ecx; ret	0_2_007C6B18
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EB2B1 push FFFFFF8Bh; iretd	0_2_007EB2B3
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007CBDAA push edi; ret	0_2_007CBDAC
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007CBEC3 push esi; ret	0_2_007CBEC5

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_00808111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00808111
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007BEB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_007BEB42

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007C123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_007C123A

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

API/Special instruction interceptor: Address: 1562C8C

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: aS39AS7b0P.exe, 00000000.00000002.1703828409.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, aS39AS7b0P.exe, 00000000.00000003.1691611629.0000000001365000.00000004.00000020.00020000.00000000.sdmp, aS39AS7b0P.exe, 00000000.00000003.1692110888.00000000013DC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCMON.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599651	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598752	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598170	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598058	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596900	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8101			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1752			Jump to behavior

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Evaded block: after key decision

graph_0-93432

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-94064

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

API coverage: 4.5 %

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007E6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007E6CA9
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007E60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_007E60DD
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007E63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_007E63F9
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007EEB60
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EF56F FindFirstFileW,FindClose,	0_2_007EF56F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007EF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007EF5FA
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007F1B2F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007F1C8A
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007F1F94

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007BDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007BDDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599651	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598752	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598170	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598058	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596900	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4160402648.0000000000A09000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007F6AAF BlockInput,

0_2_007F6AAF

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007A3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_007A3D19

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007D3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_007D3920

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007BE01E LoadLibraryA,GetProcAddress,

0_2_007BE01E

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_015618C8 mov eax, dword ptr fs:[00000030h]	0_2_015618C8
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_01562F58 mov eax, dword ptr fs:[00000030h]	0_2_01562F58
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_01562EF8 mov eax, dword ptr fs:[00000030h]	0_2_01562EF8

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007DA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_007DA66C

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007C81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_007C81AC
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007C8189 SetUnhandledExceptionFilter,		0_2_007C8189

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42D008

Jump to behavior

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007DB106 LogonUserW,

0_2_007DB106

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007A3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_007A3D19

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007E411C SendInput,keybd_event,

0_2_007E411C

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007E74E7 mouse_event,

0_2_007E74E7

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\aS39AS7b0P.exe"

Jump to behavior

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

0_2_007DA66C

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007E71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_007E71FA

Source: aS39AS7b0P.exe	Binary or memory string: Shell_TrayWnd
Source: aS39AS7b0P.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007C65C4 cpuid

0_2_007C65C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007F091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_007F091D

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_0081B340 GetUserNameW,

0_2_0081B340

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007D1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_007D1E8E

Source: C:\Users\user\Desktop\aS39AS7b0P.exe

Code function: 0_2_007BDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007BDDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Binary or memory string: procmon.exe

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4161350398.0000000002883000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4161350398.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aS39AS7b0P.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7364, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: aS39AS7b0P.exe	Binary or memory string: WIN_81
Source: aS39AS7b0P.exe	Binary or memory string: WIN_XP
Source: aS39AS7b0P.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: aS39AS7b0P.exe	Binary or memory string: WIN_XPe
Source: aS39AS7b0P.exe	Binary or memory string: WIN_VISTA
Source: aS39AS7b0P.exe	Binary or memory string: WIN_7
Source: aS39AS7b0P.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aS39AS7b0P.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7364, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.aS39AS7b0P.exe.1230000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.aS39AS7b0P.exe.1230000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4161350398.0000000002883000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4161350398.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aS39AS7b0P.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7364, type: MEMORYSTR

Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_007F8C4F
Source: C:\Users\user\Desktop\aS39AS7b0P.exe	Code function: 0_2_007F923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_007F923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aS39AS7b0P.exe	71%	ReversingLabs	Win32.Trojan.AutoitInject
aS39AS7b0P.exe	70%	Virustotal		Browse
aS39AS7b0P.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.comh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.112.1	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
18.31.95.13.in-addr.arpa	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000276F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4161350398.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comh	RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	aS39AS7b0P.exe, 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.00000000027BF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.4161350398.0000000002794000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000281D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002866000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.0000000002875000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000280F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	aS39AS7b0P.exe, 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4161350398.000000000277C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.112.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589073
Start date and time:	2025-01-11 09:11:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aS39AS7b0P.exe renamed because original name is a hash value
Original Sample Name:	de7e8561b2cf84f247a1f76a1fb4f1a53b5fd18b093d880bf563fd1b55a97d71.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@3/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 295
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.95.31.18, 20.12.23.50, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 7364 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:12:37	API Interceptor	10541765x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	fqbVL4XxCr.exe	Get hash	malicious	FormBook	Browse	www.vilakodsiy.sbs/w7eo/
	BalphRTkPS.exe	Get hash	malicious	FormBook	Browse	www.kkpmoneysocial.top/86am/
	9MZZG92yMO.exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/qzi3/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/w98i/
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
158.101.44.242	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	yqfze5TKW7.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	VCU262Y2QB.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	WGi85dsMNp.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
reallyfreegeoip.org	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
CLOUDFLARENETUS	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	Exodus.txt.lnk	Get hash	malicious	StormKitty	Browse	104.16.185.241
	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	z6tNjJC614.exe	Get hash	malicious	FormBook	Browse	104.21.42.77
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	lrw6UNGsUC.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	Q7QR4k52HL.exe	Get hash	malicious	LummaC	Browse	104.21.48.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1

Process:	C:\Users\user\Desktop\aS39AS7b0P.exe
File Type:	data
Category:	dropped
Size (bytes):	88964
Entropy (8bit):	7.894440044316975
Encrypted:	false
SSDEEP:	1536:XcyMgxxM8wvHTremAcAOT217UuVRamiYlVO7k0zLXZpMoaIXV5F:XLxi/73Fq1iZYlVOrXE83F
MD5:	172B0CA42FD98669A39C0340E7E4D32D
SHA1:	D24880FD0F34199B96495503464A1A3A64C463C0
SHA-256:	C08E9EF93553ACF96F6E348FC81A4A5012BF23AFA2BA2965008B4CA57892F528
SHA-512:	BC98219E385C814A7BD5F4D75CE15541445DBCAD124F42FA8C9E4AD4196B703C383D01BF290C8B5EAEF7B17A81C2362F419D2220722322581612A6FD0C8ADB1C
Malicious:	false
Reputation:	low
Preview:	EA06.......uz.BoU.L.M.2.P..(..^.P..j..E.gD.Q...7...6..Ej....<....B...69..t.M+.9...f.H.3I...2..&.:.s).@......S._...u..#18.j.{.T...OF.....BkT..`.J7..P....1..T..K ..p....:.j.. L..J..Fh..Z.Q&tJ..F+...B.0.Q(.0.F.9....1D....5...6......u\|..^......~.z.B~.%.tf.W...v.D..f....MQ....0.N..>.<.Y..e2.....~fV.Hi......q.......3..Zf.R.H'.`./..P..Z\|t...&!..E.._.q....iF.......Q.\f._@.......&.sD.k...Q...S.]\|..S..B..i....H..........I...p.!".$&............BT.HN...%J?u.L+....x.L(.:..)#..j.....3.H..G..Z.L..I.R..Q.:..sC....\E..D.Nx.Z<.....:..N.0....:%j.3.K(.z..;s.L...4.P......P..Q...:.H#Q.Uz.Z.G.......q.@N...@..H6JmR.G.[g6......F..EX.KT0.-T...I.t$uZ...f.I.....'a...z..`.$I...]......j.n.L....m:.s.U......[.tJ..al...7..b._.l.+.faD.....S...i...:..Q0..]i.U(..@....Dj@...........;V....D.sj4<.;.J...L.S..V/\...V.V..P..h.....4.}6.h.jl..H.]..*-._W.U.Q...W3.U.Q...h..^..J5../..-.......$.s...l.Y.h..3.<..0.Om7..x.@_....:.c7.3.P.T-.h..D..4:...5.w@6.l..r...{J.^.z...{.AB1D.Y@$.

C:\Users\user\AppData\Local\Temp\tapestring

Download File

Process:	C:\Users\user\Desktop\aS39AS7b0P.exe
File Type:	data
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	6.911280006088806
Encrypted:	false
SSDEEP:	3072:LNMCqaQDDi4ien8lpn35aIq/HzHP5Dfy32UJIRWI:5MCqJDqBT35YjjJ
MD5:	D55209F113CBF203F0226993DFB8B0B3
SHA1:	7D3A01B3885A1E91BD0F3465B718326EF8AD33D0
SHA-256:	F14DD55537E0C3BC3358610F7305351CBD8AC05CC1A81772653FDB8B81B1CE17
SHA-512:	5FB50860677A083BE7F476D508C5CB5D34885C58F66A5E99C1CDDED410196BA5C9D9BA9C8F50E263629595E976255DF5BC409C055F0A0CE423E076872D709C0C
Malicious:	false
Reputation:	low
Preview:	.c.WYP7UT0TD..DP.0F9CWZPwUP0TDF3DPG0F9CWZP7UP0TDF3DPG0F9CWZP.UP0Z[.=D.N.g.B..qc=9Ct44\#"&]fZ"94?Cu2Ut63]d9)..v.w7?S0~=YNb3DPG0F9..ZP{TS0.i.UDPG0F9CW.P5T[1.DF.EPG$F9CWZP.FR0TdF3DpE0F9.WZp7UP2TDB3DPG0F9GWZP7UP0T$D3DRG0F9CWXPw.P0DDF#DPG0V9CGZP7UP0DDF3DPG0F9CW.B5U.0TDF.FP. F9CWZP7UP0TDF3DPG0FyAWVP7UP0TDF3DPG0F9CWZP7UP0TDF3DPG0F9CWZP7UP0TDF3DPG0F9CwZP?UP0TDF3DPG0N.CW.P7UP0TDF3DPiD#A7WZP..Q0TdF3D.F0F;CWZP7UP0TDF3DPg0FYm%)"TUP0.TF3DpE0F+CWZ.6UP0TDF3DPG0F9.WZ..'5\;'F3HPG0FyAWZR7UP8VDF3DPG0F9CWZPwUPrTDF3DPG0F9CWZP7U@#VDF3DP.0F9AW_P.tQ0..F3GPG0.9CQbq6U.0TDF3DPG0F9CWZP7UP0TDF3DPG0F9CWZP7UP0TDF3DP.M.6..9D..0TDF3DQE3B?K_ZP7UP0TD83DP.0F9.WZP.UP0qDF3)PG0b9CW$P7U.0TD"3DP50F9"WZPpUP0;DF3*PG089CWDR.uP0^n`3Fxf0F3C}.#.UP:.EF3@#d0F3.UZP3&t0TN.0DPCCc9C].T7UTCrDF9.UG0B..WY.!SP0O+.3DZG3.,EWZK.sP2\|~F3NPm.F:.B\P7Nz.TF.:DPC..J^WZV..P0^0O3DR.:F9G}DR..P0^ndMTPG4m9iu$A7UT.TndMVPG4m9iu$C7UT.TndMPPG4m9iIX.#UP4~f8&DPC.F.a)LP7Q{0~f8$DPC.F.]U.G7UT.Rn$36i[06:,.ZP1}.0TNnSDPA0l.C)zP7QR_.DF9bz.0D.@VZZ7WSMbDF7FT:.F9G}.P5.i0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.890678571997542
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aS39AS7b0P.exe
File size:	1'025'536 bytes
MD5:	10f089d7b9e39a47f1ba6e9ca2086d25
SHA1:	9fd173cf8141ed645d09cf87ccd569994c926eff
SHA256:	de7e8561b2cf84f247a1f76a1fb4f1a53b5fd18b093d880bf563fd1b55a97d71
SHA512:	2e7ad3ef6f8bc4ab620974450e85eb96307952a118c36637b653a3330d495f87c8c88f1c07e33117b130501761ddd42273897f62c083396058b3a2c0b931080a
SSDEEP:	24576:4tb20pkaCqT5TBWgNQ7aq93uFD82aSx6A:BVg5tQ7aqaTaa5
TLSH:	F225BF1373DE8361C3B25273BA65B741AEBF782506B1F56B2FD4093DE920122521EA73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6748F70D [Thu Nov 28 23:04:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007EFEC8F52F3Fh
jmp 00007EFEC8F45F54h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007EFEC8F460DAh
cmp edi, eax
jc 00007EFEC8F4643Eh
bt dword ptr [004C0158h], 01h
jnc 00007EFEC8F460D9h
rep movsb
jmp 00007EFEC8F463ECh
cmp ecx, 00000080h
jc 00007EFEC8F462A4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007EFEC8F460E0h
bt dword ptr [004BA370h], 01h
jc 00007EFEC8F465B0h
bt dword ptr [004C0158h], 00000000h
jnc 00007EFEC8F4627Dh
test edi, 00000003h
jne 00007EFEC8F4628Eh
test esi, 00000003h
jne 00007EFEC8F4626Dh
bt edi, 02h
jnc 00007EFEC8F460DFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007EFEC8F460E3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007EFEC8F46135h
bt esi, 03h
jnc 00007EFEC8F46188h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x31404	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf6000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x31404	0x31600	debc4edffaada9ca914e25066cbda521	False	0.8654519382911392	data	7.73769908027459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf6000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x28709	data			1.000368266310877
RT_GROUP_ICON	0xf4ec4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xf4f3c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf4f50	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xf4f64	0x14	data	English	Great Britain	1.25
RT_VERSION	0xf4f78	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xf5054	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:12:37.633234+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	158.101.44.242	80	TCP
2025-01-11T09:12:38.726915+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	158.101.44.242	80	TCP
2025-01-11T09:12:39.326128+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49732	104.21.112.1	443	TCP
2025-01-11T09:12:40.105937+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	158.101.44.242	80	TCP
2025-01-11T09:12:46.406487+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49742	104.21.112.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:12:36.844780922 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:36.849675894 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:36.849751949 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:36.850209951 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:36.854978085 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:37.414777040 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:37.422501087 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:37.427403927 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:37.577548027 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:37.633234024 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:37.834789038 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:37.834903955 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:37.834983110 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:37.847100973 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:37.847146988 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.312516928 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.312746048 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.320393085 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.320442915 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.320966005 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.367552042 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.399884939 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.443339109 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.508663893 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.508755922 CET	443	49731	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.508819103 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.516622066 CET	49731	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.521152020 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:38.526182890 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:38.676266909 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:38.692755938 CET	49732	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.692820072 CET	443	49732	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.692882061 CET	49732	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.693734884 CET	49732	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:38.693758965 CET	443	49732	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:38.726914883 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:39.174813986 CET	443	49732	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:39.177077055 CET	49732	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:39.177103996 CET	443	49732	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:39.325695038 CET	443	49732	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:39.325784922 CET	443	49732	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:39.325858116 CET	49732	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:39.326459885 CET	49732	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:39.331264019 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:39.332811117 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:39.336322069 CET	80	49730	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:39.336407900 CET	49730	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:39.337642908 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:39.337711096 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:39.337857008 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:39.342662096 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:40.105669022 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:40.105937004 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:40.107420921 CET	49734	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:40.107470989 CET	443	49734	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:40.107532978 CET	49734	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:40.109420061 CET	49734	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:40.109430075 CET	443	49734	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:40.110963106 CET	80	49733	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:40.111032963 CET	49733	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:40.584470034 CET	443	49734	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:40.602602959 CET	49734	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:40.602617979 CET	443	49734	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:40.724941969 CET	443	49734	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:40.725025892 CET	443	49734	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:40.725063086 CET	49734	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:40.800718069 CET	49734	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:40.817008972 CET	49735	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:40.821959019 CET	80	49735	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:40.822067022 CET	49735	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:40.822304964 CET	49735	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:40.827089071 CET	80	49735	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:41.388544083 CET	80	49735	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:41.390280008 CET	49736	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:41.390338898 CET	443	49736	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:41.390403032 CET	49736	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:41.390748978 CET	49736	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:41.390763044 CET	443	49736	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:41.430109978 CET	49735	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:41.848004103 CET	443	49736	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:41.850482941 CET	49736	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:41.850516081 CET	443	49736	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:41.998613119 CET	443	49736	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:41.998788118 CET	443	49736	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:41.998850107 CET	49736	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:41.999300957 CET	49736	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:42.003773928 CET	49735	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:42.004713058 CET	49737	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:42.011266947 CET	80	49737	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:42.011341095 CET	49737	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:42.011534929 CET	49737	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:42.015094042 CET	80	49735	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:42.015149117 CET	49735	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:42.017307997 CET	80	49737	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:42.886188030 CET	80	49737	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:42.887815952 CET	49738	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:42.887867928 CET	443	49738	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:42.887938976 CET	49738	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:42.888228893 CET	49738	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:42.888242006 CET	443	49738	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:42.930099964 CET	49737	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:43.364010096 CET	443	49738	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:43.365909100 CET	49738	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:43.365936041 CET	443	49738	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:43.504307985 CET	443	49738	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:43.504465103 CET	443	49738	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:43.504555941 CET	49738	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:43.505206108 CET	49738	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:43.509161949 CET	49737	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:43.510119915 CET	49739	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:43.514302015 CET	80	49737	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:43.514403105 CET	49737	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:43.514982939 CET	80	49739	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:43.515072107 CET	49739	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:43.515218019 CET	49739	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:43.520042896 CET	80	49739	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:44.619976997 CET	80	49739	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:44.621962070 CET	49740	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:44.622011900 CET	443	49740	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:44.622091055 CET	49740	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:44.622446060 CET	49740	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:44.622456074 CET	443	49740	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:44.664480925 CET	49739	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:45.077501059 CET	443	49740	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:45.100056887 CET	49740	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:45.100090981 CET	443	49740	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:45.226089954 CET	443	49740	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:45.226188898 CET	443	49740	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:45.226267099 CET	49740	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:45.227229118 CET	49740	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:45.231831074 CET	49739	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:45.233226061 CET	49741	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:45.236877918 CET	80	49739	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:45.236953020 CET	49739	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:45.238171101 CET	80	49741	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:45.238245964 CET	49741	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:45.238359928 CET	49741	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:45.243160963 CET	80	49741	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:45.800664902 CET	80	49741	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:45.802840948 CET	49742	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:45.802891016 CET	443	49742	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:45.802962065 CET	49742	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:45.803257942 CET	49742	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:45.803268909 CET	443	49742	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:45.851985931 CET	49741	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:46.257689953 CET	443	49742	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:46.259660959 CET	49742	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:46.259695053 CET	443	49742	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:46.406589985 CET	443	49742	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:46.406764030 CET	443	49742	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:46.406848907 CET	49742	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:46.407371998 CET	49742	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:46.410914898 CET	49741	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:46.412306070 CET	49743	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:46.415944099 CET	80	49741	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:46.416028976 CET	49741	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:46.417206049 CET	80	49743	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:46.417294025 CET	49743	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:46.417385101 CET	49743	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:46.422225952 CET	80	49743	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:46.980377913 CET	80	49743	158.101.44.242	192.168.2.4
Jan 11, 2025 09:12:46.982361078 CET	49744	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:46.982417107 CET	443	49744	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:46.982485056 CET	49744	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:46.982840061 CET	49744	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:46.982855082 CET	443	49744	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:47.024389029 CET	49743	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:12:47.447220087 CET	443	49744	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:47.449145079 CET	49744	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:47.449208021 CET	443	49744	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:47.596441984 CET	443	49744	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:47.596621037 CET	443	49744	104.21.112.1	192.168.2.4
Jan 11, 2025 09:12:47.596687078 CET	49744	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:12:47.597085953 CET	49744	443	192.168.2.4	104.21.112.1
Jan 11, 2025 09:13:08.860529900 CET	64920	53	192.168.2.4	162.159.36.2
Jan 11, 2025 09:13:08.865489006 CET	53	64920	162.159.36.2	192.168.2.4
Jan 11, 2025 09:13:08.865597963 CET	64920	53	192.168.2.4	162.159.36.2
Jan 11, 2025 09:13:08.870527983 CET	53	64920	162.159.36.2	192.168.2.4
Jan 11, 2025 09:13:09.333472013 CET	64920	53	192.168.2.4	162.159.36.2
Jan 11, 2025 09:13:09.338532925 CET	53	64920	162.159.36.2	192.168.2.4
Jan 11, 2025 09:13:09.338591099 CET	64920	53	192.168.2.4	162.159.36.2
Jan 11, 2025 09:13:51.980356932 CET	80	49743	158.101.44.242	192.168.2.4
Jan 11, 2025 09:13:51.980683088 CET	49743	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:14:26.993218899 CET	49743	80	192.168.2.4	158.101.44.242
Jan 11, 2025 09:14:26.998085976 CET	80	49743	158.101.44.242	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:12:36.827387094 CET	64905	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:12:36.834822893 CET	53	64905	1.1.1.1	192.168.2.4
Jan 11, 2025 09:12:37.824960947 CET	52733	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:12:37.833573103 CET	53	52733	1.1.1.1	192.168.2.4
Jan 11, 2025 09:13:08.859894991 CET	53	55347	162.159.36.2	192.168.2.4
Jan 11, 2025 09:13:09.363558054 CET	59134	53	192.168.2.4	1.1.1.1
Jan 11, 2025 09:13:09.371042013 CET	53	59134	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:12:36.827387094 CET	192.168.2.4	1.1.1.1	0x69b8	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.824960947 CET	192.168.2.4	1.1.1.1	0xbe23	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:13:09.363558054 CET	192.168.2.4	1.1.1.1	0x2c86	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:12:36.834822893 CET	1.1.1.1	192.168.2.4	0x69b8	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:12:36.834822893 CET	1.1.1.1	192.168.2.4	0x69b8	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:36.834822893 CET	1.1.1.1	192.168.2.4	0x69b8	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:36.834822893 CET	1.1.1.1	192.168.2.4	0x69b8	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:36.834822893 CET	1.1.1.1	192.168.2.4	0x69b8	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:36.834822893 CET	1.1.1.1	192.168.2.4	0x69b8	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.833573103 CET	1.1.1.1	192.168.2.4	0xbe23	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.833573103 CET	1.1.1.1	192.168.2.4	0xbe23	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.833573103 CET	1.1.1.1	192.168.2.4	0xbe23	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.833573103 CET	1.1.1.1	192.168.2.4	0xbe23	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.833573103 CET	1.1.1.1	192.168.2.4	0xbe23	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.833573103 CET	1.1.1.1	192.168.2.4	0xbe23	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:12:37.833573103 CET	1.1.1.1	192.168.2.4	0xbe23	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:13:09.371042013 CET	1.1.1.1	192.168.2.4	0x2c86	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	158.101.44.242	80	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:12:36.850209951 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 09:12:37.414777040 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5a39e6e90ec0bcc5b73294604f794b40 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 09:12:37.422501087 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 09:12:37.577548027 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4553290c239c5a2aac92faf6ebc0052d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 11, 2025 09:12:38.521152020 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 09:12:38.676266909 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 46597a94574970c1d342c05221394ca3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	158.101.44.242	80	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:12:39.337857008 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 11, 2025 09:12:40.105669022 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2856cea54cd4a5269bcd5abe3da1d85f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	158.101.44.242	80	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:12:40.822304964 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 09:12:41.388544083 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2232eeebbfa485dab6122464a4206ce3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	158.101.44.242	80	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:12:42.011534929 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 09:12:42.886188030 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 01ccffea22187bae04cb55c6aedb0394 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	158.101.44.242	80	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:12:43.515218019 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 09:12:44.619976997 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 28d79659c45ec8c59fe3a1f240e9e119 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	158.101.44.242	80	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:12:45.238359928 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 09:12:45.800664902 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:45 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cf3d44d4c8a514538a40809544b02387 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	158.101.44.242	80	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:12:46.417385101 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 11, 2025 09:12:46.980377913 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 336eedee68e64c56050a58f7d5fa5f01 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:38 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 08:12:38 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:38 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897947 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=emiM11k0pf0Ur8QppKKm9l9W3W5vYS92y7TOSE9Yv4rcsKQ79hz%2B4SSw%2FR2gIGKFxTlw5cqUSEXMRmPPyOsE3412f5pBJ64b5HHFCDCvmgWNfIaChY%2FntNuibSuDGkkth9tvq4DD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900371645c27424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1582&rtt_var=597&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1828428&cwnd=248&unsent_bytes=0&cid=ae2033adc0e62871&ts=211&x=0"
2025-01-11 08:12:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:39 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 08:12:39 UTC	855	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:39 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897948 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mOyH0GwirinjGVpovM0mpje5y7vKgJAZm5E053c1OtmyH2%2FvG1YKwIdpqMsssHg2AX3DlLG8s3KyGXcsdyzDfNwbAur4OTQ4f5bkJvjZg6Ud6JLlRaaco8%2BmhFukzXl%2Fq7dFpL2O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900371696f87424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1557&min_rtt=1553&rtt_var=590&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1842271&cwnd=248&unsent_bytes=0&cid=2b13825ef2a798ab&ts=154&x=0"
2025-01-11 08:12:39 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:40 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 08:12:40 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:40 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897949 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7nrrwGlBEhYn%2B6ynLZO6pKsb9XR4H4IT0dLOBY%2FNn6XHuyaWkPOsIzd2ORj8lnxjk452gDcg9OZe%2Fwf5gsUiP56IRMn1corB%2FLZEoITkOOi15vkDIG8LmFj2Y1n%2BLl4X7q4YXt8t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9003717228b643b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1607&min_rtt=1588&rtt_var=634&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1674311&cwnd=203&unsent_bytes=0&cid=24be5a1f50a77e84&ts=147&x=0"
2025-01-11 08:12:40 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:41 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 08:12:41 UTC	865	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:41 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897951 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tBFHKyOm%2BCBRupljYD8CGKuLVdbnegoQ%2FoPj%2FJW8ODFysOG7APiBvAyysIicFeVWg6R1OSA33yFWFZY9cifSnjVyveBO7NmFo0%2Bx%2FRFro4js93eB%2FbWilcPN%2BKYMOKc1Otd%2FG1HP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9003717a2ec1729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2024&min_rtt=2020&rtt_var=766&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1421616&cwnd=169&unsent_bytes=0&cid=84a204faf5155875&ts=160&x=0"
2025-01-11 08:12:41 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:43 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 08:12:43 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:43 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897952 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6PWpouDtvxBsuFlcSq8PZpGRg1sEFzVRdehTfNEPwUL8YyuYj0pXyrjNFLLrUq8XugCBgrzub7s6oYOkXMfCfcs4Vvq7uW33auCWvN6%2FhnmJj69HRZ8Hd1AaKk7hibO%2FahM2HChN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900371839c42424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1543&rtt_var=591&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1833019&cwnd=248&unsent_bytes=0&cid=775113ecd0475077&ts=148&x=0"
2025-01-11 08:12:43 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:45 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 08:12:45 UTC	861	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897954 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uV%2Bi9HdumhwHP%2F4ne2b4MCPMQ4gQd%2BbDyCzXKva14AHVHSg2TrsDTFgaWkdPkMUgrkVrtAegH4dBY69wQLNhX3LxHS4hPRUTotYegflqh90%2FJvOKeUbSlUc6L4%2BJfN%2FjPt1wAzsZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9003718e5815c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1454&min_rtt=1448&rtt_var=556&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1945369&cwnd=181&unsent_bytes=0&cid=c0e01d775915c18d&ts=154&x=0"
2025-01-11 08:12:45 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:46 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-11 08:12:46 UTC	857	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:46 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897955 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sqy0pfVSGL6B%2B2Ry5Fk%2BeQ%2B1awxCBtj6%2BhU1f68VFwKg6qlh4GpfZTSLsFfBBenL1aAH74dMXjddUCe9e9ScL7smVrGckqi7v54539L7FjDgnuu5SA1yxxDaI2JmAOmJk8VD0zAF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90037195bf65729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2025&min_rtt=2003&rtt_var=767&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1457813&cwnd=169&unsent_bytes=0&cid=1d0f681582105049&ts=153&x=0"
2025-01-11 08:12:46 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	104.21.112.1	443	7364	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 08:12:47 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-11 08:12:47 UTC	853	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 08:12:47 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1897956 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hv7NvJppzEO5r6hDbnJF1Mv5J2noLMS674n8nxXJxPtK4ltM3UwD2cxD9XBBQb2qXgpdBEduoSWxm2Ti60pd8jyTtDrWrtt5%2BvhlCt8cOfvqm43kthkbbPJu3pN5Q6sRWHO9%2F5cj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9003719d282d0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1580&rtt_var=610&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1766485&cwnd=221&unsent_bytes=0&cid=df661273400bd3b3&ts=154&x=0"
2025-01-11 08:12:47 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	03:12:34
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\aS39AS7b0P.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aS39AS7b0P.exe"
Imagebase:	0x7a0000
File size:	1'025'536 bytes
MD5 hash:	10F089D7B9E39A47F1BA6E9CA2086D25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1703709649.0000000001230000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:12:35
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aS39AS7b0P.exe"
Imagebase:	0x310000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000002.4160242776.0000000000702000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.4161350398.0000000002883000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.4161350398.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	1%
Signature Coverage:	4%
Total number of Nodes:	1960
Total number of Limit Nodes:	169

Executed Functions

Function 007CB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37997999f5f3e1fdfedf8130288f29967f1c83acf0b1b99d9e88f0d60b1181a
Instruction ID: f7ddc0f53e285c60fbb51555a9b641fd5bf6c4bb230781d9883408b867b343aa
Opcode Fuzzy Hash: f37997999f5f3e1fdfedf8130288f29967f1c83acf0b1b99d9e88f0d60b1181a
Instruction Fuzzy Hash: 9E325C75B022688FDB248F54DC86BE9B7B5FB46310F1840DDE80AA7A91D7349E80CF52

Function 007A3D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,007A3AA3,?), ref: 007A3D45
IsDebuggerPresent.KERNEL32(?,?,?,?,007A3AA3,?), ref: 007A3D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,00861148,00861130,?,?,?,?,007A3AA3,?), ref: 007A3DC8

Part of subcall function 007A6430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,007A3DEE,00861148,?,?,?,?,?,007A3AA3,?), ref: 007A6471

SetCurrentDirectoryW.KERNEL32(?,?,?,007A3AA3,?), ref: 007A3E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,008528F4,00000010), ref: 00811CCE
SetCurrentDirectoryW.KERNEL32(?,00861148,?,?,?,?,?,007A3AA3,?), ref: 00811D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0083DAB4,00861148,?,?,?,?,?,007A3AA3,?), ref: 00811D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,007A3AA3), ref: 00811D90

Part of subcall function 007A3E6E: GetSysColorBrush.USER32(0000000F), ref: 007A3E79
Part of subcall function 007A3E6E: LoadCursorW.USER32(00000000,00007F00), ref: 007A3E88
Part of subcall function 007A3E6E: LoadIconW.USER32(00000063), ref: 007A3E9E
Part of subcall function 007A3E6E: LoadIconW.USER32(000000A4), ref: 007A3EB0
Part of subcall function 007A3E6E: LoadIconW.USER32(000000A2), ref: 007A3EC2
Part of subcall function 007A3E6E: RegisterClassExW.USER32(?), ref: 007A3F30

Part of subcall function 007A36B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007A36E6
Part of subcall function 007A36B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007A3707
Part of subcall function 007A36B8: ShowWindow.USER32(00000000,?,?,?,?,007A3AA3,?), ref: 007A371B
Part of subcall function 007A36B8: ShowWindow.USER32(00000000,?,?,?,?,007A3AA3,?), ref: 007A3724

Part of subcall function 007A4FFC: _memset.LIBCMT ref: 007A5022
Part of subcall function 007A4FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007A50CB

Strings

This is a third-party compiled AutoIt script., xrefs: 00811CC8
runas, xrefs: 00811D84

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-3287110873
Opcode ID: 368bef9b303bee4844f187373659f362d5a07fbb91df285a7a75c6c2406e7192
Instruction ID: 8c39d261500a7139a966ffba5dbc2f0eeda9a37d0f485397cd34ab73da3f324f
Opcode Fuzzy Hash: 368bef9b303bee4844f187373659f362d5a07fbb91df285a7a75c6c2406e7192
Instruction Fuzzy Hash: 3B51D631A08248EACF11ABF0DC4DEED7B79FF97700F045265F611A2292DA7D4649CB21

Function 007BDDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 007BDDEC
GetCurrentProcess.KERNEL32(00000000,0083DC38,?,?), ref: 007BDEAC
GetNativeSystemInfo.KERNELBASE(?,0083DC38,?,?), ref: 007BDF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 007BDF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 007BDF1F
GetSystemInfo.KERNEL32(?,0083DC38,?,?), ref: 007BDF29
GetSystemInfo.KERNEL32(?,0083DC38,?,?), ref: 007BDF35

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: 7905080df7b1b21e2a42cfb21111a7a03d74a95ccf7219b1abe53a34c873c048
Instruction ID: fc0b9cac00c920116d94a05afe6da102f41f034d383c6e2a905a93bb64da8541
Opcode Fuzzy Hash: 7905080df7b1b21e2a42cfb21111a7a03d74a95ccf7219b1abe53a34c873c048
Instruction Fuzzy Hash: E861A1B180A384CFCF25CF6898C16E97FB4AF29300F1989D9D8459F207D638C949CB69

Function 007A406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,007A449E,?,?,00000000,00000001), ref: 007A407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,007A449E,?,?,00000000,00000001), ref: 007A4092
LoadResource.KERNEL32(?,00000000,?,?,007A449E,?,?,00000000,00000001,?,?,?,?,?,?,007A41FB), ref: 00814F1A
SizeofResource.KERNEL32(?,00000000,?,?,007A449E,?,?,00000000,00000001,?,?,?,?,?,?,007A41FB), ref: 00814F2F
LockResource.KERNEL32(007A449E,?,?,007A449E,?,?,00000000,00000001,?,?,?,?,?,?,007A41FB,00000000), ref: 00814F42

Strings

SCRIPT, xrefs: 007A4088

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: b666d528ec3a069b6eec0207ae88ba3bcff6eae81a9ef124b1a092d67e848191
Instruction ID: 3417408c82b60144f40f3ec6cf7acb5851402975b0fdb029f5bb3663697e950d
Opcode Fuzzy Hash: b666d528ec3a069b6eec0207ae88ba3bcff6eae81a9ef124b1a092d67e848191
Instruction Fuzzy Hash: DD112E71200701BFE7318B65DC48F677BB9FBC5B51F10856DF61296250DAB2EC019A70

Function 007E6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00812F49), ref: 007E6CB9
FindFirstFileW.KERNELBASE(?,?), ref: 007E6CCA
FindClose.KERNEL32(00000000), ref: 007E6CDA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 74c269dbd59009be76b3951bd8b5ca498d0de2e1cd06e0703c946dcf71e2d0e7
Instruction ID: a4bd497741586422e3d187015bbccbd106d1fa37993d01a649c9d0c10b830389
Opcode Fuzzy Hash: 74c269dbd59009be76b3951bd8b5ca498d0de2e1cd06e0703c946dcf71e2d0e7
Instruction Fuzzy Hash: 6AE0D8358116105B82206738EC0D4E97B6CFA19379F204706F571C21E0E774E91055E6

Function 007AE8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007AE959
timeGetTime.WINMM ref: 007AEBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007AED2E
TranslateMessage.USER32(?), ref: 007AED3F
DispatchMessageW.USER32(?), ref: 007AED4A
LockWindowUpdate.USER32(00000000), ref: 007AED79
DestroyWindow.USER32 ref: 007AED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007AED9F
Sleep.KERNEL32(0000000A), ref: 00815270
TranslateMessage.USER32(?), ref: 008159F7
DispatchMessageW.USER32(?), ref: 00815A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00815A19

Strings

@GUI_CTRLID, xrefs: 00815314
@GUI_CTRLHANDLE, xrefs: 008153AC
@TRAY_ID, xrefs: 008154C9
@GUI_WINHANDLE, xrefs: 00815360

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 111aa6d5891e4296188ba62c45aa0d75a31041194fad23b6b17c4cc3eeeb6393
Instruction ID: dc7881ab4b7e182f98b939cfc17fea7f73215ef6a0fa89963a75cf57bb7b9d41
Opcode Fuzzy Hash: 111aa6d5891e4296188ba62c45aa0d75a31041194fad23b6b17c4cc3eeeb6393
Instruction Fuzzy Hash: 7C62A570508340DFDB24DF24C899BAA77E5FF85304F144A6DF9868B292DB79D884CB62

Function 007D5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 007D5EC3
___createFile.LIBCMT ref: 007D5F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 007D5F2D
__dosmaperr.LIBCMT ref: 007D5F34
GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 007D5F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 007D5F6A
__dosmaperr.LIBCMT ref: 007D5F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 007D5F7C
__set_osfhnd.LIBCMT ref: 007D5FAC
__lseeki64_nolock.LIBCMT ref: 007D6016
__close_nolock.LIBCMT ref: 007D603C
__chsize_nolock.LIBCMT ref: 007D606C
__lseeki64_nolock.LIBCMT ref: 007D607E
__lseeki64_nolock.LIBCMT ref: 007D6176
__lseeki64_nolock.LIBCMT ref: 007D618B
__close_nolock.LIBCMT ref: 007D61EB

Part of subcall function 007CEA9C: CloseHandle.KERNELBASE(00000000,0084EEF4,00000000,?,007D6041,0084EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 007CEAEC
Part of subcall function 007CEA9C: GetLastError.KERNEL32(?,007D6041,0084EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 007CEAF6
Part of subcall function 007CEA9C: __free_osfhnd.LIBCMT ref: 007CEB03
Part of subcall function 007CEA9C: __dosmaperr.LIBCMT ref: 007CEB25

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

__lseeki64_nolock.LIBCMT ref: 007D620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 007D6342
___createFile.LIBCMT ref: 007D6361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 007D636E
__dosmaperr.LIBCMT ref: 007D6375
__free_osfhnd.LIBCMT ref: 007D6395
__invoke_watson.LIBCMT ref: 007D63C3
__wsopen_helper.LIBCMT ref: 007D63DD

Strings

@, xrefs: 007D5F98

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: e39b53ca17a09ad656704b22fbd9649c45850da97a52af31970328d6ef398eae
Instruction ID: 95381446f58fd12c95f2d7c0699645bbac79e56e423316a70ab3560ad36101d5
Opcode Fuzzy Hash: e39b53ca17a09ad656704b22fbd9649c45850da97a52af31970328d6ef398eae
Instruction Fuzzy Hash: A4220771A0060A9BEB299F68CC85BBD7B72FB14324F24422EE5219B3D1D63D8D40CB61

Function 007CEE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 4837d9f712ec613c7ed274279fc5e89f87f26d39455a2e4dedeaf37668581820
Instruction ID: 76e68b11653e5e87bb896a170825d529d142f3688bcd397e66cf8322ae26876c
Opcode Fuzzy Hash: 4837d9f712ec613c7ed274279fc5e89f87f26d39455a2e4dedeaf37668581820
Instruction Fuzzy Hash: A9324670A04285DFDB218F68D880FADBBB3BF55310F29406EE8559F292D7789D42CB61

Function 007EFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 007EFA96
_wcschr.LIBCMT ref: 007EFAA4
_wcscpy.LIBCMT ref: 007EFABB
_wcscat.LIBCMT ref: 007EFACA
_wcscat.LIBCMT ref: 007EFAE8
_wcscpy.LIBCMT ref: 007EFB09
__wsplitpath.LIBCMT ref: 007EFBE6
_wcscpy.LIBCMT ref: 007EFC0B
_wcscpy.LIBCMT ref: 007EFC1D
_wcscpy.LIBCMT ref: 007EFC32
_wcscat.LIBCMT ref: 007EFC47
_wcscat.LIBCMT ref: 007EFC59
_wcscat.LIBCMT ref: 007EFC6E

Part of subcall function 007EBFA4: _wcscmp.LIBCMT ref: 007EC03E
Part of subcall function 007EBFA4: __wsplitpath.LIBCMT ref: 007EC083
Part of subcall function 007EBFA4: _wcscpy.LIBCMT ref: 007EC096
Part of subcall function 007EBFA4: _wcscat.LIBCMT ref: 007EC0A9
Part of subcall function 007EBFA4: __wsplitpath.LIBCMT ref: 007EC0CE
Part of subcall function 007EBFA4: _wcscat.LIBCMT ref: 007EC0E4
Part of subcall function 007EBFA4: _wcscat.LIBCMT ref: 007EC0F7

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 007EFA61

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: b7b8da0d9a638b831620dd8a200316f18f9ce96ad0ba53274803851f303e8301
Instruction ID: bba02d99d2127fdaa3cf7ab3a6c3f33cfe14e0672092614cd8137007a4dc014a
Opcode Fuzzy Hash: b7b8da0d9a638b831620dd8a200316f18f9ce96ad0ba53274803851f303e8301
Instruction Fuzzy Hash: 6A91B272604745DFCB20EB61C855F9BB3E8BF98300F00496DF95997291DB38EA58CB92

Function 007A3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007A3F86
RegisterClassExW.USER32(00000030), ref: 007A3FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007A3FC1
InitCommonControlsEx.COMCTL32(?), ref: 007A3FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007A3FEE
LoadIconW.USER32(000000A9), ref: 007A4004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007A4013

Strings

TaskbarCreated, xrefs: 007A3FB6
AutoIt v3 GUI, xrefs: 007A3FA2
0, xrefs: 007A3F68
+, xrefs: 007A3F6F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d23098a7c7a4f56197f0a3b41aa48edcdf6bb30490d4ed84ee80e6570369b633
Instruction ID: b0251f5b5f64b05d72dc5612d7fad4b575b273dc35c2bf4f77c48544d7202a55
Opcode Fuzzy Hash: d23098a7c7a4f56197f0a3b41aa48edcdf6bb30490d4ed84ee80e6570369b633
Instruction Fuzzy Hash: 4721C3B5D00319AFDF10DFA4E889BCDBFB4FB18700F15921AFA11A62A0D7B545458F91

Function 007EBFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007EBDB4: __time64.LIBCMT ref: 007EBDBE

Part of subcall function 007A4517: _fseek.LIBCMT ref: 007A452F

__wsplitpath.LIBCMT ref: 007EC083

Part of subcall function 007C1DFC: __wsplitpath_helper.LIBCMT ref: 007C1E3C

_wcscpy.LIBCMT ref: 007EC096
_wcscat.LIBCMT ref: 007EC0A9
__wsplitpath.LIBCMT ref: 007EC0CE
_wcscat.LIBCMT ref: 007EC0E4
_wcscat.LIBCMT ref: 007EC0F7
_wcscmp.LIBCMT ref: 007EC03E

Part of subcall function 007EC56D: _wcscmp.LIBCMT ref: 007EC65D
Part of subcall function 007EC56D: _wcscmp.LIBCMT ref: 007EC670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007EC2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 007EC338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 007EC34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007EC35F
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007EC371

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 2378138488-0
Opcode ID: 96fbf5a4b9c891f49b5d2f942144bb53a48a96a3ffa94e898db3a474b63d3263
Instruction ID: 8de316eaa0af1e729a5fa59123d356a4cda8cc1bac30031b593413a6432411b4
Opcode Fuzzy Hash: 96fbf5a4b9c891f49b5d2f942144bb53a48a96a3ffa94e898db3a474b63d3263
Instruction Fuzzy Hash: 44C15CB5901259EFCF21DF95CC85EDEBBBCAF89300F0040AAF609E6151DB789A458F61

Function 007A3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 007A37B3
KillTimer.USER32(?,00000001), ref: 007A37DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007A3800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007A380B
CreatePopupMenu.USER32 ref: 007A381F
PostQuitMessage.USER32(00000000), ref: 007A382E

Strings

TaskbarCreated, xrefs: 007A3806

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 0a5fe8d085aa3031d33c53dfd507588f3d008083c3b2195a6499c6877cffd429
Instruction ID: 8f6bf3869d0328f530222995185856df7ce68bacac7561165f3b3bdd1f65e7bb
Opcode Fuzzy Hash: 0a5fe8d085aa3031d33c53dfd507588f3d008083c3b2195a6499c6877cffd429
Instruction Fuzzy Hash: 52413DF2104245ABDF145F68EC8EFBA3A59FB82301F480315F602D2192CBAC9D50D762

Function 007A3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007A3E79
LoadCursorW.USER32(00000000,00007F00), ref: 007A3E88
LoadIconW.USER32(00000063), ref: 007A3E9E
LoadIconW.USER32(000000A4), ref: 007A3EB0
LoadIconW.USER32(000000A2), ref: 007A3EC2

Part of subcall function 007A4024: LoadImageW.USER32(007A0000,00000063,00000001,00000010,00000010,00000000), ref: 007A4048

RegisterClassExW.USER32(?), ref: 007A3F30

Part of subcall function 007A3F53: GetSysColorBrush.USER32(0000000F), ref: 007A3F86
Part of subcall function 007A3F53: RegisterClassExW.USER32(00000030), ref: 007A3FB0
Part of subcall function 007A3F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007A3FC1
Part of subcall function 007A3F53: InitCommonControlsEx.COMCTL32(?), ref: 007A3FDE
Part of subcall function 007A3F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007A3FEE
Part of subcall function 007A3F53: LoadIconW.USER32(000000A9), ref: 007A4004
Part of subcall function 007A3F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007A4013

Strings

0, xrefs: 007A3F02
AutoIt v3, xrefs: 007A3F1F
#, xrefs: 007A3F09

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 57721338cf1f9dddfc1ca975e17cfec0f20693691f667b28a0493f3c56a8619b
Instruction ID: ac6d9d5e19624a87baf644fc45834e4e6b0abae4fff9353b853c9e21c11e4685
Opcode Fuzzy Hash: 57721338cf1f9dddfc1ca975e17cfec0f20693691f667b28a0493f3c56a8619b
Instruction Fuzzy Hash: D22162B0E00304AFCF10DFA9EC4AA99BFF5FB49310F15622AE604A32A1D3B546449F91

Function 01562048 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01562119
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0156233F

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: a42bb69224c822e23b40d02ffcda804e8c397f100c048c21efda3418e284254d
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: 45A10A74E04209EBDF14CFA4C898BEEBBB9BF48305F108559E615BB280D7759A81CF90

Function 007A49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 007A4A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 008141DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0081421A
RegCloseKey.ADVAPI32(?), ref: 00814249

Strings

Software\AutoIt v3\AutoIt, xrefs: 007A4A13
Include, xrefs: 008141D3, 00814212

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: b713c2dee624e26bb827d657e33b038c50921320ca9de7120ed726c478df25bc
Instruction ID: 9b28771a8624025c0682e380ca6d6437ff6121d72f451858ba798e96d08bf878
Opcode Fuzzy Hash: b713c2dee624e26bb827d657e33b038c50921320ca9de7120ed726c478df25bc
Instruction Fuzzy Hash: 27116D71600208FEEB14ABA4DD8ADEF7BACFF45344F005055B506E61A1EA759E429750

Function 007A36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007A36E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007A3707
ShowWindow.USER32(00000000,?,?,?,?,007A3AA3,?), ref: 007A371B
ShowWindow.USER32(00000000,?,?,?,?,007A3AA3,?), ref: 007A3724

Strings

AutoIt v3, xrefs: 007A36DE, 007A36E3, 007A36E4
edit, xrefs: 007A3701

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b0b66a17f4cb14e5271cb94756213df0950b2842dd32ae07168db818a16cab95
Instruction ID: 880d7c8ee3d9e22d81c540841873c12251d87db8ee51a272c2d2e0ed3359fd26
Opcode Fuzzy Hash: b0b66a17f4cb14e5271cb94756213df0950b2842dd32ae07168db818a16cab95
Instruction Fuzzy Hash: CDF0DA716406D07AEF315757BC0CE672E7EF7C6F20F06501AFA04E21A1C5A50895EAB2

Function 01561E08 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01561CF8: Sleep.KERNELBASE(000001F4), ref: 01561D09

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01561F3A

Strings

F9CWZP7UP0TDF3DPG0, xrefs: 01561F9D, 01561FA0

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID: CreateFileSleep
String ID: F9CWZP7UP0TDF3DPG0
API String ID: 2694422964-617137175
Opcode ID: eb8016ab4380cf2a1c7e04c1facbff31a926dc0ea4e07934cc4c63b01b0a003f
Instruction ID: f7d8ac7dfa5eb696075d0354967cb9bfac1dad9e90be8cdb1d0aa374b4c0a852
Opcode Fuzzy Hash: eb8016ab4380cf2a1c7e04c1facbff31a926dc0ea4e07934cc4c63b01b0a003f
Instruction Fuzzy Hash: 84519430D04289DBEF11DBB4C854BEEBB78AF69300F004599E659BB2C1D7B90B45CBA5

Function 007A51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007A522F
_wcscpy.LIBCMT ref: 007A5283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 007A5293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00813CB0

Strings

Line: , xrefs: 00813CD9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: 58ce981997b43025241c8e61ad6fdd9a73d1e954e50a8d4bee549b6b479cc4cc
Instruction ID: 8514724829bc2d660a2bbb481e643da25bb1ac9831f4dca94e4d861f10821227
Opcode Fuzzy Hash: 58ce981997b43025241c8e61ad6fdd9a73d1e954e50a8d4bee549b6b479cc4cc
Instruction Fuzzy Hash: 3031D071108744EAC721EB60DC4AFEE77D8BF86310F04461EF58582192EBB8A6498B97

Function 007A4139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 007A41A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007A39FE,?,00000001), ref: 007A41DB

_free.LIBCMT ref: 008136B7
_free.LIBCMT ref: 008136FE

Part of subcall function 007AC833: __wsplitpath.LIBCMT ref: 007AC93E
Part of subcall function 007AC833: _wcscpy.LIBCMT ref: 007AC953
Part of subcall function 007AC833: _wcscat.LIBCMT ref: 007AC968
Part of subcall function 007AC833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 007AC978

Strings

Bad directive syntax error, xrefs: 008136E4
>>>AUTOIT SCRIPT<<<, xrefs: 00813491

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: 33909c8c8a7f8e64bc59ead7c553de8b9c3eb981208644b6b2aa331f69760d06
Instruction ID: 778975fb6e957ea5206a3ad9a2640e4efd78d09a2690b1290c3e7df342a34419
Opcode Fuzzy Hash: 33909c8c8a7f8e64bc59ead7c553de8b9c3eb981208644b6b2aa331f69760d06
Instruction Fuzzy Hash: 21914A71910218EBCF04EFA4CC459EDB7B8FF59310F104529F416EB291EB78AA55CB60

Function 007A4A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 007A5374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00861148,?,007A61FF,?,00000000,00000001,00000000), ref: 007A5392

Part of subcall function 007A49FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 007A4A1D

_wcscat.LIBCMT ref: 00812D80
_wcscat.LIBCMT ref: 00812DB5

Strings

\Include\, xrefs: 007A4B0A
\, xrefs: 00812DA2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: \$\Include\
API String ID: 3592542968-2640467822
Opcode ID: 7cd35e045dc72a66565df72fb652659263a7f8ef4166496be30cd5adb03fc372
Instruction ID: bcbc132fd580d2dab688cff335e59ba484dc48d5fa04e14a54350dcf1447382c
Opcode Fuzzy Hash: 7cd35e045dc72a66565df72fb652659263a7f8ef4166496be30cd5adb03fc372
Instruction Fuzzy Hash: 525171B1408744DBC314EF55E88589AB7F8FF9B300B41166EF644D3260EBB4AA48CB62

Function 007C34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 007C34FE

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 007C3539
__wopenfile.LIBCMT ref: 007C3549

Strings

<G, xrefs: 007C34CD, 007C34F0, 007C34FC

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: d8ae80cdc09e8a8f415bea8f7eb6940f72802faf32bbe8468bbf6e3b258184e9
Instruction ID: b64408619994117b57413937e9fd60175cd57582959df5968dee853b9250797b
Opcode Fuzzy Hash: d8ae80cdc09e8a8f415bea8f7eb6940f72802faf32bbe8468bbf6e3b258184e9
Instruction Fuzzy Hash: CE11C170A00206DADB26BF709C46F6E37A8AF05350B14C92DE815CB281EB3CCB119BA1

Function 007BD298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,007BD28B,SwapMouseButtons,00000004,?), ref: 007BD2BC
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,007BD28B,SwapMouseButtons,00000004,?,?,?,?,007BC865), ref: 007BD2DD
RegCloseKey.KERNELBASE(00000000,?,?,007BD28B,SwapMouseButtons,00000004,?,?,?,?,007BC865), ref: 007BD2FF

Strings

Control Panel\Mouse, xrefs: 007BD2BA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: e6f748562664729cd8c2b1bf0e1e404c4d7d474143729a92600f4bb94970c824
Instruction ID: a1077d58a88ab1ad3977faf4c0a9d88ba5bfaed740afb50a3e5985e3126db61c
Opcode Fuzzy Hash: e6f748562664729cd8c2b1bf0e1e404c4d7d474143729a92600f4bb94970c824
Instruction Fuzzy Hash: F8113975611208FFDB208FA4CC84EEF7BF8EF44744F10846AE805D7220E635AE419B64

Function 01560CF8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01561525
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01561549
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0156156B

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction ID: 89334766ddd48b1c1c360507ce38f16569fa4a701e4de7d033edca1cbae32d4a
Opcode Fuzzy Hash: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction Fuzzy Hash: 9262FE30A146589BEB24CFA4C850BEEB776FF98300F1095A9D10DEB390E7759E81CB55

Function 007C365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C36B7
_memcpy_s.LIBCMT ref: 007C3729
__filbuf.LIBCMT ref: 007C37AA
_memset.LIBCMT ref: 007C37EE

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: 4a21aeb2d57ed383ee1525271ef2fedea222f3e742fea6d9fd617506f428831b
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: 2A51A2B0A00705EBDB249F698984FAE77A5AF40320F24C72DF825962D0D77D9F509B50

Function 007EC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 007A4517: _fseek.LIBCMT ref: 007A452F

Part of subcall function 007EC56D: _wcscmp.LIBCMT ref: 007EC65D
Part of subcall function 007EC56D: _wcscmp.LIBCMT ref: 007EC670

_free.LIBCMT ref: 007EC4DD
_free.LIBCMT ref: 007EC4E4
_free.LIBCMT ref: 007EC54F

Part of subcall function 007C1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,007C7A85), ref: 007C1CB1
Part of subcall function 007C1C9D: GetLastError.KERNEL32(00000000,?,007C7A85), ref: 007C1CC3

_free.LIBCMT ref: 007EC557

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
Instruction ID: bf614314e3e1b8878583692016decbca8188ea2a1e4a2220cd29a37555074e7c
Opcode Fuzzy Hash: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
Instruction Fuzzy Hash: 30516FB5904258EFDF259F65DC85BEEBBB9EF49300F1000AEF209A3241DB755A908F58

Function 007A40E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00813725
GetOpenFileNameW.COMDLG32 ref: 0081376F

Part of subcall function 007A660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007A53B1,?,?,007A61FF,?,00000000,00000001,00000000), ref: 007A662F

Part of subcall function 007A40A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007A40C6

Strings

X, xrefs: 0081373E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 0c068f0d5065fdb4b14c05b80088742d0411e3fed1881aa7902e0bd758cb8a3c
Instruction ID: 2bb9f00f64de675880ceab9229e046d00711ca6a0d77edf11e4e0d1d9156e240
Opcode Fuzzy Hash: 0c068f0d5065fdb4b14c05b80088742d0411e3fed1881aa7902e0bd758cb8a3c
Instruction Fuzzy Hash: 44219371A10298DBCF01DFD4D849BDE7BF9AF89304F008069E505E7241DBF85A898FA5

Function 007EC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 007EC72F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 007EC746

Strings

aut, xrefs: 007EC740

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 0e47ea62fec8cf70cef5029888d18513d01e4104f634e30374d83fa36c7bd3b4
Instruction ID: 08dd034076bee85dcff8138fdbeb0eaa33356ea8c1fac7026e0e1347a997c11f
Opcode Fuzzy Hash: 0e47ea62fec8cf70cef5029888d18513d01e4104f634e30374d83fa36c7bd3b4
Instruction Fuzzy Hash: D0D05E7250030EABDB60AB90DC0EF8A7B6CE700744F0041A07650E51B1DAB4E69A8B54

Function 007FF8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdba233056f566d36d53679c1997529b2dac47938751c28fc847a8bf502220d2
Instruction ID: b5fc17d165e95464c0bd3514b03221a3c3d1c7c75abb6eb3090ab6e90c4c8da9
Opcode Fuzzy Hash: bdba233056f566d36d53679c1997529b2dac47938751c28fc847a8bf502220d2
Instruction Fuzzy Hash: 83F15A71604305DFC710DF28C895B6ABBE5BF88314F14892DFA959B392DB78E905CB82

Function 007A4FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A5022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 007A50CB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 9e896a0ec31f62d5a380954b910a63769c899e59e3df82ea67f68059caf8452a
Instruction ID: 7ea39cc270c11b281afcdf64cebc4087f1b011b7e2f1d05f2a9bcdef7cc5997a
Opcode Fuzzy Hash: 9e896a0ec31f62d5a380954b910a63769c899e59e3df82ea67f68059caf8452a
Instruction Fuzzy Hash: 9D3193B1505B01DFC721DF34D845697BBE8FF89308F000A2EF69A83241E775A944CB96

Function 007C395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 007C3973

Part of subcall function 007C81C2: __NMSG_WRITE.LIBCMT ref: 007C81E9
Part of subcall function 007C81C2: __NMSG_WRITE.LIBCMT ref: 007C81F3

__NMSG_WRITE.LIBCMT ref: 007C397A

Part of subcall function 007C821F: GetModuleFileNameW.KERNEL32(00000000,00860312,00000104,00000000,00000001,00000000), ref: 007C82B1
Part of subcall function 007C821F: ___crtMessageBoxW.LIBCMT ref: 007C835F

Part of subcall function 007C1145: ___crtCorExitProcess.LIBCMT ref: 007C114B
Part of subcall function 007C1145: ExitProcess.KERNEL32 ref: 007C1154

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

RtlAllocateHeap.NTDLL(01300000,00000000,00000001,00000001,00000000,?,?,007BF507,?,0000000E), ref: 007C399F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 5a5307fdf570a09b343fdac6531af4734e946b2bec73021a9582715578047fc5
Instruction ID: a995e4d4bb1cde5260815914599e472796d1f255e12dec1389b9c7f8e30c9939
Opcode Fuzzy Hash: 5a5307fdf570a09b343fdac6531af4734e946b2bec73021a9582715578047fc5
Instruction Fuzzy Hash: 6501B931345301DAE6253B34EC4AF6A735CAB82768F61413DF50597282DFFCAD008AA4

Function 007EC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,007EC385,?,?,?,?,?,00000004), ref: 007EC6F2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,007EC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 007EC708
CloseHandle.KERNEL32(00000000,?,007EC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007EC70F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 368a70f776131e24fe036a8d116398d999f775a9dbbc418bb6bf5c5fedbe04bf
Instruction ID: ceac0ab6372ef05838b0297e60acccf9e8f9ce8a285f608fe33f7505e798b433
Opcode Fuzzy Hash: 368a70f776131e24fe036a8d116398d999f775a9dbbc418bb6bf5c5fedbe04bf
Instruction Fuzzy Hash: 51E08632141314B7D7311B54EC0EFCA7F58BB05761F108110FB14690E097B125228799

Function 007EBB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007EBB72

Part of subcall function 007C1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,007C7A85), ref: 007C1CB1
Part of subcall function 007C1C9D: GetLastError.KERNEL32(00000000,?,007C7A85), ref: 007C1CC3

_free.LIBCMT ref: 007EBB83
_free.LIBCMT ref: 007EBB95

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 20f76424029b3f4f106c4d8a086868d24a1af312dab904e69dcb584714f23b8e
Instruction ID: 5226610a7e28de7034a92fc575f90a53b852b741e9422841735a3eb17ba940ed
Opcode Fuzzy Hash: 20f76424029b3f4f106c4d8a086868d24a1af312dab904e69dcb584714f23b8e
Instruction Fuzzy Hash: BEE012E164279186DA34657E6E48FB327CC4F09352B54092DB459E7147DF2CE84085B4

Function 007A2322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 007A22A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007A24F1), ref: 007A2303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007A25A1
CoInitialize.OLE32(00000000), ref: 007A2618
CloseHandle.KERNEL32(00000000), ref: 0081503A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: b87c345a741b3c1c86d88ed8c11c1ee6743c2f678ffb34d59edfb92f69f2cee9
Instruction ID: 81f3547924664b76ba902d3d060f8a672fce799e3c7fc33e340ec560971b2377
Opcode Fuzzy Hash: b87c345a741b3c1c86d88ed8c11c1ee6743c2f678ffb34d59edfb92f69f2cee9
Instruction Fuzzy Hash: 9171D0B4901381CFCF04EF9AA9AD594BBA5F79934078A622ED20AC7773CBB44408DF54

Function 007EBBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 007EBC18

Strings

EA06, xrefs: 007EBC46

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 8242fb5d04722f1736c7129ac82b363a384443ced391a8a60dfc55c661114429
Instruction ID: 717e5f679152ccdf0167183acfa9a78b7c8ab52c0dbbcec966b4d58491153813
Opcode Fuzzy Hash: 8242fb5d04722f1736c7129ac82b363a384443ced391a8a60dfc55c661114429
Instruction Fuzzy Hash: 6801B971904258BEDB18C799C85AFEE7FF89B15305F00455EF553D6181D578E7088B70

Function 007A3A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 007A3A73

Part of subcall function 007C1405: __lock.LIBCMT ref: 007C140B

Part of subcall function 007A3ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 007A3AF3
Part of subcall function 007A3ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007A3B08

Part of subcall function 007A3D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,007A3AA3,?), ref: 007A3D45
Part of subcall function 007A3D19: IsDebuggerPresent.KERNEL32(?,?,?,?,007A3AA3,?), ref: 007A3D57
Part of subcall function 007A3D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00861148,00861130,?,?,?,?,007A3AA3,?), ref: 007A3DC8
Part of subcall function 007A3D19: SetCurrentDirectoryW.KERNEL32(?,?,?,007A3AA3,?), ref: 007A3E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007A3AB3

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: 1772036aae2d7881974d1f4c0af1f80fc31fce8372aaf1a4cd5c567c1934a114
Instruction ID: 93787fa6b98a57896c5b137fd3d78709611fe1241f0710d076dd1fba8e446e46
Opcode Fuzzy Hash: 1772036aae2d7881974d1f4c0af1f80fc31fce8372aaf1a4cd5c567c1934a114
Instruction Fuzzy Hash: 4111AE71A08341DFC700EF65E809A0ABFE9FB95350F008A1EF484872A2DBB49541CF92

Function 007CE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 007CEA29
__close_nolock.LIBCMT ref: 007CEA42

Part of subcall function 007C7BDA: __getptd_noexit.LIBCMT ref: 007C7BDA

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: 8ed29c10f7c54a273c0480d5845f8c2e37b0e11bb4e72722ee01d6604c5e9256
Instruction ID: ecf99602b10ed246ea47bf2214cc6cd999439a59a41747c0068af1cdb993a5fe
Opcode Fuzzy Hash: 8ed29c10f7c54a273c0480d5845f8c2e37b0e11bb4e72722ee01d6604c5e9256
Instruction Fuzzy Hash: B7117372405A10DED715BF648885F6D7B517F41332F26835CE4205F1E2CBBC8C40DAA5

Function 007BF4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 007C395C: __FF_MSGBANNER.LIBCMT ref: 007C3973
Part of subcall function 007C395C: __NMSG_WRITE.LIBCMT ref: 007C397A
Part of subcall function 007C395C: RtlAllocateHeap.NTDLL(01300000,00000000,00000001,00000001,00000000,?,?,007BF507,?,0000000E), ref: 007C399F

std::exception::exception.LIBCMT ref: 007BF51E
__CxxThrowException@8.LIBCMT ref: 007BF533

Part of subcall function 007C6805: RaiseException.KERNEL32(?,?,0000000E,00856A30,?,?,?,007BF538,0000000E,00856A30,?,00000001), ref: 007C6856

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 115ada790aa21c36bcca294abb1f401e24d551f69a8b98e7d0db3a086cbabbf7
Instruction ID: 449462ec18e55dbcf97e54de70e225995ff438bfcc84e6db3bb5ec535f555fcb
Opcode Fuzzy Hash: 115ada790aa21c36bcca294abb1f401e24d551f69a8b98e7d0db3a086cbabbf7
Instruction Fuzzy Hash: 14F0F43110022EA7CB14BF98EC06FDE7BECAF00754F60403EFA09D2181DBB8D68482A5

Function 007C3839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C3868
__lock_file.LIBCMT ref: 007C3889

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: db078ab45cacbae7cb959a6fb2aef32ebc65216350daa6641f5eae60d8643483
Instruction ID: b6473d41a7af2ea17da507f13a3516c209b3a2f02b4461adfccb9b41016367cb
Opcode Fuzzy Hash: db078ab45cacbae7cb959a6fb2aef32ebc65216350daa6641f5eae60d8643483
Instruction Fuzzy Hash: F9014471900609FBCF22AFA58D09E9E7BA1BF40320F15C11DF82457161D7798B61DBA2

Function 007C35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

__lock_file.LIBCMT ref: 007C3629

Part of subcall function 007C4E1C: __lock.LIBCMT ref: 007C4E3F

__fclose_nolock.LIBCMT ref: 007C3634

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 3611bc3e1ed0eb6c0c8ad98c9fcbd80192ae1736dcb4f4769315305f6fff53a1
Instruction ID: 68460fa14d691df1229b99e28cd4e456da4fb7b36829f3e4f4b8b447d2fc9895
Opcode Fuzzy Hash: 3611bc3e1ed0eb6c0c8ad98c9fcbd80192ae1736dcb4f4769315305f6fff53a1
Instruction Fuzzy Hash: 16F09071801604EAD7117B65880AF6E7BA06F41335F25C14DE421BB2C2CB7C8A019A55

Function 01560CF5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01561525
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01561549
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0156156B

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: 83174537986547aeac51a6e70fa1f130d7803cbc44bf9dcbe048af2f136fde78
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: 4D12DD20E24658C6EB24DF64D8507DEB232FF68300F1091E9910DEB7A5E77A4E81CF5A

Function 007C2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 007C2A0B

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: 0002869629909fabc6e1084d0eac7160dcb656a719765b977f736972f787d572
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: 6041A471700706AFDB289E69C884FAE77A6AF44360F24C53DEC55D7242EB78ED428B40

Function 007BED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 007BEDC7

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: ee1f1d1c374b8d98942d14fe88be39435383f7b442659f1fe81bc85a1d06a82f
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: BB31D074B001069BC718DF58C480AE9FBA6FF49340B6486A5E40ACB366DB78EDC1DBC0

Function 00819A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00819A80

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7d8b53c10303d51b90e13e54e9374f717a584c061a3934babb584ce2615fb1ce
Instruction ID: f73cae88a336b2ee51ca1d7e741977e29c52fab7c5ebb84b7bece430a69968d9
Opcode Fuzzy Hash: 7d8b53c10303d51b90e13e54e9374f717a584c061a3934babb584ce2615fb1ce
Instruction Fuzzy Hash: 3B414E74504651CFDB24DF18C454B5ABBE0BF45304F1989ACE99A8B362C376F885CF92

Function 007CED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 14c1eb27b2542666c1fbc3015dba303062d296789a1f366af7e24d8895b1a915
Instruction ID: 12043c1a5769453d1109bfe9099b9452f02840ea8ca94505f261aa5ed73512a8
Opcode Fuzzy Hash: 14c1eb27b2542666c1fbc3015dba303062d296789a1f366af7e24d8895b1a915
Instruction Fuzzy Hash: 83216DB2905600DBD7267FA8C849F593BA5AF51736F26064CE4714B1E2DFBC8C00DBA1

Function 007A41A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007A4214: FreeLibrary.KERNEL32(00000000,?), ref: 007A4247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007A39FE,?,00000001), ref: 007A41DB

Part of subcall function 007A4291: FreeLibrary.KERNEL32(00000000), ref: 007A42C4

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: 517298287d60ccec0956b3d3070ebed72fab34d2b6b7f5934441c7ca1d898588
Instruction ID: d3ff0a2386140ad3e8bcc451932c50718d3dc9d3339157d94e3aa45d9010daa6
Opcode Fuzzy Hash: 517298287d60ccec0956b3d3070ebed72fab34d2b6b7f5934441c7ca1d898588
Instruction Fuzzy Hash: 1F11E731600306EADB10AB74DC0AF9E77A9BFC1700F108529B596E61C1DFBA9E059B60

Function 00819B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00819B51

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 404b945534815fd5a30c62b4e37611ff5241acf507576377121aecdac173377a
Instruction ID: 2786d6c4e980c180a9cf040decad6926b1b857715e002cb91a98953c763081f1
Opcode Fuzzy Hash: 404b945534815fd5a30c62b4e37611ff5241acf507576377121aecdac173377a
Instruction Fuzzy Hash: 2F210770508701CFDB24DF64C448B5BBBE1BF85304F154A68F59647262D735E855CF92

Function 007CAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 007CAFC0

Part of subcall function 007C7BDA: __getptd_noexit.LIBCMT ref: 007C7BDA

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: e2539dd6bc91fe275c52b468b4dcb320d9db0b3a5c064363187db7a7675f7e37
Instruction ID: a9b56cf1950b05c50380befdd6d674ead78ffa14fb6d2150c70d42c10d0f1c43
Opcode Fuzzy Hash: e2539dd6bc91fe275c52b468b4dcb320d9db0b3a5c064363187db7a7675f7e37
Instruction Fuzzy Hash: 29119DB2805610DBD7166FA4884AF5A3B61AF51336F26424CF4301F2E2DBBC8D40DBA2

Function 007A39DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
Instruction ID: 2e4fea827cd3fc3426270dd548acef2d8e872918066e8a1ef90df7750aca9466
Opcode Fuzzy Hash: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
Instruction Fuzzy Hash: F901863140010DEFCF05EF64C885CEEBB78EF52304F108129B51597195EA359A49CB60

Function 007C2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 007C2AED

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: e90ebfbd0f804b1049f3bc7a4e70ceeda16e0bbeec1a69b1e72f3a67c04f1529
Instruction ID: 86cb0377685a4935eb11fe4a083346d730a0e76260f23202c30a82756885981d
Opcode Fuzzy Hash: e90ebfbd0f804b1049f3bc7a4e70ceeda16e0bbeec1a69b1e72f3a67c04f1529
Instruction Fuzzy Hash: D1F06D71900205FADF21AF658C0AF9F3BA5BF00321F15855DB814AB1A2DBBD8A63DB51

Function 007A4252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,007A39FE,?,00000001), ref: 007A4286

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 70b2f86fa462d65c7a23bba05fc745af63165eaa342d300d5c23425e026b8b5b
Instruction ID: c4784336ed9d894318ba3490346595203c0039a2590581421eed319ffd06cc22
Opcode Fuzzy Hash: 70b2f86fa462d65c7a23bba05fc745af63165eaa342d300d5c23425e026b8b5b
Instruction Fuzzy Hash: AAF01571505702DFCB349F64E894A16FBE4BF863253248B2EF1D682A50C7BA9840DF50

Function 007A40A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007A40C6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: eca5c579eaa8d63d837f39d906fb7412659471d2dfc084355036e195c808c6ad
Instruction ID: cc68bcc8161bff99e225d913db472c72e0b7ebde1ddb37d03206e93bac26c48f
Opcode Fuzzy Hash: eca5c579eaa8d63d837f39d906fb7412659471d2dfc084355036e195c808c6ad
Instruction Fuzzy Hash: 12E0CD365002245BC7119654CC46FEA779DDFC8790F094175F905D7244D96499818690

Function 007EBCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 007EBD16

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: 6b3b0aa9266034bffc196b48acc8e216772fa883c65d4e31981ef2508d66b9ba
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: 4AE092B0204B409BD7348A24DC00BE377E1EB09309F00081CF29A83241EB6278418659

Function 01561CF8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01561D09

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 8e6fb92a2ae50abab07ca07002a2f796e866467ac766904612b0fbdc72bef337
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 3AE0BF7494010D9FDB00EFA4D5496AD7BB4EF04301F100161FD0196280D63099508A62

Non-executed Functions

Function 0080F7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 0080F87D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0080F8DC
GetWindowLongW.USER32(?,000000F0), ref: 0080F919
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0080F940
SendMessageW.USER32 ref: 0080F966
_wcsncpy.LIBCMT ref: 0080F9D2
GetKeyState.USER32(00000011), ref: 0080F9F3
GetKeyState.USER32(00000009), ref: 0080FA00
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0080FA16
GetKeyState.USER32(00000010), ref: 0080FA20
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0080FA4F
SendMessageW.USER32 ref: 0080FA72
SendMessageW.USER32(?,00001030,?,0080E059), ref: 0080FB6F
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 0080FB85
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0080FB96
SetCapture.USER32(?), ref: 0080FB9F
ClientToScreen.USER32(?,?), ref: 0080FC03
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0080FC0F
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 0080FC29
ReleaseCapture.USER32 ref: 0080FC34
GetCursorPos.USER32(?), ref: 0080FC69
ScreenToClient.USER32(?,?), ref: 0080FC76
SendMessageW.USER32(?,00001012,00000000,?), ref: 0080FCD8
SendMessageW.USER32 ref: 0080FD02
SendMessageW.USER32(?,00001111,00000000,?), ref: 0080FD41
SendMessageW.USER32 ref: 0080FD6C
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0080FD84
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0080FD8F
GetCursorPos.USER32(?), ref: 0080FDB0
ScreenToClient.USER32(?,?), ref: 0080FDBD
GetParent.USER32(?), ref: 0080FDD9
SendMessageW.USER32(?,00001012,00000000,?), ref: 0080FE3F
SendMessageW.USER32 ref: 0080FE6F
ClientToScreen.USER32(?,?), ref: 0080FEC5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0080FEF1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0080FF19
SendMessageW.USER32 ref: 0080FF3C
ClientToScreen.USER32(?,?), ref: 0080FF86
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0080FFB6
GetWindowLongW.USER32(?,000000F0), ref: 0081004B

Strings

@GUI_DRAGID, xrefs: 0080FBCC
F, xrefs: 0080FF42

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: 621870bb04870f4058d4e9d2365cda3d37ae50353542ea6265245827608698a0
Instruction ID: b1d0248f005b715604bb6cf9f0f52d09e8b29cf9e825e8bcb01f75fbe8ca0ff4
Opcode Fuzzy Hash: 621870bb04870f4058d4e9d2365cda3d37ae50353542ea6265245827608698a0
Instruction Fuzzy Hash: 8232A974604345EFDB60CF28CC84AAABBA8FF49358F148A29F695C76A2C770DC45CB51

Function 0080AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0080B1CD

Strings

%d/%02d/%02d, xrefs: 0080AEFC

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 5d66805394d8e7df34f2f4198d877314e1ce06ce0989d3cf6da8db95fd9c8ca4
Instruction ID: c2fb296a139d954944f33d22c6ac1168475c29e2352125db65f262f5f67f7649
Opcode Fuzzy Hash: 5d66805394d8e7df34f2f4198d877314e1ce06ce0989d3cf6da8db95fd9c8ca4
Instruction Fuzzy Hash: 7F12CFB1600349ABEB689F64CC49FAE7BB8FF45710F108119F91ADB2D1DBB48942CB51

Function 007BEB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 007BEB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00813AEA
IsIconic.USER32(000000FF), ref: 00813AF3
ShowWindow.USER32(000000FF,00000009), ref: 00813B00
SetForegroundWindow.USER32(000000FF), ref: 00813B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00813B20
GetCurrentThreadId.KERNEL32 ref: 00813B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00813B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00813B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00813B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 00813B54
SetForegroundWindow.USER32(000000FF), ref: 00813B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 00813B6C
keybd_event.USER32(00000012,00000000), ref: 00813B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 00813B81
keybd_event.USER32(00000012,00000000), ref: 00813B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 00813B8F
keybd_event.USER32(00000012,00000000), ref: 00813B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 00813B9E
keybd_event.USER32(00000012,00000000), ref: 00813BA3
SetForegroundWindow.USER32(000000FF), ref: 00813BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00813BCD

Strings

Shell_TrayWnd, xrefs: 00813AE5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 8fb66b14d4306a6717fe8984b042576c2495f10e764c85ee2c189802c42a947a
Instruction ID: 4796e81411c61ec5e3bf6189d63ca0bcdcdc27b837081d429505d3f226a13842
Opcode Fuzzy Hash: 8fb66b14d4306a6717fe8984b042576c2495f10e764c85ee2c189802c42a947a
Instruction Fuzzy Hash: C2318771A40318BFEB305B658C4AFBF7E6CFF44B60F108025FA05EA1D1D6B15D42AAA0

Function 007DACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 007DB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007DB180
Part of subcall function 007DB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007DB1AD
Part of subcall function 007DB134: GetLastError.KERNEL32 ref: 007DB1BA

_memset.LIBCMT ref: 007DAD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 007DAD5A
CloseHandle.KERNEL32(?), ref: 007DAD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007DAD82
GetProcessWindowStation.USER32 ref: 007DAD9B
SetProcessWindowStation.USER32(00000000), ref: 007DADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 007DADBF

Part of subcall function 007DAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007DACC0), ref: 007DAB99
Part of subcall function 007DAB84: CloseHandle.KERNEL32(?,?,007DACC0), ref: 007DABAB

Strings

default, xrefs: 007DADBA
, xrefs: 007DAD17
winsta0, xrefs: 007DAD7D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 5699f2735a651044a0b4fb324eceb2a4863e4b8c2994a2907b22a0643f72bd70
Instruction ID: d45a08df7213182cf33fe6b0fbcedba38c3a520a00ad936f70e5686289db62ca
Opcode Fuzzy Hash: 5699f2735a651044a0b4fb324eceb2a4863e4b8c2994a2907b22a0643f72bd70
Instruction Fuzzy Hash: 41817DB1900209FFDF219FA4CC49AEE7B79FF04304F14815AF914A6261D7398E55DBA1

Function 007E60DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007E5FA6,?), ref: 007E6ED8

Part of subcall function 007E6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007E5FA6,?), ref: 007E6EF1

Part of subcall function 007E725E: __wsplitpath.LIBCMT ref: 007E727B
Part of subcall function 007E725E: __wsplitpath.LIBCMT ref: 007E728E

Part of subcall function 007E72CB: GetFileAttributesW.KERNEL32(?,007E6019), ref: 007E72CC

_wcscat.LIBCMT ref: 007E6149
_wcscat.LIBCMT ref: 007E6167
__wsplitpath.LIBCMT ref: 007E618E
FindFirstFileW.KERNEL32(?,?), ref: 007E61A4
_wcscpy.LIBCMT ref: 007E6209
_wcscat.LIBCMT ref: 007E621C
_wcscat.LIBCMT ref: 007E622F
lstrcmpiW.KERNEL32(?,?), ref: 007E625D
DeleteFileW.KERNEL32(?), ref: 007E626E
MoveFileW.KERNEL32(?,?), ref: 007E6289
MoveFileW.KERNEL32(?,?), ref: 007E6298
CopyFileW.KERNEL32(?,?,00000000), ref: 007E62AD
DeleteFileW.KERNEL32(?), ref: 007E62BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007E62E1
FindClose.KERNEL32(00000000), ref: 007E62FD
FindClose.KERNEL32(00000000), ref: 007E630B

Strings

\*.*, xrefs: 007E6138, 007E6147, 007E6165

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*
API String ID: 1917200108-1173974218
Opcode ID: b8994f694ead5d18fc01a45ffecf4b2bd097046f7dec2c918f3d7eeefe7ad322
Instruction ID: 059c251d8f766443944e88e43b130829fadb9a8edebb81e022f8986250c55ca9
Opcode Fuzzy Hash: b8994f694ead5d18fc01a45ffecf4b2bd097046f7dec2c918f3d7eeefe7ad322
Instruction Fuzzy Hash: 3C51337280925C9ACB21EB92CC48DDF77BCBF19340F0541EAE645E3141DE3A97498FA4

Function 007F6B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0083DC00), ref: 007F6B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 007F6B44
GetClipboardData.USER32(0000000D), ref: 007F6B4C
CloseClipboard.USER32 ref: 007F6B58
GlobalLock.KERNEL32(00000000), ref: 007F6B74
CloseClipboard.USER32 ref: 007F6B7E
GlobalUnlock.KERNEL32(00000000), ref: 007F6B93
IsClipboardFormatAvailable.USER32(00000001), ref: 007F6BA0
GetClipboardData.USER32(00000001), ref: 007F6BA8
GlobalLock.KERNEL32(00000000), ref: 007F6BB5
GlobalUnlock.KERNEL32(00000000), ref: 007F6BE9
CloseClipboard.USER32 ref: 007F6CF6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 80356530e8d07fc982698dcb35a2ae8e4fc1a1a0f7803b67d8831f65e195c18d
Instruction ID: 78482a5a07847c76a7f5beec27e6a1a663b9a56eeb4860eb7cf117065535bd8f
Opcode Fuzzy Hash: 80356530e8d07fc982698dcb35a2ae8e4fc1a1a0f7803b67d8831f65e195c18d
Instruction Fuzzy Hash: 6951B2B1200305ABD311AF64DD5AF7E77A8FF94B00F104129FA96D62D1DF78E906CA62

Function 007EF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007EF62B
FindClose.KERNEL32(00000000), ref: 007EF67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007EF6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007EF6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 007EF6E2
__swprintf.LIBCMT ref: 007EF72E
__swprintf.LIBCMT ref: 007EF767
__swprintf.LIBCMT ref: 007EF7BB

Part of subcall function 007C172B: __woutput_l.LIBCMT ref: 007C1784

__swprintf.LIBCMT ref: 007EF809
__swprintf.LIBCMT ref: 007EF858
__swprintf.LIBCMT ref: 007EF8A7
__swprintf.LIBCMT ref: 007EF8F6

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 007EF728
%02d, xrefs: 007EF7B0, 007EF7B9, 007EF807, 007EF856, 007EF8A5, 007EF8F4
%4d, xrefs: 007EF761

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: 83ff1b27df9969808657898576e91cf72b90f25e1c250066a29c6af8a2f41da9
Instruction ID: 3488ac8732e1c232f6a34a45588797dfc8b2aeecfbd0b16b1e8bc3c53de47b4a
Opcode Fuzzy Hash: 83ff1b27df9969808657898576e91cf72b90f25e1c250066a29c6af8a2f41da9
Instruction Fuzzy Hash: B2A10DB2408344EBC315EB95C889EAFB7ECBF99700F40492DF595C6152EB38E949C762

Function 007F1B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 007F1B50
_wcscmp.LIBCMT ref: 007F1B65
_wcscmp.LIBCMT ref: 007F1B7C
GetFileAttributesW.KERNEL32(?), ref: 007F1B8E
SetFileAttributesW.KERNEL32(?,?), ref: 007F1BA8
FindNextFileW.KERNEL32(00000000,?), ref: 007F1BC0
FindClose.KERNEL32(00000000), ref: 007F1BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 007F1BE7
_wcscmp.LIBCMT ref: 007F1C0E
_wcscmp.LIBCMT ref: 007F1C25
SetCurrentDirectoryW.KERNEL32(?), ref: 007F1C37
SetCurrentDirectoryW.KERNEL32(008539FC), ref: 007F1C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 007F1C5F
FindClose.KERNEL32(00000000), ref: 007F1C6C
FindClose.KERNEL32(00000000), ref: 007F1C7C

Strings

*.*, xrefs: 007F1BE2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: a9cb9d6169dad192765d85006c5affba9251c5d424a04c6e84f4a636ad07da8d
Instruction ID: ddefcb4e43873980cdd85dfc4748555d0c78cad3b26177657559971a82daf9d2
Opcode Fuzzy Hash: a9cb9d6169dad192765d85006c5affba9251c5d424a04c6e84f4a636ad07da8d
Instruction Fuzzy Hash: 8D31D67150031DEFCF20DBA0EC49AEE77ACEF05320F508155E911D3290EB78DA55CA64

Function 007F1C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 007F1CAB
_wcscmp.LIBCMT ref: 007F1CC0
_wcscmp.LIBCMT ref: 007F1CD7

Part of subcall function 007E6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 007E6BEF

FindNextFileW.KERNEL32(00000000,?), ref: 007F1D06
FindClose.KERNEL32(00000000), ref: 007F1D11
FindFirstFileW.KERNEL32(*.*,?), ref: 007F1D2D
_wcscmp.LIBCMT ref: 007F1D54
_wcscmp.LIBCMT ref: 007F1D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 007F1D7D
SetCurrentDirectoryW.KERNEL32(008539FC), ref: 007F1D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 007F1DA5
FindClose.KERNEL32(00000000), ref: 007F1DB2
FindClose.KERNEL32(00000000), ref: 007F1DC2

Strings

*.*, xrefs: 007F1D28

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 798ee7b73a057fcc85df6291de1e5f7c0b50e60d99e011106b556e3003ba182c
Instruction ID: b7d9abf634fcd5a5a654f827553c9d2d5135354fbe4ba99d3f322f6bdd02755f
Opcode Fuzzy Hash: 798ee7b73a057fcc85df6291de1e5f7c0b50e60d99e011106b556e3003ba182c
Instruction Fuzzy Hash: EB31F63160071DEACF20EBA4EC09AEE7BBCAF45360F504555E911E3291DB78DA55CA60

Function 007A7D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A7DBD

Strings

[, xrefs: 007A7E14
\b(?<=\w), xrefs: 0081F877
^, xrefs: 007A7D96
], xrefs: 007A7D9F
Q\E, xrefs: 007A86D6
\, xrefs: 007A7D89
\b(?=\w), xrefs: 0081F85E
[:<:]], xrefs: 007A7D1D
\, xrefs: 007A7E1D
[:>:]], xrefs: 007A7D37
\, xrefs: 0081F95B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _memset
String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
API String ID: 2102423945-2023335898
Opcode ID: 9bd8db71a88dfbc75bbc6cece2718ce867c25a18c3ce576103109f45c86e37f1
Instruction ID: e7f4b004b62459fde192d357dfb7e4fa2740def1d64b6b7df2d3ca6b7bcb6ed4
Opcode Fuzzy Hash: 9bd8db71a88dfbc75bbc6cece2718ce867c25a18c3ce576103109f45c86e37f1
Instruction Fuzzy Hash: 8F82A071D04219DBCF28CF98C8806EDBBB5FF85314F248269D919EB251E7789D85CB90

Function 007F091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 007F09DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 007F09EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007F09FB
__wsplitpath.LIBCMT ref: 007F0A59
_wcscat.LIBCMT ref: 007F0A71
_wcscat.LIBCMT ref: 007F0A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007F0A98
SetCurrentDirectoryW.KERNEL32(?), ref: 007F0AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 007F0ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 007F0AFF
_wcscpy.LIBCMT ref: 007F0B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007F0B4A

Strings

*.*, xrefs: 007F0B05

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 607092deeacfedb2a2dd04bd4cc2a7b7f79100f673c5fac9872268a164f72081
Instruction ID: 4d3bdd8394477ff05c8120e2974813cd90b90963719fcae4376a0c2b35fd54bd
Opcode Fuzzy Hash: 607092deeacfedb2a2dd04bd4cc2a7b7f79100f673c5fac9872268a164f72081
Instruction Fuzzy Hash: 41612CB15043059FD710DF60C845AAEB3E8FF89310F04891DEA99C7352EB39E945CB92

Function 007DA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007DABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 007DABD7
Part of subcall function 007DABBB: GetLastError.KERNEL32(?,007DA69F,?,?,?), ref: 007DABE1
Part of subcall function 007DABBB: GetProcessHeap.KERNEL32(00000008,?,?,007DA69F,?,?,?), ref: 007DABF0
Part of subcall function 007DABBB: HeapAlloc.KERNEL32(00000000,?,007DA69F,?,?,?), ref: 007DABF7
Part of subcall function 007DABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 007DAC0E

Part of subcall function 007DAC56: GetProcessHeap.KERNEL32(00000008,007DA6B5,00000000,00000000,?,007DA6B5,?), ref: 007DAC62
Part of subcall function 007DAC56: HeapAlloc.KERNEL32(00000000,?,007DA6B5,?), ref: 007DAC69
Part of subcall function 007DAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,007DA6B5,?), ref: 007DAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007DA6D0
_memset.LIBCMT ref: 007DA6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007DA704
GetLengthSid.ADVAPI32(?), ref: 007DA715
GetAce.ADVAPI32(?,00000000,?), ref: 007DA752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007DA76E
GetLengthSid.ADVAPI32(?), ref: 007DA78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 007DA79A
HeapAlloc.KERNEL32(00000000), ref: 007DA7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 007DA7C2
CopySid.ADVAPI32(00000000), ref: 007DA7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007DA7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007DA820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 007DA834

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: fe25de0fefb84b7fadbb7c6b8bf165d5be28846d94b1212830c73a7db153c91a
Instruction ID: 553e4834f0be0aaafed64ee3fc4ebd1f0499c87d7142b8759daeabdf6d20c011
Opcode Fuzzy Hash: fe25de0fefb84b7fadbb7c6b8bf165d5be28846d94b1212830c73a7db153c91a
Instruction Fuzzy Hash: BD514971900249BFDF119FA4DC44EEEBBB9FF04300F04812AE915AA291DB789A06DB61

Function 007A6F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

CR), xrefs: 00822E09
ANYCRLF), xrefs: 00822E7D
LF), xrefs: 00822E26
CRLF), xrefs: 00822E43
NO_AUTO_POSSESS), xrefs: 00822CB0
UCP), xrefs: 00822C8F
UTF), xrefs: 00822C7C
NO_START_OPT), xrefs: 00822CD1
BSR_ANYCRLF), xrefs: 00822EA0
BSR_UNICODE), xrefs: 00822EBA
LIMIT_MATCH=, xrefs: 00822CF2
UTF16), xrefs: 00822C56
LIMIT_RECURSION=, xrefs: 00822D7E
ANY), xrefs: 00822E60

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 031ffda50100d793a13bbbfdc2e85739b4e83a01748023df626e2b40b94b075b
Instruction ID: 527e5ff2b65f4638d3b29bcc9efd81e6b814a495d26e87c2e8a6711ff3cc0d57
Opcode Fuzzy Hash: 031ffda50100d793a13bbbfdc2e85739b4e83a01748023df626e2b40b94b075b
Instruction Fuzzy Hash: A4728375E04229DBDF28CF58D8407AEB7B5FF49310F14416AE905EB281DB789E81DB90

Function 007E63F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007E6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007E5FA6,?), ref: 007E6ED8

Part of subcall function 007E72CB: GetFileAttributesW.KERNEL32(?,007E6019), ref: 007E72CC

_wcscat.LIBCMT ref: 007E6441
__wsplitpath.LIBCMT ref: 007E645F
FindFirstFileW.KERNEL32(?,?), ref: 007E6474
_wcscpy.LIBCMT ref: 007E64A3
_wcscat.LIBCMT ref: 007E64B8
_wcscat.LIBCMT ref: 007E64CA
DeleteFileW.KERNEL32(?), ref: 007E64DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 007E64EB
FindClose.KERNEL32(00000000), ref: 007E6506

Strings

\*.*, xrefs: 007E643B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: 21fdbaaf770a24e0f7a64d4c1569f482fab5cae3a80986b2c5203a04e51713ec
Instruction ID: d89d2b8a2781d9b976e48978b99893c5c3044eda6da249d863bae26bff4edfff
Opcode Fuzzy Hash: 21fdbaaf770a24e0f7a64d4c1569f482fab5cae3a80986b2c5203a04e51713ec
Instruction Fuzzy Hash: 5A31A4B24093849EC331DBA48889EDBB7DCAF5A350F40492EF5D9C3141EA39D60987A7

Function 008031BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00803C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00802BB5,?,?), ref: 00803C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0080328E

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0080332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 008033C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00803604
RegCloseKey.ADVAPI32(00000000), ref: 00803611

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: cae6825f546edaa321224d0499c5266ea05656e0e1d64cd4037795ba3264982a
Instruction ID: d6532437b25ea26b8f65db1a969536d9a01b44de19692913f3b99d0f89472e3c
Opcode Fuzzy Hash: cae6825f546edaa321224d0499c5266ea05656e0e1d64cd4037795ba3264982a
Instruction Fuzzy Hash: 0DE14731604200EFCB15DF28CC95E2ABBE8FF89314B04896DF54ADB2A1DB34E905CB52

Function 007E2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007E2B5F
GetAsyncKeyState.USER32(000000A0), ref: 007E2BE0
GetKeyState.USER32(000000A0), ref: 007E2BFB
GetAsyncKeyState.USER32(000000A1), ref: 007E2C15
GetKeyState.USER32(000000A1), ref: 007E2C2A
GetAsyncKeyState.USER32(00000011), ref: 007E2C42
GetKeyState.USER32(00000011), ref: 007E2C54
GetAsyncKeyState.USER32(00000012), ref: 007E2C6C
GetKeyState.USER32(00000012), ref: 007E2C7E
GetAsyncKeyState.USER32(0000005B), ref: 007E2C96
GetKeyState.USER32(0000005B), ref: 007E2CA8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 70f2452756438cbc70f021d887ea418b6e563d10c15530fb984cb6432e346a98
Instruction ID: d8d14506a6313521633887a86d51731083b2ccc3026e0e02e2888e6baee1bc6e
Opcode Fuzzy Hash: 70f2452756438cbc70f021d887ea418b6e563d10c15530fb984cb6432e346a98
Instruction Fuzzy Hash: AA4124706057C96DFF349B66C9043A9BEA86F19304F148059D9C2462D3EBEC99CAC7B2

Function 007F6D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 007F6D2E
EmptyClipboard.USER32 ref: 007F6D34
GlobalAlloc.KERNEL32(00000002,?), ref: 007F6D49
CloseClipboard.USER32 ref: 007F6DE8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: c90729dd005bdf5f72b642f563f706c25a9f7675d19fb4084e260084af07dd14
Instruction ID: 434fd3441412d26f90fcaf0c7d876320aca8e014eaebad9881dcd1d770b6303e
Opcode Fuzzy Hash: c90729dd005bdf5f72b642f563f706c25a9f7675d19fb4084e260084af07dd14
Instruction Fuzzy Hash: 98218B35300214EFDB21AF64DC49B6E7BA8FF54710F058019FA0A9B2A1DB78E8028B91

Function 007FC18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 007D9ABF: CLSIDFromProgID.OLE32 ref: 007D9ADC
Part of subcall function 007D9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 007D9AF7
Part of subcall function 007D9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 007D9B05
Part of subcall function 007D9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 007D9B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 007FC235
_memset.LIBCMT ref: 007FC242
_memset.LIBCMT ref: 007FC360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 007FC38C
CoTaskMemFree.OLE32(?), ref: 007FC397

Strings

NULL Pointer assignment, xrefs: 007FC3E5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 48c8ad0a85e293cc541855401e5fb1d1a2258e6931b6ab1e86f16573fedd937d
Instruction ID: c79a583d32ffa8dc0d3f9d8fa85c6abedc08caeddc4bc84ffd48c7ab469a6f3b
Opcode Fuzzy Hash: 48c8ad0a85e293cc541855401e5fb1d1a2258e6931b6ab1e86f16573fedd937d
Instruction Fuzzy Hash: D6912771D0021CEBDB11DF94DC85EEEBBB8AF48750F10812AF615A7281DB759A45CFA0

Function 007E79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 007DB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007DB180
Part of subcall function 007DB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007DB1AD
Part of subcall function 007DB134: GetLastError.KERNEL32 ref: 007DB1BA

ExitWindowsEx.USER32(?,00000000), ref: 007E7A0F

Strings

@, xrefs: 007E7A02
SeShutdownPrivilege, xrefs: 007E79DD
, xrefs: 007E79FD

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: dc51fa5c929be7360438c190121005e79afb0edbbed50121d8c48e662ac65a55
Instruction ID: 5395a35037a21ca87d9a03136264dd6cead66cfe19d917c9914c9dacbc642747
Opcode Fuzzy Hash: dc51fa5c929be7360438c190121005e79afb0edbbed50121d8c48e662ac65a55
Instruction Fuzzy Hash: C201FC7165A391AAF72C567D8C4BBBF3658AB08740F148435BD13E21D2EA6C5E01C1A0

Function 007F8C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 007F8CA8
WSAGetLastError.WSOCK32(00000000), ref: 007F8CB7
bind.WSOCK32(00000000,?,00000010), ref: 007F8CD3
listen.WSOCK32(00000000,00000005), ref: 007F8CE2
WSAGetLastError.WSOCK32(00000000), ref: 007F8CFC
closesocket.WSOCK32(00000000,00000000), ref: 007F8D10

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 82893500ee994309a04b780769b184b3a8ce2c724fb4c1551b93e0096181b1aa
Instruction ID: a7a81ed232bceef69562a30ada1945213595d9263f5ab255a71c7cfc58ed7405
Opcode Fuzzy Hash: 82893500ee994309a04b780769b184b3a8ce2c724fb4c1551b93e0096181b1aa
Instruction Fuzzy Hash: B621A231600204DFCB20AF64C949B7E7BA9FF49720F108158FA16A73D2CB78AD42CB61

Function 007E6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 007E6554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 007E6564
Process32NextW.KERNEL32(00000000,0000022C), ref: 007E6583
__wsplitpath.LIBCMT ref: 007E65A7
_wcscat.LIBCMT ref: 007E65BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 007E65F9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: bcf941fe6e2f68e1e7e27c1b08364ccf646551dbe3e661532348deca164114cd
Instruction ID: 5698a9fb0e8f42a5154ecf8e2cb694d946e41c634e33b19ad3c269692a45d1e7
Opcode Fuzzy Hash: bcf941fe6e2f68e1e7e27c1b08364ccf646551dbe3e661532348deca164114cd
Instruction Fuzzy Hash: EF21A771A01258EBDB20ABA5CC88FDEBBBCAB19340F5000A9F505D3141E7799F95CBA0

Function 007F923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007FA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 007FA84E

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 007F9296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 007F92B9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: a69526523cdf179f584959fa5ec180a750c8b72a0e0c65f3c4dbacd379ae9c80
Instruction ID: c7088d63a904abd9254542b44f146d8d6fe0a17d51c50967905334d3d2a89efb
Opcode Fuzzy Hash: a69526523cdf179f584959fa5ec180a750c8b72a0e0c65f3c4dbacd379ae9c80
Instruction Fuzzy Hash: C541B170600204EFDB10AF288C56F7E77E9EF44764F148558FA569B382CA789D028B91

Function 007EEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007EEB8A
_wcscmp.LIBCMT ref: 007EEBBA
_wcscmp.LIBCMT ref: 007EEBCF
FindNextFileW.KERNEL32(00000000,?), ref: 007EEBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 007EEC0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 544dc2abb99f5b4bd14ddafe72a22df771c952fb21bd4e6070a8991735bcde89
Instruction ID: 15e122ec86a7e7470dc4dc1a95ac90be0f120f51ad209c9451a4408192b11544
Opcode Fuzzy Hash: 544dc2abb99f5b4bd14ddafe72a22df771c952fb21bd4e6070a8991735bcde89
Instruction Fuzzy Hash: ED41B075600301CFC718DF28C495E9AB7E4FF49324F20495DE95ACB3A1DB39A945CBA1

Function 00808111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00808160
IsWindowEnabled.USER32 ref: 0080816E
GetForegroundWindow.USER32(?,?,00000001), ref: 0080817B
IsIconic.USER32 ref: 00808189
IsZoomed.USER32 ref: 00808197

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 54087ca88b15958aa0fe2659d0a6aac6dda0c4a3e8150b76a5a8bf5843130a58
Instruction ID: 5a5d1400007736ed1deb72d5eaab7beba2a8cfdd40c2c1e6fcb182582d8ba0e7
Opcode Fuzzy Hash: 54087ca88b15958aa0fe2659d0a6aac6dda0c4a3e8150b76a5a8bf5843130a58
Instruction Fuzzy Hash: 77119031301211EFE7612F269C48A6F7B98FF54760B044429F889D7281CF74D94386A4

Function 007A9B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 007A9ED4
VUUU, xrefs: 007A9E95
ERCP, xrefs: 007A9C32
VUUU, xrefs: 007A9EA7
VUUU, xrefs: 0082BE14

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 0d8741119637b208ca4c9bf7b9e9697a088eb6d1404a7112e976e185d74cbb31
Instruction ID: 0b301123467eccb674f4372883b9cd80e22d346d17558d3c6af66cd373a291c4
Opcode Fuzzy Hash: 0d8741119637b208ca4c9bf7b9e9697a088eb6d1404a7112e976e185d74cbb31
Instruction Fuzzy Hash: 72927C71A0022ADBDF24CF58C8407BDB7B1FB95314F24829AE916E7280E7799DD1CB91

Function 007BE01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007BE014,74DF0AE0,007BDEF1,0083DC38,?,?), ref: 007BE02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 007BE03E

Strings

GetNativeSystemInfo, xrefs: 007BE038
kernel32.dll, xrefs: 007BE027

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 155a6360735bf7e8072c17395b26fb33600a4f70df87f359a4112f4f4262693d
Instruction ID: 3791e7c6a7a40305bf9e96c8397423086450107f32882899429c1ad32b3581fe
Opcode Fuzzy Hash: 155a6360735bf7e8072c17395b26fb33600a4f70df87f359a4112f4f4262693d
Instruction Fuzzy Hash: 88D0C7705007129FD7315F65EC097D2BAF4FB05711F28C519E895D2750EBBCD8858750

Function 007E13CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007E13DC

Strings

|, xrefs: 007E140C
(, xrefs: 007E1422

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 17b7fa559ba08480ef50f0eabbe3a9aed1b2640d181a3a3c89e39adcaa4790c4
Instruction ID: c657de5f2a86cce399e73f9193f2196ed4c1235b2ae2eb1e8ae307501838ddf3
Opcode Fuzzy Hash: 17b7fa559ba08480ef50f0eabbe3a9aed1b2640d181a3a3c89e39adcaa4790c4
Instruction Fuzzy Hash: 3B322475A00645DFC728CF6AC481A6AB7F0FF48320B51C46EE59ADB3A2E774E941CB40

Function 007BB11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 007BB22F

Part of subcall function 007BB55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 007BB5A5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: 6cfd71088c54f12d94d15e8e18fec6a4dc8c5d114fb30a90bb9a85e632435a26
Instruction ID: 456be5bc5467609332cd63a42ddf79b41d56ccf7a448182cef63e656bea19bfd
Opcode Fuzzy Hash: 6cfd71088c54f12d94d15e8e18fec6a4dc8c5d114fb30a90bb9a85e632435a26
Instruction Fuzzy Hash: 06A15570114409BADB38AB2E9C8DFFF296DFF56344B144119FE02D2592DBAD9C41D272

Function 007F4EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007F43BF,00000000), ref: 007F4FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 007F4FD2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: bbea4e88012100cdc6f7fe48759059e71b6b70c5a2affb8a362a3c4c41a38fd7
Instruction ID: 2e414ab1ac14a7e8d796c2378d77a5fe323487517e34b2e129c1c07902efaf64
Opcode Fuzzy Hash: bbea4e88012100cdc6f7fe48759059e71b6b70c5a2affb8a362a3c4c41a38fd7
Instruction Fuzzy Hash: E741C47150420DFFEB209E94DC85FBB77ECEB40764F14402EF705A6281EA799E4196A0

Function 007EE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007EE20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 007EE267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 007EE2B4

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 819db9c1925db37def931b4d82c708cb892c1f460cdd88948e56efe5ca989718
Instruction ID: 3cbfa269930e952ff77eba2a41ecb0d1569a0c9c17c37fe42e54a567ff44a638
Opcode Fuzzy Hash: 819db9c1925db37def931b4d82c708cb892c1f460cdd88948e56efe5ca989718
Instruction Fuzzy Hash: 05213D75A00618EFCB00EFA5D885EEDFBB8FF49310F1484A9E905AB351DB359916CB50

Function 007DB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 007BF4EA: std::exception::exception.LIBCMT ref: 007BF51E
Part of subcall function 007BF4EA: __CxxThrowException@8.LIBCMT ref: 007BF533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007DB180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007DB1AD
GetLastError.KERNEL32 ref: 007DB1BA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 2bb92ec6723291b92e8eaaa62983115b82f132291dd016cec5efdd48e3a1cbd2
Instruction ID: 62d92b17f40ad7f1fbab39c1397f7fd4565f1562bc085a423b2b394cba8a90b5
Opcode Fuzzy Hash: 2bb92ec6723291b92e8eaaa62983115b82f132291dd016cec5efdd48e3a1cbd2
Instruction Fuzzy Hash: 4511BFB2400304EFE7289F64DC85E6BBBBDFB44710B21852EE05693251EB74FC428A60

Function 007E6606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007E6623
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 007E6664
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007E666F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 623e54652a3de5825cd980ad3423b9bdb1e0da16bcd90896ce17a3f072fd8d91
Instruction ID: 2a197ac1a3501bab2af49da6b9f1648a9d49eb5b8308c3b9592364b41ff04092
Opcode Fuzzy Hash: 623e54652a3de5825cd980ad3423b9bdb1e0da16bcd90896ce17a3f072fd8d91
Instruction Fuzzy Hash: 52111E71E11228BFDB108FA5DC45BAEBBFCEB49B50F108156F900E6290D7B45A058BA5

Function 007E71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 007E7223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007E723A
FreeSid.ADVAPI32(?), ref: 007E724A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 2b83bb1a0c7d423d929b3d0243910432d599099ea02751894bb1492e56846991
Instruction ID: 01a272073bbc5505a0605b55c680c847a1b523d2b4b437c6505ef62d7781368d
Opcode Fuzzy Hash: 2b83bb1a0c7d423d929b3d0243910432d599099ea02751894bb1492e56846991
Instruction Fuzzy Hash: 25F01D76A04309BFDF04DFE4DD89AEEBBBCFF08201F508469A602E2191E2749A458B54

Function 007EF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007EF599
FindClose.KERNEL32(00000000), ref: 007EF5C9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ad6c7113e059a4532611ee7d26f12a56bf2a934d904d8e470e375ce8073c8deb
Instruction ID: 14a39da6277764a2149e1f974a9bbe45f7e995e4c18d330114e57100174bd0a9
Opcode Fuzzy Hash: ad6c7113e059a4532611ee7d26f12a56bf2a934d904d8e470e375ce8073c8deb
Instruction Fuzzy Hash: E511C432600200DFD710EF29D849A2EF7E8FF98324F00891EF9A5D7291CB34AD118B91

Function 007ECE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,007FBE6A,?,?,00000000,?), ref: 007ECEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,007FBE6A,?,?,00000000,?), ref: 007ECEB9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: beb47e774cd5e8fdf4741f08ad034225a1c06add33c668328b9d711282e98b15
Instruction ID: 712b14171b9b58fb5c9479d316c1688e08b59181182a14ff38d06d772cde4282
Opcode Fuzzy Hash: beb47e774cd5e8fdf4741f08ad034225a1c06add33c668328b9d711282e98b15
Instruction Fuzzy Hash: 14F08235101329FBDB219BA4DC49FEA776DFF09351F008265F915D6181D6349A41CBA0

Function 007E411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 007E4153
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 007E4166

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 3bf3b81bca8106144cf04a8f25826218094db3faa879d85a29daab7fe39bb9dc
Instruction ID: b3bb8c4c88502dbc1d0805680023750c1e6b11a61b96badcf36300c0577b81a5
Opcode Fuzzy Hash: 3bf3b81bca8106144cf04a8f25826218094db3faa879d85a29daab7fe39bb9dc
Instruction Fuzzy Hash: D8F0677080038DAFDF058FA5C805BBE7FB0FF04305F00800AF966A6192D7B986129FA0

Function 007DAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007DACC0), ref: 007DAB99
CloseHandle.KERNEL32(?,?,007DACC0), ref: 007DABAB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 9eb9e7a40c24243f37317e5e3419d5439bb2dcd4711b10ded8471f6e143be39b
Instruction ID: 1deec9701edb0e7bc4ee249917d28a9fb9df95354fd0a71fdb5ecf0e09bd3660
Opcode Fuzzy Hash: 9eb9e7a40c24243f37317e5e3419d5439bb2dcd4711b10ded8471f6e143be39b
Instruction Fuzzy Hash: 8FE0BF72000610EFE7352F55EC09EB67BE9FF043217108429F45981470D7765C919B50

Function 007C81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,007C6DB3,-0000031A,?,?,00000001), ref: 007C81B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 007C81BA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4aea4dcfecba90ad549e30e8c7282f1f0bca0152046329e1af34dd8c8d6563a6
Instruction ID: bac500f373edacebf60e962f01a229e4c288d2a573c11d508868b5afcc421703
Opcode Fuzzy Hash: 4aea4dcfecba90ad549e30e8c7282f1f0bca0152046329e1af34dd8c8d6563a6
Instruction Fuzzy Hash: 97B09231044708BBEB106BA1EC0DB587F68FB08656F10C010F60D88261AB7254128A92

Function 007A77B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007A7921

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f1da49abd1664147e7d980a73a5efc7acf7a268e358350db8d6a506c205ab352
Instruction ID: e6613ae00f9e5cfb2cc66fa9988c2d5d2453b17ab7f7f529feadc7612db49fd0
Opcode Fuzzy Hash: f1da49abd1664147e7d980a73a5efc7acf7a268e358350db8d6a506c205ab352
Instruction Fuzzy Hash: A2A26D74D04219DFCB28CF58C8846ADBBB1FF99314F2582A9D859AB391D7349E81CF50

Function 007B3B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON

Download Yara Rule

Strings

@, xrefs: 007B4176

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @
API String ID: 3728558374-2766056989
Opcode ID: 68ecc5e336d4d265bf8151622e5a2ec94a7a91658e2a4333b1ece31826f69211
Instruction ID: 470136b833bfeda04ec0a37db7f8b34611cc1f8c75c328541875266e7fee19c1
Opcode Fuzzy Hash: 68ecc5e336d4d265bf8151622e5a2ec94a7a91658e2a4333b1ece31826f69211
Instruction Fuzzy Hash: 6C727C74A04209DFCB14DF94C485BFEB7B5FF48300F14805AE916AB291D779AE86CB91

Function 007CD1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd94297990968b18b8d5ce6d95cba7c3575c79bf2473d53df848a0089447ec7
Instruction ID: 257c9e832b0beea401de0ea07a4efc4ef10aaf0e84fabcda9caa0bc6e3a4e529
Opcode Fuzzy Hash: 3cd94297990968b18b8d5ce6d95cba7c3575c79bf2473d53df848a0089447ec7
Instruction Fuzzy Hash: CA32D131D29F414DD7339634D922325A398BFB73D4F15DB3BE819B5AA6EB29D8834100

Function 007A96C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: af14923611f9ba6a02c8b173a6bbff4ccd6c27e9755170af04b0fd059f5bd26a
Instruction ID: 719a56556018c9fe207583b68a55e5040b4729a5cf9e2da6868a3b16e2bdf0ca
Opcode Fuzzy Hash: af14923611f9ba6a02c8b173a6bbff4ccd6c27e9755170af04b0fd059f5bd26a
Instruction Fuzzy Hash: 552266715083009FD724DF14C894BABB7E4BFC5310F104A2DFA9A9B291DB79E945CB92

Function 007D038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578f519ed473217f54052bf9749946cf8ae076de06faf822d24c1cefed76e373
Instruction ID: c811adf757f1656d9069487ffd701ba8cbf7212c1044a77c0906020d7b0cdd62
Opcode Fuzzy Hash: 578f519ed473217f54052bf9749946cf8ae076de06faf822d24c1cefed76e373
Instruction Fuzzy Hash: 7CB1D120D2AF414DD62396398971336B65CBFFB2D5F91DB1BFC1A74E62EB2285834180

Function 007EB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 007EB6DF

Part of subcall function 007C344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,007EBDC3,00000000,?,?,?,?,007EBF70,00000000,?), ref: 007C3453
Part of subcall function 007C344A: __aulldiv.LIBCMT ref: 007C3473

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 7a6792a3682040e2eacb917d783efdcfc2b395086a1c84c80c061a5775b25c9e
Instruction ID: b2ca009bc2638b1e2658fbdaa10f9611500de62aa95126eb6106877bc9ca2636
Opcode Fuzzy Hash: 7a6792a3682040e2eacb917d783efdcfc2b395086a1c84c80c061a5775b25c9e
Instruction Fuzzy Hash: EA218472634510CBC729CF79D881A52BBE1EB99310B258E7DE4E5CB2C0CB78BA05DB54

Function 007F6AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 007F6ACA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 08bcd691fa49bda2505ad3f29e4171bef4be377789df7c4fb61e1f3e6873af2b
Instruction ID: 164b70beba59974308deb64f1e4fd4afd6902bedec27af52616662973a46d792
Opcode Fuzzy Hash: 08bcd691fa49bda2505ad3f29e4171bef4be377789df7c4fb61e1f3e6873af2b
Instruction Fuzzy Hash: 76E04835200204AFC750EF59D808E9ABBECBFB4751F04C456FA45D7391DAB4F8058BA0

Function 007E74E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 007E750A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 67f8f15106fe7043c3ed3f2a2e95ea4daed37f57d4d989ea2dd616b7732f55f4
Instruction ID: f479cbf6ed398f98fb0723370a318bbf00d4cb3ce2a380c908e33a6f2aafff67
Opcode Fuzzy Hash: 67f8f15106fe7043c3ed3f2a2e95ea4daed37f57d4d989ea2dd616b7732f55f4
Instruction Fuzzy Hash: E5D09EA416E6C579ED2D07269C1FFB71909F309786FD495497613D90C0B8DC5D51E031

Function 007DB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,007DAD3E), ref: 007DB124

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 1898d4522b402696c86f8839fb4848a4cd4f8826214e5adcc5e03c37bcfa462b
Instruction ID: 7f6e98080cdb603c6401ae4ec78f0b657dc757b9240674f62ebbdbe093c55f8a
Opcode Fuzzy Hash: 1898d4522b402696c86f8839fb4848a4cd4f8826214e5adcc5e03c37bcfa462b
Instruction Fuzzy Hash: 20D05E320A4A0EAEDF028FA4DC02EAE3F6AEB04700F408110FA11C50A0C671D532AB50

Function 0081B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0081B352

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 72838d746bee9346168ac63dc23999071f30b2add6a32bf3316d2d32226a4a94
Instruction ID: 464ae6d34f2e9d767d517d0cda3de53735690e1391802e0d3565c273dddbb1b3
Opcode Fuzzy Hash: 72838d746bee9346168ac63dc23999071f30b2add6a32bf3316d2d32226a4a94
Instruction Fuzzy Hash: 25C04CB140150DDFC755CBC0C9449EEB7BCBB04305F1050919105F1110D7709B859B72

Function 007C8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 007C818F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6310f9a5632d5bc2266f829c0e1549983403804c1e86623e50c59c9125b39a87
Instruction ID: 96cf6ce153da669b1cb687f82a3edfa3427fa2ea2c810034f33a7620e04852f5
Opcode Fuzzy Hash: 6310f9a5632d5bc2266f829c0e1549983403804c1e86623e50c59c9125b39a87
Instruction Fuzzy Hash: 41A0113000020CAB8F002B82EC088883F2CFA002A0B208020F80C80220AB32A8228A82

Function 007B3200 Relevance: 1.0, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 1259c8a7d8c65bffea9813ef13a5f945f638450ecfcbcdb1144caa9afd42484d
Instruction ID: 464d7aee92acbd4721bbf13b71b2645ce7ca2aa6d90514b71dc9e752ef36e184
Opcode Fuzzy Hash: 1259c8a7d8c65bffea9813ef13a5f945f638450ecfcbcdb1144caa9afd42484d
Instruction Fuzzy Hash: 3C928870608341DFD724CF18C494BAABBE5FF88304F14895DE88A8B262D779ED85CB52

Function 007AE3B0 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399670cf2c3ee8fb6d311e5e7e894d9fb92c10488048f5f228c0bfc259b6eeca
Instruction ID: 4299e3d779df989dfc955bcef54a3a0386b827e0e5f22c75912199871f3a0451
Opcode Fuzzy Hash: 399670cf2c3ee8fb6d311e5e7e894d9fb92c10488048f5f228c0bfc259b6eeca
Instruction Fuzzy Hash: CB22DE70904206CFDB24DF58C494BAEB7B0FF9A300F248269E9469B351E339AD85CB91

Function 007A93F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5111d8c08e1a01796d6e3466d71c375308d744a3246cd3c6c4c7c2dfaab13107
Instruction ID: 66f8b88f57e489653ac5dd02d7a8c9d97ab953263fba721498fa5ae9b9ed6de7
Opcode Fuzzy Hash: 5111d8c08e1a01796d6e3466d71c375308d744a3246cd3c6c4c7c2dfaab13107
Instruction Fuzzy Hash: BA126E70A00209DFDF04DFA9D985AEEB7F5FF89300F104669E406E7291EB39A961CB50

Function 007AAF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: fa7781e0a47a20c6f887780313dc883d36f7a3a02658980aeef5cc3e755cd73d
Instruction ID: 44c440d62b362d705708729953aa15344f9626a8c1f3fbf542155a54422b4528
Opcode Fuzzy Hash: fa7781e0a47a20c6f887780313dc883d36f7a3a02658980aeef5cc3e755cd73d
Instruction Fuzzy Hash: 2502E770A00209DFCF04DF68D985AAEBBB5FF89300F148169E806DB255EB39DD65CB91

Function 007C02A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 40b98d1132d365ca293e048c882ed1b490f6c75e1d5469df108a5983bdca367e
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 41C1B7322051D34ADF2D4639C834A7EFBA15E92BB131A076DD8B3DB4D5EF28C524D6A0

Function 007C06D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 7efee0e1b9108e8d659d0d47d252014f7ab374b945c8430ad502b3716de81c86
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: E1C1E53320519349DF2D4639C834A7EFBA15EA2BB131A076DD4B3CB4D5EF28D524D6A0

Function 007BFA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: e21714121773911ac50bbd5180ceba5558a083668678872f2959c27b557a27ec
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 3FC1823220509309DF2D4639CC746BEBAA15AA2FB131A177DD8B3CB5D9EF28C564D620

Function 01563068 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 5da8097a82b16a414e946da2ce2735e75df0984acd0f9b36fb92e45f0ea58800
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 0C41C171D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB80

Function 01562F58 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 79653644232131a38d031366eaadcaeccdf8a32c4ad14522693225ff75e90f24
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 52019278A00109EFCB44DF98C5909AEF7F9FF48310F208699E819AB705D730AE41DB80

Function 01562EF8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 32f680ee0fedd8596663a4d18d622de9cab419b89ad89cfb7b8eb9565d6adf76
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: EE019278A11109EFCB44DF98C5909AEF7F9FF58310F208599E819AB705D730AE42DB80

Function 015618C8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703970988.000000000155F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0155F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155f000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 007FA2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 007FA2FE
DeleteObject.GDI32(00000000), ref: 007FA310
DestroyWindow.USER32 ref: 007FA31E
GetDesktopWindow.USER32 ref: 007FA338
GetWindowRect.USER32(00000000), ref: 007FA33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 007FA480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 007FA490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA4D8
GetClientRect.USER32(00000000,?), ref: 007FA4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 007FA51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA55E
GlobalLock.KERNEL32(00000000), ref: 007FA567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA576
GlobalUnlock.KERNEL32(00000000), ref: 007FA57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA586
GlobalFree.KERNEL32(00000000), ref: 007FA591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0082D9BC,00000000), ref: 007FA5B9
GlobalFree.KERNEL32(00000000), ref: 007FA5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 007FA5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 007FA60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007FA81D

Strings

DISPLAY, xrefs: 007FA680
static, xrefs: 007FA518, 007FA66F
AutoIt v3, xrefs: 007FA4D0
, xrefs: 007FA7A3

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 35309d28db4027c0f71864ca2a07e58f48f3cb3587b2466bbfca91151e3f13b0
Instruction ID: 8a2c52f000d706552e90e1c4b04e5a995a31db392ede1aaf8b52bc7620449408
Opcode Fuzzy Hash: 35309d28db4027c0f71864ca2a07e58f48f3cb3587b2466bbfca91151e3f13b0
Instruction Fuzzy Hash: 01027E71900208EFDB14DFA4CD89EAE7BB9FF49310F148158FA19AB2A1D774AD41CB61

Function 0080D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0080D2DB
GetSysColorBrush.USER32(0000000F), ref: 0080D30C
GetSysColor.USER32(0000000F), ref: 0080D318
SetBkColor.GDI32(?,000000FF), ref: 0080D332
SelectObject.GDI32(?,00000000), ref: 0080D341
InflateRect.USER32(?,000000FF,000000FF), ref: 0080D36C
GetSysColor.USER32(00000010), ref: 0080D374
CreateSolidBrush.GDI32(00000000), ref: 0080D37B
FrameRect.USER32(?,?,00000000), ref: 0080D38A
DeleteObject.GDI32(00000000), ref: 0080D391
InflateRect.USER32(?,000000FE,000000FE), ref: 0080D3DC
FillRect.USER32(?,?,00000000), ref: 0080D40E
GetWindowLongW.USER32(?,000000F0), ref: 0080D439

Part of subcall function 0080D575: GetSysColor.USER32(00000012), ref: 0080D5AE
Part of subcall function 0080D575: SetTextColor.GDI32(?,?), ref: 0080D5B2
Part of subcall function 0080D575: GetSysColorBrush.USER32(0000000F), ref: 0080D5C8
Part of subcall function 0080D575: GetSysColor.USER32(0000000F), ref: 0080D5D3
Part of subcall function 0080D575: GetSysColor.USER32(00000011), ref: 0080D5F0
Part of subcall function 0080D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0080D5FE
Part of subcall function 0080D575: SelectObject.GDI32(?,00000000), ref: 0080D60F
Part of subcall function 0080D575: SetBkColor.GDI32(?,00000000), ref: 0080D618
Part of subcall function 0080D575: SelectObject.GDI32(?,?), ref: 0080D625
Part of subcall function 0080D575: InflateRect.USER32(?,000000FF,000000FF), ref: 0080D644
Part of subcall function 0080D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0080D65B
Part of subcall function 0080D575: GetWindowLongW.USER32(00000000,000000F0), ref: 0080D670
Part of subcall function 0080D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0080D698

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 016ca46410dcae26f9574dd88cfafa1dd488d453729156f1130c0c79efe9611c
Instruction ID: d0c19696160f221e08e036c956685af3c3e3c285a0d3be1dfc633ad56784cd13
Opcode Fuzzy Hash: 016ca46410dcae26f9574dd88cfafa1dd488d453729156f1130c0c79efe9611c
Instruction Fuzzy Hash: 05919E72408301FFDB609F64DC08A6BBBA9FF89325F108A19F962D61E0D771D946CB52

Function 007BB8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 007BB98B
DeleteObject.GDI32(00000000), ref: 007BB9CD
DeleteObject.GDI32(00000000), ref: 007BB9D8
DestroyIcon.USER32(00000000), ref: 007BB9E3
DestroyWindow.USER32(00000000), ref: 007BB9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 0081D2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0081D2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0081D711

Part of subcall function 007BB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007BB759,?,00000000,?,?,?,?,007BB72B,00000000,?), ref: 007BBA58

SendMessageW.USER32 ref: 0081D758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0081D76F
ImageList_Destroy.COMCTL32(00000000), ref: 0081D785
ImageList_Destroy.COMCTL32(00000000), ref: 0081D790

Strings

0, xrefs: 0081D5A5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: a887114d557c3ea561d70482202fc36d77b1ddff2d5d8e97d6e8cb7f2dc67e5b
Instruction ID: c17035590f10e1f8043e767fc94b727b158a4e26459d54bfa62dddd52baa88a0
Opcode Fuzzy Hash: a887114d557c3ea561d70482202fc36d77b1ddff2d5d8e97d6e8cb7f2dc67e5b
Instruction Fuzzy Hash: A4127C70204301DFDB25CF28C888BE9BBE9FF55304F184569E999CB662C775E886CB91

Function 007EDBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007EDBD6
GetDriveTypeW.KERNEL32(?,0083DC54,?,\\.\,0083DC00), ref: 007EDCC3
SetErrorMode.KERNEL32(00000000,0083DC54,?,\\.\,0083DC00), ref: 007EDE29

Strings

Network, xrefs: 007EDD01
PhysicalDrive, xrefs: 007EDC67
RAMDisk, xrefs: 007EDCED
SAS, xrefs: 007EDDD2
1394, xrefs: 007EDDA8
Removable, xrefs: 007EDD15
SSD, xrefs: 007EDD50
\\.\, xrefs: 007EDC2B
CDROM, xrefs: 007EDCF7
Fixed, xrefs: 007EDD0B
USB, xrefs: 007EDDBD
SCSI, xrefs: 007EDD93
SATA, xrefs: 007EDDD9
ATAPI, xrefs: 007EDD9A
iSCSI, xrefs: 007EDDCB
Fibre, xrefs: 007EDDB6
Virtual, xrefs: 007EDDEE
MMC, xrefs: 007EDDE7
ATA, xrefs: 007EDDA1
SSA, xrefs: 007EDDAF
RAID, xrefs: 007EDDC4
FileBackedVirtual, xrefs: 007EDDF5
Unknown, xrefs: 007EDCE3, 007EDD8C

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 4b42e8799d415065f0eb94c54372d43a4b26a4c462eb428216e2df5fecf97890
Instruction ID: 56d7b6fa87d357eec62639cef9ca09d532fada454280c1d0c7c6def36f2e8b02
Opcode Fuzzy Hash: 4b42e8799d415065f0eb94c54372d43a4b26a4c462eb428216e2df5fecf97890
Instruction Fuzzy Hash: 9351F630309382EB8620DF12CC458A9B7A0FB9D395B24491AF813DB395CB6CDD69D743

Function 007ACC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007ACC68
__wcsnicmp.LIBCMT ref: 007ACC80
__wcsnicmp.LIBCMT ref: 007ACC98
__wcsnicmp.LIBCMT ref: 007ACCB0
__wcsnicmp.LIBCMT ref: 007ACCC8
__wcsnicmp.LIBCMT ref: 007ACCE0
__wcsnicmp.LIBCMT ref: 007ACCF8
__wcsnicmp.LIBCMT ref: 007ACD0C
__wcsnicmp.LIBCMT ref: 007ACD4D
__wcsnicmp.LIBCMT ref: 007ACD61
__wcsnicmp.LIBCMT ref: 007ACD75
__wcsnicmp.LIBCMT ref: 007ACD89

Strings

Bad directive syntax error, xrefs: 00812ECB
#comments-start, xrefs: 007ACCF2, 007ACD47
#pragma compile, xrefs: 007ACC62
#notrayicon, xrefs: 007ACC7A
#OnAutoItStartRegister, xrefs: 007ACCAA
#include-once, xrefs: 007ACCC2
#comments-end, xrefs: 007ACD6F
#ce, xrefs: 007ACD83
#include, xrefs: 007ACCDA
Unterminated group of comments, xrefs: 00812FB4
#requireadmin, xrefs: 007ACC92
Cannot parse #include, xrefs: 00812FA1
#cs, xrefs: 007ACD06, 007ACD5B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 3843f20c3b77675c636e85b0d667bcf905845f5510926d6481e72907a259bee3
Instruction ID: 1ed32aa3bf3e6f0a04bc789a855587e94bdbcdf8923f3881d9325b6e7a87d48a
Opcode Fuzzy Hash: 3843f20c3b77675c636e85b0d667bcf905845f5510926d6481e72907a259bee3
Instruction Fuzzy Hash: 5481F830640305FBDB26AB64DC46FEA37A9FF96710F044138F905EA283EB69D955C2A1

Function 0080638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0083DC00), ref: 00806449

Strings

GETCURRENTLINE, xrefs: 00806704
HIDEDROPDOWN, xrefs: 00806520
GETCURRENTCOL, xrefs: 00806724
UNCHECK, xrefs: 008066A1
GETLINECOUNT, xrefs: 008066E4
EDITPASTE, xrefs: 0080675B
CURRENTTAB, xrefs: 008064DD
GETLINE, xrefs: 0080678B
GETCURRENTSELECTION, xrefs: 00806603
SELECTSTRING, xrefs: 00806626
GETSELECTED, xrefs: 008066C1
ISENABLED, xrefs: 0080648C
SENDCOMMANDID, xrefs: 008067CA
DELSTRING, xrefs: 00806569
CHECK, xrefs: 0080668B
ADDSTRING, xrefs: 00806536
TABLEFT, xrefs: 008064A7
ISCHECKED, xrefs: 00806659
ISVISIBLE, xrefs: 00806455
SHOWDROPDOWN, xrefs: 00806500
TABRIGHT, xrefs: 008064BD
FINDSTRING, xrefs: 00806596
SETCURRENTSELECTION, xrefs: 008065D6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 957602b98d669373c70f7fc86386b82ed8c7993ff5d5ccd5ff21e897481f491f
Instruction ID: 250cb36430b0f003c5f6abd4639e35b8a2bc5665517e9c9bfaa89d8f599803d3
Opcode Fuzzy Hash: 957602b98d669373c70f7fc86386b82ed8c7993ff5d5ccd5ff21e897481f491f
Instruction Fuzzy Hash: 12C1A230204245CBCB44EF10C955AAE77A5FF95348F004969F886DB3D3EB24ED6ACB92

Function 0080D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0080D5AE
SetTextColor.GDI32(?,?), ref: 0080D5B2
GetSysColorBrush.USER32(0000000F), ref: 0080D5C8
GetSysColor.USER32(0000000F), ref: 0080D5D3
CreateSolidBrush.GDI32(?), ref: 0080D5D8
GetSysColor.USER32(00000011), ref: 0080D5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0080D5FE
SelectObject.GDI32(?,00000000), ref: 0080D60F
SetBkColor.GDI32(?,00000000), ref: 0080D618
SelectObject.GDI32(?,?), ref: 0080D625
InflateRect.USER32(?,000000FF,000000FF), ref: 0080D644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0080D65B
GetWindowLongW.USER32(00000000,000000F0), ref: 0080D670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0080D698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0080D6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 0080D6DD
DrawFocusRect.USER32(?,?), ref: 0080D6E8
GetSysColor.USER32(00000011), ref: 0080D6F6
SetTextColor.GDI32(?,00000000), ref: 0080D6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0080D712
SelectObject.GDI32(?,0080D2A5), ref: 0080D729
DeleteObject.GDI32(?), ref: 0080D734
SelectObject.GDI32(?,?), ref: 0080D73A
DeleteObject.GDI32(?), ref: 0080D73F
SetTextColor.GDI32(?,?), ref: 0080D745
SetBkColor.GDI32(?,?), ref: 0080D74F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 91e85aa58084ec3c366b8ff6adc60ce99439e36e809e69db23f277566524a8ff
Instruction ID: 0c9c258bece2f8a5748fe6fde48ea40513f1e3f40e612eeee53249acbd5b9851
Opcode Fuzzy Hash: 91e85aa58084ec3c366b8ff6adc60ce99439e36e809e69db23f277566524a8ff
Instruction Fuzzy Hash: 36512E72900208EFDB209FA4DC49AAEBFB9FF08324F208515F915AB2E1D7759941CF50

Function 0080B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0080B7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0080B7C1
CharNextW.USER32(0000014E), ref: 0080B7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0080B831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0080B847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0080B858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0080B875
SetWindowTextW.USER32(?,0000014E), ref: 0080B8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0080B8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 0080B90E
_memset.LIBCMT ref: 0080B933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0080B97C
_memset.LIBCMT ref: 0080B9DB
SendMessageW.USER32 ref: 0080BA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 0080BA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 0080BB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 0080BB2C
GetMenuItemInfoW.USER32(?), ref: 0080BB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0080BBA3
DrawMenuBar.USER32(?), ref: 0080BBB2
SetWindowTextW.USER32(?,0000014E), ref: 0080BBDA

Strings

0, xrefs: 0080BB4F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: f0ae3d9b41cdad127bf72222b052e874c1e631dc49d510f140499a0366abe373
Instruction ID: ff4aef8b2a5025d9a3b65858a6b0c5a7d1d50b85aaa6aad7bc1ff7dbcb45aa38
Opcode Fuzzy Hash: f0ae3d9b41cdad127bf72222b052e874c1e631dc49d510f140499a0366abe373
Instruction Fuzzy Hash: 33E18CB5900219ABDF608F65CC88EEE7BB8FF05714F10815AF919EA2D1D7748A41CF60

Function 0080764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0080778A
GetDesktopWindow.USER32 ref: 0080779F
GetWindowRect.USER32(00000000), ref: 008077A6
GetWindowLongW.USER32(?,000000F0), ref: 00807808
DestroyWindow.USER32(?), ref: 00807834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0080785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0080787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 008078A1
SendMessageW.USER32(?,00000421,?,?), ref: 008078B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 008078C9
IsWindowVisible.USER32(?), ref: 008078E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00807904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00807918
GetWindowRect.USER32(?,?), ref: 00807930
MonitorFromPoint.USER32(?,?,00000002), ref: 00807956
GetMonitorInfoW.USER32 ref: 00807970
CopyRect.USER32(?,?), ref: 00807987
SendMessageW.USER32(?,00000412,00000000), ref: 008079F2

Strings

tooltips_class32, xrefs: 00807856
(, xrefs: 00807965
0, xrefs: 00807735

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 9f03556c5b9272b6d9e1edc5017369da01b96777ef9fe07fc76dd047a32e924b
Instruction ID: b3a1283455457c35aac6056b1659c2da132f9e54f953ea47e6a65f0538fa0ef4
Opcode Fuzzy Hash: 9f03556c5b9272b6d9e1edc5017369da01b96777ef9fe07fc76dd047a32e924b
Instruction Fuzzy Hash: F2B17B71A08300AFDB54DF64C948B5ABBE5FF88310F008A1DF599DB291D774E805CB96

Function 007BA856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007BA939
GetSystemMetrics.USER32(00000007), ref: 007BA941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007BA96C
GetSystemMetrics.USER32(00000008), ref: 007BA974
GetSystemMetrics.USER32(00000004), ref: 007BA999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007BA9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 007BA9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 007BA9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 007BAA0D
GetClientRect.USER32(00000000,000000FF), ref: 007BAA2B
GetStockObject.GDI32(00000011), ref: 007BAA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 007BAA52

Part of subcall function 007BB63C: GetCursorPos.USER32(000000FF), ref: 007BB64F
Part of subcall function 007BB63C: ScreenToClient.USER32(00000000,000000FF), ref: 007BB66C
Part of subcall function 007BB63C: GetAsyncKeyState.USER32(00000001), ref: 007BB691
Part of subcall function 007BB63C: GetAsyncKeyState.USER32(00000002), ref: 007BB69F

SetTimer.USER32(00000000,00000000,00000028,007BAB87), ref: 007BAA79

Strings

AutoIt v3 GUI, xrefs: 007BA9F1

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 09bee1f656b4bd3d70b9141d25a37b8763625cecf3cee8b689704708a6f79be1
Instruction ID: a3aacee0720606a8e158a388c6df80d65935757199e4c5f2fda38a1e80b9a5ff
Opcode Fuzzy Hash: 09bee1f656b4bd3d70b9141d25a37b8763625cecf3cee8b689704708a6f79be1
Instruction Fuzzy Hash: 8BB13B7560030AAFDB14DFA8DC49BEE7BB8FF18314F158219FA15E6290DB78A841CB51

Function 007A2EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007A2F7A
IsWindow.USER32(?), ref: 008122FD

Strings

REGEXPTITLE, xrefs: 008120F8
ALL, xrefs: 00812264
INSTANCE, xrefs: 0081223C
LAST, xrefs: 008120B6
REGEXPCLASS, xrefs: 00812149
TITLE, xrefs: 00812292
CLASS, xrefs: 00812128
HANDLE, xrefs: 008120E2
ACTIVE, xrefs: 008120CC

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 62970417-1919597938
Opcode ID: 6fe035fd1b395f223a9db69a268d17a3bbac71d1a9ebb990fe9685eb540bdaf7
Instruction ID: 1703e5e01d4957403b6d476d278a63739b42ed8433e9e5f4f271a7bf673319c8
Opcode Fuzzy Hash: 6fe035fd1b395f223a9db69a268d17a3bbac71d1a9ebb990fe9685eb540bdaf7
Instruction Fuzzy Hash: D7D1C430108246EBCB04EF54C845ADAFBB4FF95344F004A1DF456D76A2DB34E9AADB91

Function 00803639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00803735
RegCreateKeyExW.ADVAPI32(?,?,00000000,0083DC00,00000000,?,00000000,?,?), ref: 008037A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 008037EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00803874
RegCloseKey.ADVAPI32(?), ref: 00803B94
RegCloseKey.ADVAPI32(00000000), ref: 00803BA1

Strings

REG_MULTI_SZ, xrefs: 0080395C
REG_SZ, xrefs: 008038B2
REG_QWORD, xrefs: 00803AE2
REG_BINARY, xrefs: 00803B2F
REG_DWORD, xrefs: 00803A65
REG_EXPAND_SZ, xrefs: 00803811

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 62a3a867bf01e5573e9c61aa552b9e0b3a1a325844ee9817d0a77e30ff6fe296
Instruction ID: 761b1fdb49f81def3c878bd08fb0c9348cc853d53ac150e816b5c5e890c5af16
Opcode Fuzzy Hash: 62a3a867bf01e5573e9c61aa552b9e0b3a1a325844ee9817d0a77e30ff6fe296
Instruction Fuzzy Hash: 11025875204601DFCB14EF24C859A2AB7E9FF89724F05855DF98A9B3A2CB34ED41CB81

Function 00806BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00806C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00806D16

Strings

GETITEMCOUNT, xrefs: 00806C84
GETTEXT, xrefs: 00806CBF
VIEWCHANGE, xrefs: 00806ECD
SELECTALL, xrefs: 00806D75
SELECTINVERT, xrefs: 00806DDE
GETSUBITEMCOUNT, xrefs: 00806CA1
ISSELECTED, xrefs: 00806D21
GETSELECTED, xrefs: 00806E3C
DESELECT, xrefs: 00806DFC
FINDITEM, xrefs: 00806E81
SELECTCLEAR, xrefs: 00806D8D
SELECT, xrefs: 00806DA8
GETSELECTEDCOUNT, xrefs: 00806CF9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: a47c588135d4d40c62b5d3220e695a42504bcac01aebd28318482917d71b43b5
Instruction ID: 584242157da59409584b09254c7756ddbeaa419130964c7165a5746f64e113ce
Opcode Fuzzy Hash: a47c588135d4d40c62b5d3220e695a42504bcac01aebd28318482917d71b43b5
Instruction Fuzzy Hash: 8FA18D70204345DFCB54EF20C856AAAB7A1FF84314F144969B866DB3D2EB34EC2ACB51

Function 007DCF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 007DCF91
__swprintf.LIBCMT ref: 007DD032
_wcscmp.LIBCMT ref: 007DD045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 007DD09A
_wcscmp.LIBCMT ref: 007DD0D6
GetClassNameW.USER32(?,?,00000400), ref: 007DD10D
GetDlgCtrlID.USER32(?), ref: 007DD15F
GetWindowRect.USER32(?,?), ref: 007DD195
GetParent.USER32(?), ref: 007DD1B3
ScreenToClient.USER32(00000000), ref: 007DD1BA
GetClassNameW.USER32(?,?,00000100), ref: 007DD234
_wcscmp.LIBCMT ref: 007DD248
GetWindowTextW.USER32(?,?,00000400), ref: 007DD26E
_wcscmp.LIBCMT ref: 007DD282

Strings

%s%u, xrefs: 007DD02C

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: 9b7afc475b398f0d0c34a8d6a3e8a426995d41791fd0eb2e1965aff2543c9118
Instruction ID: a3ff82112e996e8e9393d4b907b286c1b93531afbb4deba2fba32cb17838df09
Opcode Fuzzy Hash: 9b7afc475b398f0d0c34a8d6a3e8a426995d41791fd0eb2e1965aff2543c9118
Instruction Fuzzy Hash: 65A1B171604306EFD725DF64C884FAAB7A8FF48354F00852AF999D2250DB38EE46CB91

Function 007DD8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 007DD8EB
_wcscmp.LIBCMT ref: 007DD8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 007DD924
CharUpperBuffW.USER32(?,00000000), ref: 007DD941
_wcscmp.LIBCMT ref: 007DD95F
_wcsstr.LIBCMT ref: 007DD970
GetClassNameW.USER32(00000018,?,00000400), ref: 007DD9A8
_wcscmp.LIBCMT ref: 007DD9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 007DD9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 007DDA28
_wcscmp.LIBCMT ref: 007DDA38
GetClassNameW.USER32(00000010,?,00000400), ref: 007DDA60
GetWindowRect.USER32(00000004,?), ref: 007DDAC9

Strings

@, xrefs: 007DD8C6
ThumbnailClass, xrefs: 007DD9B3, 007DDA33

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: b42444053fd25ea8aeded12c656adf3b2fc7ef4265e54b7afc4d1ae53b114358
Instruction ID: 14b33a57e11588f4877de283b1ce3b021820fc6fcadc2bd3ca496c3dee7b6833
Opcode Fuzzy Hash: b42444053fd25ea8aeded12c656adf3b2fc7ef4265e54b7afc4d1ae53b114358
Instruction Fuzzy Hash: 1381A3710083459BDB25DF14C885FAA7BA8FF84314F04846BFD899A196DB38ED46CBA1

Function 007DD6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007DD753

Strings

REGEXP=, xrefs: 007DD768
[REGEXPTITLE:, xrefs: 007DD77B
[ALL, xrefs: 007DD7F9
HANDLE=, xrefs: 007DD74C
[CLASS:, xrefs: 007DD7A3
ALL, xrefs: 007DD7E7
LAST, xrefs: 007DD718
[HANDLE:, xrefs: 007DD75F
[LAST, xrefs: 007DD800
[ACTIVE, xrefs: 007DD740
ACTIVE, xrefs: 007DD72E
CLASSNAME=, xrefs: 007DD790

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 829f1fb613ec7937698e8f9d9a1343ccc3b0407c0c157243a289491768e70a39
Instruction ID: 50976baf20f1e70f0fbd5845e8d42f3d1f9b804c654539e62c0db62829b7235f
Opcode Fuzzy Hash: 829f1fb613ec7937698e8f9d9a1343ccc3b0407c0c157243a289491768e70a39
Instruction Fuzzy Hash: AF31A131A44205E6DB25FB50CD57FED73B4AF22721F20026AF851B12D2EF5DAE08D652

Function 007DEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 007DEAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 007DEAC2
SetWindowTextW.USER32(?,?), ref: 007DEAD9
GetDlgItem.USER32(?,000003EA), ref: 007DEAEE
SetWindowTextW.USER32(00000000,?), ref: 007DEAF4
GetDlgItem.USER32(?,000003E9), ref: 007DEB04
SetWindowTextW.USER32(00000000,?), ref: 007DEB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 007DEB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 007DEB45
GetWindowRect.USER32(?,?), ref: 007DEB4E
SetWindowTextW.USER32(?,?), ref: 007DEBB9
GetDesktopWindow.USER32 ref: 007DEBBF
GetWindowRect.USER32(00000000), ref: 007DEBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 007DEC12
GetClientRect.USER32(?,?), ref: 007DEC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 007DEC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 007DEC6F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 9c0298945452cef9a515fef3d72c8954ed12ef4acb7cd104e4cee41645bbb3d3
Instruction ID: 2f4cb07debf5fea67f24226cbd1232bf3da5fd169ae44502ad4ea2bde693fd91
Opcode Fuzzy Hash: 9c0298945452cef9a515fef3d72c8954ed12ef4acb7cd104e4cee41645bbb3d3
Instruction Fuzzy Hash: CE515D71900709EFDB21AFA8CD89E6EBBF5FF04705F00491AE586A66A0C774B945CB50

Function 007F79B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 007F79C6
LoadCursorW.USER32(00000000,00007F00), ref: 007F79D1
LoadCursorW.USER32(00000000,00007F03), ref: 007F79DC
LoadCursorW.USER32(00000000,00007F8B), ref: 007F79E7
LoadCursorW.USER32(00000000,00007F01), ref: 007F79F2
LoadCursorW.USER32(00000000,00007F81), ref: 007F79FD
LoadCursorW.USER32(00000000,00007F88), ref: 007F7A08
LoadCursorW.USER32(00000000,00007F80), ref: 007F7A13
LoadCursorW.USER32(00000000,00007F86), ref: 007F7A1E
LoadCursorW.USER32(00000000,00007F83), ref: 007F7A29
LoadCursorW.USER32(00000000,00007F85), ref: 007F7A34
LoadCursorW.USER32(00000000,00007F82), ref: 007F7A3F
LoadCursorW.USER32(00000000,00007F84), ref: 007F7A4A
LoadCursorW.USER32(00000000,00007F04), ref: 007F7A55
LoadCursorW.USER32(00000000,00007F02), ref: 007F7A60
LoadCursorW.USER32(00000000,00007F89), ref: 007F7A6B
GetCursorInfo.USER32(?), ref: 007F7A7B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 4abe614890acefb4fdd8fe83e2db8ce485d93b3b4738bdc99651ef8a99fddc6f
Instruction ID: 21683698ca228b78cec6e88bbee4bfd6071209a6cd0b8f06098f0c6a7c15a225
Opcode Fuzzy Hash: 4abe614890acefb4fdd8fe83e2db8ce485d93b3b4738bdc99651ef8a99fddc6f
Instruction Fuzzy Hash: EF3119B0D0831DAADB509FBA8C8996FBFE8FF04750F504526A50DE7280DA7CA501CFA1

Function 007AC833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 007BE968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,007AC8B7,?,00002000,?,?,00000000,?,007A419E,?,?,?,0083DC00), ref: 007BE984

Part of subcall function 007A660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007A53B1,?,?,007A61FF,?,00000000,00000001,00000000), ref: 007A662F

__wsplitpath.LIBCMT ref: 007AC93E

Part of subcall function 007C1DFC: __wsplitpath_helper.LIBCMT ref: 007C1E3C

_wcscpy.LIBCMT ref: 007AC953
_wcscat.LIBCMT ref: 007AC968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 007AC978
SetCurrentDirectoryW.KERNEL32(?), ref: 007ACABE

Part of subcall function 007AB337: _wcscpy.LIBCMT ref: 007AB36F

Strings

Bad directive syntax error, xrefs: 00813429
EA06, xrefs: 008130C9
Error opening the file, xrefs: 008130B4, 0081313D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00813098
AU3!, xrefs: 007AC90C
Unterminated string, xrefs: 00813470
>>>AUTOIT SCRIPT<<<, xrefs: 0081311B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: f4bac84beafa072b12729fd136b418514a2d78e5937f939000baea2233751bef
Instruction ID: 01e20a8645422314514f11fe73189fdff43dd36ee961d36c7bb1c18cb91a825a
Opcode Fuzzy Hash: f4bac84beafa072b12729fd136b418514a2d78e5937f939000baea2233751bef
Instruction Fuzzy Hash: F9126A71508341EFC725EF24C845AAEBBE9BFD9304F004A1DF58993251DB39DA49CB52

Function 0080CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0080CEFB
DestroyWindow.USER32(?,?), ref: 0080CF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0080CFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0080D016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0080D025
DestroyWindow.USER32(?), ref: 0080D042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,007A0000,00000000), ref: 0080D075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0080D094
GetDesktopWindow.USER32 ref: 0080D0A9
GetWindowRect.USER32(00000000), ref: 0080D0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0080D0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0080D0DA

Part of subcall function 007BB526: GetWindowLongW.USER32(?,000000EB), ref: 007BB537

Strings

0, xrefs: 0080CF1B
tooltips_class32, xrefs: 0080CFED, 0080D06E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: 95e0532833ea25a845dbae41e2cc63076ab9cc6c8a367086a708e316f902e8c8
Instruction ID: a6fdb27e9580996c8367f2ad3193a74c0cf4d1cdf1b2bc90f826cfddffccc6d3
Opcode Fuzzy Hash: 95e0532833ea25a845dbae41e2cc63076ab9cc6c8a367086a708e316f902e8c8
Instruction Fuzzy Hash: 6B71AAB5140305AFEB60CF68CC89F663BE5FB89704F088519F989872A1D774E842CB62

Function 0080F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

DragQueryPoint.SHELL32(?,?), ref: 0080F37A

Part of subcall function 0080D7DE: ClientToScreen.USER32(?,?), ref: 0080D807
Part of subcall function 0080D7DE: GetWindowRect.USER32(?,?), ref: 0080D87D
Part of subcall function 0080D7DE: PtInRect.USER32(?,?,0080ED5A), ref: 0080D88D

SendMessageW.USER32(?,000000B0,?,?), ref: 0080F3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0080F3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0080F411
_wcscat.LIBCMT ref: 0080F441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0080F458
SendMessageW.USER32(?,000000B0,?,?), ref: 0080F471
SendMessageW.USER32(?,000000B1,?,?), ref: 0080F488
SendMessageW.USER32(?,000000B1,?,?), ref: 0080F4AA
DragFinish.SHELL32(?), ref: 0080F4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0080F59C

Strings

@GUI_DROPID, xrefs: 0080F4D1
@GUI_DRAGID, xrefs: 0080F510
@GUI_DRAGFILE, xrefs: 0080F54B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 4ba9a48462e08d2b90cbfac7fb2011bb1915dddb81fff65e67ebd150b6688f9f
Instruction ID: 09f47ca3e1ba258e01b575b8f3935181411cf0e24458852a895e1e87dcc82436
Opcode Fuzzy Hash: 4ba9a48462e08d2b90cbfac7fb2011bb1915dddb81fff65e67ebd150b6688f9f
Instruction Fuzzy Hash: 01615A71108300AFD711EF64CC89E9BBBF8FF99710F004A1EF695961A1DB749A09CB52

Function 007EAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 007EAB3D
VariantCopy.OLEAUT32(?,?), ref: 007EAB46
VariantClear.OLEAUT32(?), ref: 007EAB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007EAC40
__swprintf.LIBCMT ref: 007EAC70
VarR8FromDec.OLEAUT32(?,?), ref: 007EAC9C
VariantInit.OLEAUT32(?), ref: 007EAD4D
SysFreeString.OLEAUT32(00000016), ref: 007EADDF
VariantClear.OLEAUT32(?), ref: 007EAE35
VariantClear.OLEAUT32(?), ref: 007EAE44
VariantInit.OLEAUT32(00000000), ref: 007EAE80

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 007EAC6A
Default, xrefs: 007EACFD

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: e18924ff514cc40870925b150ce1021106de4f5e2bb3852a60ac1ee58c3cc15e
Instruction ID: de2512cb43d6af7f9e9c60ac9230be7c2c4653f8e9d5777e8482e894d6c22636
Opcode Fuzzy Hash: e18924ff514cc40870925b150ce1021106de4f5e2bb3852a60ac1ee58c3cc15e
Instruction Fuzzy Hash: EAD1F1B1601295FBCB249F66C889BAABBB5FF4C700F248055E4059B181DB7CFC40DBA2

Function 0080716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008071FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00807247

Strings

GETITEMCOUNT, xrefs: 00807311
EXPAND, xrefs: 008072E1
GETTEXT, xrefs: 00807382
CHECK, xrefs: 00807267
UNCHECK, xrefs: 0080740B
ISCHECKED, xrefs: 008073B2
GETTOTALCOUNT, xrefs: 0080722A
COLLAPSE, xrefs: 0080728D
SELECT, xrefs: 008073E0
GETSELECTED, xrefs: 0080733F
EXISTS, xrefs: 008072B0

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 382ccc9c574215a9c92aedeb32b7d79eaf3fc1453f7152a9efaaf844ae20ad39
Instruction ID: fc3e4de1abf60955f9d2664e6e4744d0eb2dbd6853c2d4cf762a3fde6c27ecba
Opcode Fuzzy Hash: 382ccc9c574215a9c92aedeb32b7d79eaf3fc1453f7152a9efaaf844ae20ad39
Instruction Fuzzy Hash: C5917C70608601DBCB05EF10C845AAEBBA1FF94304F004859B9969B3E2DB34FD4ADB92

Function 0080E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0080E5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00809808,?), ref: 0080E607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0080E647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0080E68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0080E6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,00809808,?), ref: 0080E6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0080E6DF
DestroyIcon.USER32(?), ref: 0080E6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0080E70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0080E717

Part of subcall function 007C0FA7: __wcsicmp_l.LIBCMT ref: 007C1030

Strings

.exe, xrefs: 0080E541
.icl, xrefs: 0080E521
.dll, xrefs: 0080E564

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: d92b30047aa234e5a6749b374794e89cb2efabce753eebba092f38f9356a5424
Instruction ID: 06fe0a9fcbb8260355066b045f6d557adbdb7cd66aacc956668c92e6dda07ba4
Opcode Fuzzy Hash: d92b30047aa234e5a6749b374794e89cb2efabce753eebba092f38f9356a5424
Instruction Fuzzy Hash: 6A61D071500215FAEB20DF64DC46FBF7BA8FB18725F104A09F921D61D1EB759980CBA0

Function 007ED219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

CharLowerBuffW.USER32(?,?), ref: 007ED292
GetDriveTypeW.KERNEL32 ref: 007ED2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007ED327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007ED35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007ED38C

Strings

open, xrefs: 007ED2B9
type cdaudio alias cd wait, xrefs: 007ED30A
open , xrefs: 007ED2EE
closed, xrefs: 007ED2A6, 007ED2AF
set cd door , xrefs: 007ED32D
close cd wait, xrefs: 007ED377
wait, xrefs: 007ED349
close, xrefs: 007ED298

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: b6887ee7940fcb8c52129d9433d376d609c0717bfffd5083e776ec9335cd6d9e
Instruction ID: cdb222ee12232aedf085e96404cc1c5a30b28866691eb9d0ef3b00721c8542d9
Opcode Fuzzy Hash: b6887ee7940fcb8c52129d9433d376d609c0717bfffd5083e776ec9335cd6d9e
Instruction Fuzzy Hash: 26515871104304EFC700EF20C88596EB7E8FF89758F00896DF895A7251DB39AE0ACB92

Function 007E26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00813973,00000016,0000138C,00000016,?,00000016,0083DDB4,00000000,?), ref: 007E26F1
LoadStringW.USER32(00000000,?,00813973,00000016), ref: 007E26FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00813973,00000016,0000138C,00000016,?,00000016,0083DDB4,00000000,?,00000016), ref: 007E271C
LoadStringW.USER32(00000000,?,00813973,00000016), ref: 007E271F
__swprintf.LIBCMT ref: 007E276F
__swprintf.LIBCMT ref: 007E2780
_wprintf.LIBCMT ref: 007E2829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007E2840

Strings

Line %d:, xrefs: 007E277A
%s (%d) : ==> %s: %s %s, xrefs: 007E2824
^ ERROR, xrefs: 007E27D5
Line %d (File "%s"):, xrefs: 007E2769
Error: , xrefs: 007E27F7

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: 8961d9b37c758d9439424b0b5b4cd09cbb02c676cdd1acebd767847e4ec9d443
Instruction ID: c0c1f0b31aa6b4762cabee37aac1e3dd9b1d27f3f102c3032910d5daf010e1f1
Opcode Fuzzy Hash: 8961d9b37c758d9439424b0b5b4cd09cbb02c676cdd1acebd767847e4ec9d443
Instruction Fuzzy Hash: 20416272800208FACB15FBD0DD8AEEEB77CEF59341F100165B501B2192EA796F1ACB61

Function 007ED0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007ED0D8
__swprintf.LIBCMT ref: 007ED0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 007ED137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 007ED15C
_memset.LIBCMT ref: 007ED17B
_wcsncpy.LIBCMT ref: 007ED1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 007ED1EC
CloseHandle.KERNEL32(00000000), ref: 007ED1F7
RemoveDirectoryW.KERNEL32(?), ref: 007ED200
CloseHandle.KERNEL32(00000000), ref: 007ED20A

Strings

:, xrefs: 007ED11B
\, xrefs: 007ED110
\??\%s, xrefs: 007ED0F4

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 13c13649bc78daffd1043f8f5d6aaa1b3e21b78f7f599c1f9c398c4b8de2ff62
Instruction ID: 50d50ee2f9bc358c6924bc640679b1697ef223d5c5dd761c4aa2472d4a4dc948
Opcode Fuzzy Hash: 13c13649bc78daffd1043f8f5d6aaa1b3e21b78f7f599c1f9c398c4b8de2ff62
Instruction Fuzzy Hash: EF318EB2500249ABDB31DFA1CC49FEB77BCFF89741F1080AAF609D2161E7749A458B24

Function 007D87CD Relevance: 22.7, APIs: 15, Instructions: 210COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 007D882D
___wtomb_environ.LIBCMT ref: 007D884F

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

__malloc_crt.LIBCMT ref: 007D8875
__malloc_crt.LIBCMT ref: 007D8892
_free.LIBCMT ref: 007D88C9
__recalloc_crt.LIBCMT ref: 007D8902
__recalloc_crt.LIBCMT ref: 007D8947
_strlen.LIBCMT ref: 007D8973
__calloc_crt.LIBCMT ref: 007D897D
_strlen.LIBCMT ref: 007D898C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 007D89BA
_free.LIBCMT ref: 007D89D4
_free.LIBCMT ref: 007D89E1
_free.LIBCMT ref: 007D89F3
__invoke_watson.LIBCMT ref: 007D8A0D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 17830dc19005c8edc7393d9aee150b3d44c6ec83a3e7a9a815e50b24b5e5c531
Instruction ID: 7135d0cec0d72475d1c37c3b6f813cbe97d1abe2a9b4820b1538ac8d77626116
Opcode Fuzzy Hash: 17830dc19005c8edc7393d9aee150b3d44c6ec83a3e7a9a815e50b24b5e5c531
Instruction Fuzzy Hash: F561D172900211EFDB615F64DC4AB6A37B8AF01721F61412FE841AB281EF7CD941DBA6

Function 0080E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 0080E754
GetFileSize.KERNEL32(00000000,00000000), ref: 0080E76B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 0080E776
CloseHandle.KERNEL32(00000000), ref: 0080E783
GlobalLock.KERNEL32(00000000), ref: 0080E78C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0080E79B
GlobalUnlock.KERNEL32(00000000), ref: 0080E7A4
CloseHandle.KERNEL32(00000000), ref: 0080E7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0080E7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,0082D9BC,?), ref: 0080E7D5
GlobalFree.KERNEL32(00000000), ref: 0080E7E5
GetObjectW.GDI32(?,00000018,000000FF), ref: 0080E809
CopyImage.USER32(?,00000000,?,?,00002000), ref: 0080E834
DeleteObject.GDI32(00000000), ref: 0080E85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0080E872

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 38c6c1ce6a2d80d70020f316ceac5bc12796ea880a9eb49afe779ab468030187
Instruction ID: ee2be52fbbfdf6791dab1692f15802eb2014f84490e3cc5ad6bbc429e72c6883
Opcode Fuzzy Hash: 38c6c1ce6a2d80d70020f316ceac5bc12796ea880a9eb49afe779ab468030187
Instruction Fuzzy Hash: 10412975600308EFDB219F65DC88EAB7BB8FF89715F108468F905D72A0D770A942DB60

Function 007F05F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 007F076F
_wcscat.LIBCMT ref: 007F0787
_wcscat.LIBCMT ref: 007F0799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007F07AE
SetCurrentDirectoryW.KERNEL32(?), ref: 007F07C2
GetFileAttributesW.KERNEL32(?), ref: 007F07DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 007F07F4
SetCurrentDirectoryW.KERNEL32(?), ref: 007F0806

Strings

*.*, xrefs: 007F0845

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: ff737ff737d712b1bf8918fde9bbe9d6ef08ecbce0baa11a07bd47132fddccdc
Instruction ID: 1dea207d9fd89774e554ef8f2b11394b1730ba743596a00f9cb2fb32368d2dcc
Opcode Fuzzy Hash: ff737ff737d712b1bf8918fde9bbe9d6ef08ecbce0baa11a07bd47132fddccdc
Instruction Fuzzy Hash: 92818F71504309DFCB24EF24C8459BAB7E8BBC8354F14882EFA85C7352E638E9558BD2

Function 0080EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0080EF3B
GetFocus.USER32 ref: 0080EF4B
GetDlgCtrlID.USER32(00000000), ref: 0080EF56
_memset.LIBCMT ref: 0080F081
GetMenuItemInfoW.USER32 ref: 0080F0AC
GetMenuItemCount.USER32(00000000), ref: 0080F0CC
GetMenuItemID.USER32(?,00000000), ref: 0080F0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0080F113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0080F15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0080F193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0080F1C8

Strings

0, xrefs: 0080F079

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 9e63eabbf9e55efcfe78078c431e9cf2443073a95f97aece77b4991e4b044856
Instruction ID: 630c3abf0274f8930642aea9eae2f59a2a3764099c05f84600e1474604ba366b
Opcode Fuzzy Hash: 9e63eabbf9e55efcfe78078c431e9cf2443073a95f97aece77b4991e4b044856
Instruction Fuzzy Hash: 08814971608306AFDB61CF14CC84A6BBBE9FB88314F14892DFA95D7292D770D905CB92

Function 007DA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007DABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 007DABD7
Part of subcall function 007DABBB: GetLastError.KERNEL32(?,007DA69F,?,?,?), ref: 007DABE1
Part of subcall function 007DABBB: GetProcessHeap.KERNEL32(00000008,?,?,007DA69F,?,?,?), ref: 007DABF0
Part of subcall function 007DABBB: HeapAlloc.KERNEL32(00000000,?,007DA69F,?,?,?), ref: 007DABF7
Part of subcall function 007DABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 007DAC0E

Part of subcall function 007DAC56: GetProcessHeap.KERNEL32(00000008,007DA6B5,00000000,00000000,?,007DA6B5,?), ref: 007DAC62
Part of subcall function 007DAC56: HeapAlloc.KERNEL32(00000000,?,007DA6B5,?), ref: 007DAC69
Part of subcall function 007DAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,007DA6B5,?), ref: 007DAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007DA8CB
_memset.LIBCMT ref: 007DA8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007DA8FF
GetLengthSid.ADVAPI32(?), ref: 007DA910
GetAce.ADVAPI32(?,00000000,?), ref: 007DA94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007DA969
GetLengthSid.ADVAPI32(?), ref: 007DA986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 007DA995
HeapAlloc.KERNEL32(00000000), ref: 007DA99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 007DA9BD
CopySid.ADVAPI32(00000000), ref: 007DA9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007DA9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007DAA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 007DAA2F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 91953ef4546cb75663742aa74c9fba1e7c030e6b21402503d55d44c560b3bcb4
Instruction ID: e25da45e37da6aeac56b1e7799b6a0ce1f6afee2a55ad76b0a51ec10895aab1a
Opcode Fuzzy Hash: 91953ef4546cb75663742aa74c9fba1e7c030e6b21402503d55d44c560b3bcb4
Instruction Fuzzy Hash: 15512AB1900209BBDF10DFA4DD45AEEBBB9FF44300F14C11AE915AA290DB399A06CB61

Function 007F9DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007F9E36
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 007F9E42
CreateCompatibleDC.GDI32(?), ref: 007F9E4E
SelectObject.GDI32(00000000,?), ref: 007F9E5B
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 007F9EAF
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 007F9EEB
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 007F9F0F
SelectObject.GDI32(00000006,?), ref: 007F9F17
DeleteObject.GDI32(?), ref: 007F9F20
DeleteDC.GDI32(00000006), ref: 007F9F27
ReleaseDC.USER32(00000000,?), ref: 007F9F32

Strings

(, xrefs: 007F9ED7

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 28d638f151e57fbd198533bedb3c1226eb58b9a4d6c3810c9ab52d256a3594d9
Instruction ID: 514187f633d6a6b5c7583ea8cc012f157061444d5fc78cfc2f33d2f1d564f896
Opcode Fuzzy Hash: 28d638f151e57fbd198533bedb3c1226eb58b9a4d6c3810c9ab52d256a3594d9
Instruction Fuzzy Hash: C8511876904309EFCB25CFA8C885EAEBBB9FF48710F14841DFA59A7350D635A9418B90

Function 007ECC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 007ECCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 007ECCC5
__swprintf.LIBCMT ref: 007ECD1E
__swprintf.LIBCMT ref: 007ECD37
_wprintf.LIBCMT ref: 007ECDED
_wprintf.LIBCMT ref: 007ECE0B

Strings

^ ERROR, xrefs: 007ECD8F
"%s" (%d) : ==> %s:, xrefs: 007ECE06
"%s" (%d) : ==> %s:%s%s, xrefs: 007ECDE8
Line %d (File "%s"):, xrefs: 007ECD18, 007ECD31
Error: , xrefs: 007ECDB5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: ac6774114bd0324d2a8e06978efc9868bcf60b6acb2e3b717cc95b4eed8f7fe5
Instruction ID: ddd7ff4f4581f4713855fc581eefe6738d938c05cff81edd9f9e9e74eea55a9c
Opcode Fuzzy Hash: ac6774114bd0324d2a8e06978efc9868bcf60b6acb2e3b717cc95b4eed8f7fe5
Instruction Fuzzy Hash: DE51AF72900549FACF16EBA0CD4AEEEB778EF09340F100165F40572162EB796F5ADB61

Function 007ECA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 007ECA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007ECAB0
__swprintf.LIBCMT ref: 007ECB09
__swprintf.LIBCMT ref: 007ECB22
_wprintf.LIBCMT ref: 007ECBCD
_wprintf.LIBCMT ref: 007ECBEB

Strings

"%s" (%d) : ==> %s:, xrefs: 007ECBE6
"%s" (%d) : ==> %s:%s%s, xrefs: 007ECBC8
^ ERROR , xrefs: 007ECB64
Line %d (File "%s"):, xrefs: 007ECB03, 007ECB1C
Error: , xrefs: 007ECB95

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: d567e78b7bb572c497b0cedbf47217eb27251547037bee67fc0d60ca71cc6602
Instruction ID: de99f0935f0c991457d7e675a0c86d3894621b351bf916c04024482efabc45fc
Opcode Fuzzy Hash: d567e78b7bb572c497b0cedbf47217eb27251547037bee67fc0d60ca71cc6602
Instruction Fuzzy Hash: E051CD72900249FACF16EBA0CD4AEEEB778AF09340F100165F50572162EA796F5ADB61

Function 007E55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E55D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 007E5664
GetMenuItemCount.USER32(00861708), ref: 007E56ED
DeleteMenu.USER32(00861708,00000005,00000000,000000F5,?,?), ref: 007E577D
DeleteMenu.USER32(00861708,00000004,00000000), ref: 007E5785
DeleteMenu.USER32(00861708,00000006,00000000), ref: 007E578D
DeleteMenu.USER32(00861708,00000003,00000000), ref: 007E5795
GetMenuItemCount.USER32(00861708), ref: 007E579D
SetMenuItemInfoW.USER32(00861708,00000004,00000000,00000030), ref: 007E57D3
GetCursorPos.USER32(?), ref: 007E57DD
SetForegroundWindow.USER32(00000000), ref: 007E57E6
TrackPopupMenuEx.USER32(00861708,00000000,?,00000000,00000000,00000000), ref: 007E57F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007E5805

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 134ffc1ff2037ca2b935cecb2800b70b7c814de59e27ffa49dfb53a4dee13559
Instruction ID: 3eee4be6282a8ee04e97e4e1d58cc64da78b0e10c0c58702505c07a4eb7187db
Opcode Fuzzy Hash: 134ffc1ff2037ca2b935cecb2800b70b7c814de59e27ffa49dfb53a4dee13559
Instruction Fuzzy Hash: 50710470642A89BFEB209F16CC49FAABF65FF4876CF244215F5146A1D1C7B85C10DB90

Function 007DA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DA1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007DA211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007DA22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007DA249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 007DA273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 007DA29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 007DA2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 007DA2AB

Strings

\IPC$, xrefs: 007DA1F3
SOFTWARE\Classes\, xrefs: 007DA17D
\CLSID, xrefs: 007DA193

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: 2c9f28188624926443d73a43a67798e032c48ff721b1feb25ebd6c0d2190595a
Instruction ID: 8b62bd300a87326ca6a64c60916e96a2910eac715caf914b62eeba4a63486bd6
Opcode Fuzzy Hash: 2c9f28188624926443d73a43a67798e032c48ff721b1feb25ebd6c0d2190595a
Instruction Fuzzy Hash: AF410876C10229EBCF25EBA4DC89DEDB778FF49310F04412AE801A3261EB399E05CB51

Function 00803C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00802BB5,?,?), ref: 00803C1D

Strings

HKCR, xrefs: 00803CAB
HKEY_CURRENT_USER, xrefs: 00803CE2
HKEY_CLASSES_ROOT, xrefs: 00803C96
HKEY_USERS, xrefs: 00803D04
HKLM, xrefs: 00803C81
HKCU, xrefs: 00803CF3
HKCC, xrefs: 00803CD1
HKU, xrefs: 00803D15
HKEY_CURRENT_CONFIG, xrefs: 00803CC0
HKEY_LOCAL_MACHINE, xrefs: 00803C6C

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 22e0bed1664a39b5130de5833dae475a0ec4f20acb3be822f813e9860ebb3381
Instruction ID: e9cf0fa79299e865a6765c1774f8705e6cb8be4920a68ddc51336b3e9ab95db1
Opcode Fuzzy Hash: 22e0bed1664a39b5130de5833dae475a0ec4f20acb3be822f813e9860ebb3381
Instruction Fuzzy Hash: 8D415B7010024A8BDF40EF50DC55AEA3769FF62344F505854EC96AB2A2EB74AA4EDB60

Function 007E25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,008136F4,00000010,?,Bad directive syntax error,0083DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 007E25D6
LoadStringW.USER32(00000000,?,008136F4,00000010), ref: 007E25DD
_wprintf.LIBCMT ref: 007E2610
__swprintf.LIBCMT ref: 007E2632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 007E26A1

Strings

Line %d:, xrefs: 007E262C
%s (%d) : ==> %s.: %s %s, xrefs: 007E260B
Error: , xrefs: 007E266F
., xrefs: 007E2687
Line %d (File "%s"):, xrefs: 007E2647

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: f97343ad141db4e46eb31e31e98f17c63bf9f271a33b5af9a06dea4d731b5164
Instruction ID: a42ea4b65beb4ee9a2203d5efaf176218c1fca031ae558c3a98bfb6c370fa879
Opcode Fuzzy Hash: f97343ad141db4e46eb31e31e98f17c63bf9f271a33b5af9a06dea4d731b5164
Instruction Fuzzy Hash: 2B217E3280021EFFCF12AB90CC0AEEE7B39FF19345F004569F515621A3DA79A629DB51

Function 007E7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 007E7B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 007E7B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007E7B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 007E7B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 007E7B8C

Strings

open , xrefs: 007E7AF1
status PlayMe mode, xrefs: 007E7B3D
play PlayMe, xrefs: 007E7B87
play PlayMe wait, xrefs: 007E7B76
alias PlayMe, xrefs: 007E7B1B
close PlayMe, xrefs: 007E7B53, 007E7B80

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 8076ef96c122ef87904a275cc64c708e5e2fc6d1eddee2db32a5533345f08011
Instruction ID: bbf20e466792b511039db4996559eec0873800d115523e94d95f9bb80821c655
Opcode Fuzzy Hash: 8076ef96c122ef87904a275cc64c708e5e2fc6d1eddee2db32a5533345f08011
Instruction Fuzzy Hash: 7311C8E1940259B9D724B362CC4ADFF7A7CFBDAB40F000529B821E61C1EE680A49C6B0

Function 007E778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 007E7794

Part of subcall function 007BDC38: timeGetTime.WINMM(?,75C0B400,008158AB), ref: 007BDC3C

Sleep.KERNEL32(0000000A), ref: 007E77C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 007E77E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 007E7806
SetActiveWindow.USER32 ref: 007E7825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 007E7833
SendMessageW.USER32(00000010,00000000,00000000), ref: 007E7852
Sleep.KERNEL32(000000FA), ref: 007E785D
IsWindow.USER32 ref: 007E7869
EndDialog.USER32(00000000), ref: 007E787A

Strings

BUTTON, xrefs: 007E77F8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 50c57f3da8663610f9bb6a02bc2f85f20cbf4b84c4b45782c33a8194526812d0
Instruction ID: ab2c044e2d56f3b9d12bf94c2f615cbf5a9f8b96c48f42b4c9b4bdebc1625a96
Opcode Fuzzy Hash: 50c57f3da8663610f9bb6a02bc2f85f20cbf4b84c4b45782c33a8194526812d0
Instruction Fuzzy Hash: 3F21AEB1205345AFE3185F61FD8DB263F29FB18349F119028F50686362DBB98D02CB60

Function 007F02EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

CoInitialize.OLE32(00000000), ref: 007F034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007F03DE
SHGetDesktopFolder.SHELL32(?), ref: 007F03F2
CoCreateInstance.OLE32(0082DA8C,00000000,00000001,00853CF8,?), ref: 007F043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007F04AD
CoTaskMemFree.OLE32(?,?), ref: 007F0505
_memset.LIBCMT ref: 007F0542
SHBrowseForFolderW.SHELL32(?), ref: 007F057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007F05A1
CoTaskMemFree.OLE32(00000000), ref: 007F05A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 007F05DF
CoUninitialize.OLE32(00000001,00000000), ref: 007F05E1

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: dbad38070f407f0d8635131e93066766b80776d4189bbabca499c7a72c419979
Instruction ID: d663f0072e5746cc3c83b67ecf8110457ee99c3f25a67e5b5d92d9439d81f2e5
Opcode Fuzzy Hash: dbad38070f407f0d8635131e93066766b80776d4189bbabca499c7a72c419979
Instruction Fuzzy Hash: 78B1D975A00218EFDB14DFA4C888DAEBBB9FF89314B148469E906EB351D774ED41CB50

Function 007E2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007E2ED6
SetKeyboardState.USER32(?), ref: 007E2F41
GetAsyncKeyState.USER32(000000A0), ref: 007E2F61
GetKeyState.USER32(000000A0), ref: 007E2F78
GetAsyncKeyState.USER32(000000A1), ref: 007E2FA7
GetKeyState.USER32(000000A1), ref: 007E2FB8
GetAsyncKeyState.USER32(00000011), ref: 007E2FE4
GetKeyState.USER32(00000011), ref: 007E2FF2
GetAsyncKeyState.USER32(00000012), ref: 007E301B
GetKeyState.USER32(00000012), ref: 007E3029
GetAsyncKeyState.USER32(0000005B), ref: 007E3052
GetKeyState.USER32(0000005B), ref: 007E3060

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: a39a5a56bfc51080257089b7420c8cdc409182355f3f3695c40eb618507cf122
Instruction ID: 1897e68a4854a4ccdcb229d222c44ac8cb7182e7fa464ea6b11564228bfeb07f
Opcode Fuzzy Hash: a39a5a56bfc51080257089b7420c8cdc409182355f3f3695c40eb618507cf122
Instruction Fuzzy Hash: 7B51292050A7D829FB35DBA188097EABFF85F09340F08859DD5C25B1C3DA9C9B8DC761

Function 007DED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 007DED1E
GetWindowRect.USER32(00000000,?), ref: 007DED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 007DED8E
GetDlgItem.USER32(?,00000002), ref: 007DED99
GetWindowRect.USER32(00000000,?), ref: 007DEDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 007DEE01
GetDlgItem.USER32(?,000003E9), ref: 007DEE0F
GetWindowRect.USER32(00000000,?), ref: 007DEE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 007DEE63
GetDlgItem.USER32(?,000003EA), ref: 007DEE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 007DEE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 007DEE9B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 554e056b42671fe01720945dcebeed0dcb43e14503295787d736da07ebffa67e
Instruction ID: d9fc6bc6e889d824397e432813e81125fe645a69f422b360ac577fd80893e5ed
Opcode Fuzzy Hash: 554e056b42671fe01720945dcebeed0dcb43e14503295787d736da07ebffa67e
Instruction Fuzzy Hash: 1B512CB1B00305AFDF18DF68CD89AAEBBBAFB98701F148129F519D7290DB749D018B50

Function 007BB73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007BB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007BB759,?,00000000,?,?,?,?,007BB72B,00000000,?), ref: 007BBA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,007BB72B), ref: 007BB7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,007BB72B,00000000,?,?,007BB2EF,?,?), ref: 007BB88D
DestroyAcceleratorTable.USER32(00000000), ref: 0081D8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007BB72B,00000000,?,?,007BB2EF,?,?), ref: 0081D8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007BB72B,00000000,?,?,007BB2EF,?,?), ref: 0081D8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007BB72B,00000000,?,?,007BB2EF,?,?), ref: 0081D90A
DeleteObject.GDI32(00000000), ref: 0081D91C

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 80b6766c2fdfa0c6a540b9f3e2575cabff56bc0ff69625f996183e1c62f40831
Instruction ID: b8c67b24969eb56e5ce869a96330d08ec0a28726719ac04b4eced7799eaaa83b
Opcode Fuzzy Hash: 80b6766c2fdfa0c6a540b9f3e2575cabff56bc0ff69625f996183e1c62f40831
Instruction Fuzzy Hash: C3617E34500700DFDB359F18D98CBA5BBF9FFA4311F19552EE84686A71CBB8A881DB80

Function 007BB40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 007BB526: GetWindowLongW.USER32(?,000000EB), ref: 007BB537

GetSysColor.USER32(0000000F), ref: 007BB438

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 50ce7b35f6a67fd64eac611eb49e55c6ea77f0979e2eb6ae6a81cc1d66b19704
Instruction ID: f8cd1b457c2bb00ac29cdab89a40228042442dc9c6ee4be05f11b0eb836ddc06
Opcode Fuzzy Hash: 50ce7b35f6a67fd64eac611eb49e55c6ea77f0979e2eb6ae6a81cc1d66b19704
Instruction Fuzzy Hash: FC419031000280AFDB245F68DC89BF93B66FF06731F188261FD658A1E6D7B48C82D721

Function 007E690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 007E6923
_wcscpy.LIBCMT ref: 007E6934
__wsplitpath.LIBCMT ref: 007E6958
__wsplitpath.LIBCMT ref: 007E6979
_wcscpy.LIBCMT ref: 007E699B
_wcscpy.LIBCMT ref: 007E69B9
_wcscpy.LIBCMT ref: 007E69C7
_wcscat.LIBCMT ref: 007E69D6
_wcscat.LIBCMT ref: 007E6A2B
_wcscat.LIBCMT ref: 007E6A61
_wcscat.LIBCMT ref: 007E6A73

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: ddc5e967c87bf70c0bc36a2606fdec31717663c732afa5d89d5526c1da94635f
Instruction ID: 5e7e5259342088134b0a3fdb8679a47810921412a0d977803a7c2d3cbb310a2e
Opcode Fuzzy Hash: ddc5e967c87bf70c0bc36a2606fdec31717663c732afa5d89d5526c1da94635f
Instruction Fuzzy Hash: 9B412F7684611CEECF65DB90CC45DCE73BCEB48310F0041AAF659A2051EA38ABE58F94

Function 007ED76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(0083DC00,0083DC00,0083DC00), ref: 007ED7CE
GetDriveTypeW.KERNEL32(?,00853A70,00000061), ref: 007ED898
_wcscpy.LIBCMT ref: 007ED8C2

Strings

fixed, xrefs: 007ED816
ramdisk, xrefs: 007ED842
network, xrefs: 007ED82C
unknown, xrefs: 007ED859
all, xrefs: 007ED7D4
removable, xrefs: 007ED800
cdrom, xrefs: 007ED7EA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: c134a081f297db5c592792a02e6c558c56719b9a6d10d70d38873fff769a0465
Instruction ID: d5722a1f5e2027d4e2cade41d9fc2f40b92157be5cad780916d19d31bd962e2b
Opcode Fuzzy Hash: c134a081f297db5c592792a02e6c558c56719b9a6d10d70d38873fff769a0465
Instruction Fuzzy Hash: 0551E331105340EFC710EF15C885BAEB7A5FF88314F10892DF99A972A2DB39ED09CA52

Function 007A936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007A93AB
__itow.LIBCMT ref: 007A93DF

Part of subcall function 007C1557: _xtow@16.LIBCMT ref: 007C1578

Strings

True, xrefs: 00814C8C
0x%p, xrefs: 00814CAD
False, xrefs: 00814C93
%.15g, xrefs: 007A93A5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: fbc542688ccd2dda7934466a3bc13e301f0997509c0270c28b14509805e3adc5
Instruction ID: 3c9f80a8faf06c54087347ac57849ae8542d2268e0664d07894c28d00bb99783
Opcode Fuzzy Hash: fbc542688ccd2dda7934466a3bc13e301f0997509c0270c28b14509805e3adc5
Instruction Fuzzy Hash: 1641D671504205EFDB28DB78D945FAAB3F8FF85300F2045AEE54AD7281EA399951CB50

Function 0080A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0080A259
CreateCompatibleDC.GDI32(00000000), ref: 0080A260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0080A273
SelectObject.GDI32(00000000,00000000), ref: 0080A27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 0080A286
DeleteDC.GDI32(00000000), ref: 0080A28F
GetWindowLongW.USER32(?,000000EC), ref: 0080A299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 0080A2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0080A2B9

Strings

static, xrefs: 0080A1F1

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: a93bde9cccca9666eff738ae90cb1e0b535d3d35e57993eeaf4e9d77b3fba5c7
Instruction ID: c9d8e83bfa90d1dd46d8638d7abfb133aedf8f7d071193066987eee025e18aea
Opcode Fuzzy Hash: a93bde9cccca9666eff738ae90cb1e0b535d3d35e57993eeaf4e9d77b3fba5c7
Instruction Fuzzy Hash: DD315831100219ABDF259FA4DC49FEA3F69FF19360F114224FA19E61E0C736D822DBA5

Function 007E6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007E6F1D
gethostname.WSOCK32(?,00000100), ref: 007E6F37
gethostbyname.WSOCK32(?), ref: 007E6F44
_wcscpy.LIBCMT ref: 007E6F6C
inet_ntoa.WSOCK32(?), ref: 007E6F8A
_strcat.LIBCMT ref: 007E6F98
_wcscpy.LIBCMT ref: 007E6FAF
WSACleanup.WSOCK32 ref: 007E6FBD
_wcscpy.LIBCMT ref: 007E6FCB

Strings

0.0.0.0, xrefs: 007E6F66

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: 7b21b59ea6d28b929c13ceb9222ad720ea7fe816a338ebc2d4018566121b1138
Instruction ID: 30288f8e82ad3de0ea74a0fcf5cf9eead059a8f004f6992b7b463be0803f24f8
Opcode Fuzzy Hash: 7b21b59ea6d28b929c13ceb9222ad720ea7fe816a338ebc2d4018566121b1138
Instruction Fuzzy Hash: 28110671904218EFCB24AB71AC0EFDA7BACEF54711F1040A9F505A6091EF7CDE868B90

Function 007C500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C5047

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

__gmtime64_s.LIBCMT ref: 007C50E0
__gmtime64_s.LIBCMT ref: 007C5116
__gmtime64_s.LIBCMT ref: 007C5133
__allrem.LIBCMT ref: 007C5189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C51A5
__allrem.LIBCMT ref: 007C51BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C51DA
__allrem.LIBCMT ref: 007C51F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007C520F
__invoke_watson.LIBCMT ref: 007C5280

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 707d82377d58409e21037510aab091e340e08e3a61982c9cdf79558cd2255c40
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: 5871B4B2A01F16ABD7149E78CC46F6A73A8BF10764F14422EE914D6281E779F9808BD0

Function 007E4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E4DF8
GetMenuItemInfoW.USER32(00861708,000000FF,00000000,00000030), ref: 007E4E59
SetMenuItemInfoW.USER32(00861708,00000004,00000000,00000030), ref: 007E4E8F
Sleep.KERNEL32(000001F4), ref: 007E4EA1
GetMenuItemCount.USER32(?), ref: 007E4EE5
GetMenuItemID.USER32(?,00000000), ref: 007E4F01
GetMenuItemID.USER32(?,-00000001), ref: 007E4F2B
GetMenuItemID.USER32(?,?), ref: 007E4F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007E4FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007E4FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007E4FEB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 890a22a7300f9e03772f77dfa7aa9745a59905dbc2cb2515084dc543caa54ca1
Instruction ID: 8d5f0f386a9b323366eaecbbd70cb5c0062ae5bcff5b7d53eeeea0b3545358f7
Opcode Fuzzy Hash: 890a22a7300f9e03772f77dfa7aa9745a59905dbc2cb2515084dc543caa54ca1
Instruction Fuzzy Hash: 5A61BFB1901289EFDF20CFA5DD88AAE7BB8FB49708F184059F801A7251D778AD15CB21

Function 00809C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00809C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00809C9B
GetWindowLongW.USER32(?,000000F0), ref: 00809CBF
_memset.LIBCMT ref: 00809CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00809CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00809D5A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: ce69439a41ae64925ea6662d00c06e88470e8b18689276d8e1631d0a89fb9e90
Instruction ID: d3ac36ba81fe264eed54985561cf4f55e60d72441f265543f6c306a90ea3e9d8
Opcode Fuzzy Hash: ce69439a41ae64925ea6662d00c06e88470e8b18689276d8e1631d0a89fb9e90
Instruction Fuzzy Hash: EA618A75900208AFDB20CFA8CC85EEE77B8FB09704F144159FA55E72A2D774AD42DB50

Function 007D94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 007D94FE
SafeArrayAllocData.OLEAUT32(?), ref: 007D9549
VariantInit.OLEAUT32(?), ref: 007D955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 007D957B
VariantCopy.OLEAUT32(?,?), ref: 007D95BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 007D95D2
VariantClear.OLEAUT32(?), ref: 007D95E7
SafeArrayDestroyData.OLEAUT32(?), ref: 007D95F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007D95FD
VariantClear.OLEAUT32(?), ref: 007D960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007D961A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 48a300c3bedb3d0a33b673feb6e923755e91735ebc14f49b3ea79ea24a60a5be
Instruction ID: 76ed17ecf70a3aeb0048ab822ab98c22ac2cf40017050ebdcdc967591affab6a
Opcode Fuzzy Hash: 48a300c3bedb3d0a33b673feb6e923755e91735ebc14f49b3ea79ea24a60a5be
Instruction Fuzzy Hash: D3413D31900219EFCB11EFA4D8489DEBF79FF08354F108066E502A7261DB34EA46CBA5

Function 007FADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

CoInitialize.OLE32 ref: 007FADF6
CoUninitialize.OLE32 ref: 007FAE01
CoCreateInstance.OLE32(?,00000000,00000017,0082D8FC,?), ref: 007FAE61
IIDFromString.OLE32(?,?), ref: 007FAED4
VariantInit.OLEAUT32(?), ref: 007FAF6E
VariantClear.OLEAUT32(?), ref: 007FAFCF

Strings

NULL Pointer assignment, xrefs: 007FAEA6
Invalid parameter, xrefs: 007FAEED
Failed to create object, xrefs: 007FAE6C, 007FAF22

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 9c07115d6fbb9dea962f1db02832dce2a4556797fb1a013b7cabcbcc151c788f
Instruction ID: f70c1c7378fa0ef5a7f39b9c53f1693cce888c2e7f0b70bf95e648bd82d23373
Opcode Fuzzy Hash: 9c07115d6fbb9dea962f1db02832dce2a4556797fb1a013b7cabcbcc151c788f
Instruction Fuzzy Hash: 0B61AAB1208315EFD710DF54C849B6ABBE8AF88714F104919FA899B391C778ED48CB93

Function 007F8107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007F8168
inet_addr.WSOCK32(?,?,?), ref: 007F81AD
gethostbyname.WSOCK32(?), ref: 007F81B9
IcmpCreateFile.IPHLPAPI ref: 007F81C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007F8237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007F824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 007F82C2
WSACleanup.WSOCK32 ref: 007F82C8

Strings

Ping, xrefs: 007F81EB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 9d94745dc17d5e9d88129e419e9609c5fd52172c09504dc2ab9a174c0f601d62
Instruction ID: 9aa2c41c8481223043f1c8ee7884791b27ec236bb2d5c050495f2706606b5216
Opcode Fuzzy Hash: 9d94745dc17d5e9d88129e419e9609c5fd52172c09504dc2ab9a174c0f601d62
Instruction Fuzzy Hash: D8519E316047049FDB619F24CC49B7ABBE4BF48310F048929FA56DB3A1DB78E901CB42

Function 007EE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007EE396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 007EE40C
GetLastError.KERNEL32 ref: 007EE416
SetErrorMode.KERNEL32(00000000,READY), ref: 007EE483

Strings

INVALID, xrefs: 007EE455
READY, xrefs: 007EE45C
READONLY, xrefs: 007EE44E
UNKNOWN, xrefs: 007EE43B
NOTREADY, xrefs: 007EE442

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 3ec548e3552cba93ecc8839e79975def0c8ecaee1cf1995621d49d3ff77b0b0e
Instruction ID: 42093a441f96a102cafc0b0755d3801760d4797fd87eaa027d6ce892173a58de
Opcode Fuzzy Hash: 3ec548e3552cba93ecc8839e79975def0c8ecaee1cf1995621d49d3ff77b0b0e
Instruction Fuzzy Hash: 16318135A00289EFDB11EB69C849AADBBB4FF4E340F148425F905EB2D1D678AE06C751

Function 007DB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 007DB98C
GetDlgCtrlID.USER32 ref: 007DB997
GetParent.USER32 ref: 007DB9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 007DB9B6
GetDlgCtrlID.USER32(?), ref: 007DB9BF
GetParent.USER32(?), ref: 007DB9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 007DB9DE

Strings

ListBox, xrefs: 007DB949
ComboBox, xrefs: 007DB911

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 6fe165a4b8aa8358de9a2e53fa0bc5cd3516fd46c8d9c57d11dc57500508cda2
Instruction ID: c69485d2b0942bc4c6d8de5f95a08b6b90d32d0a2a678e16d1113136438d3d06
Opcode Fuzzy Hash: 6fe165a4b8aa8358de9a2e53fa0bc5cd3516fd46c8d9c57d11dc57500508cda2
Instruction Fuzzy Hash: 4A21A4B4900204FFDB05ABA4CC95EBEBB75EB56300B104116F56197291DB7D5816DB60

Function 007DB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 007DBA73
GetDlgCtrlID.USER32 ref: 007DBA7E
GetParent.USER32 ref: 007DBA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 007DBA9D
GetDlgCtrlID.USER32(?), ref: 007DBAA6
GetParent.USER32(?), ref: 007DBAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 007DBAC5

Strings

ListBox, xrefs: 007DBA32
ComboBox, xrefs: 007DB9FA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: c157e230afefffec2608b29b8d5c3c325bce3c804b665c70f9a5829319a733ca
Instruction ID: e32b573883407319c4576e082a6d8c43c5904183bf0b635bd41256ff73ebe20d
Opcode Fuzzy Hash: c157e230afefffec2608b29b8d5c3c325bce3c804b665c70f9a5829319a733ca
Instruction Fuzzy Hash: 1921C1B4900204FBDB01ABA0CC85EBEBB75FF95300F108116F55197291DB7D581A9B60

Function 007DBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 007DBAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 007DBAF8
_wcscmp.LIBCMT ref: 007DBB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 007DBB85

Strings

SHELLDLL_DefView, xrefs: 007DBB04
largeicons, xrefs: 007DBB19
list, xrefs: 007DBB67
details, xrefs: 007DBB33
smallicons, xrefs: 007DBB4D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 8aa3618f66151a5287bb04a58c8bbf4d9828269344a05479f5ff2b84188951ae
Instruction ID: d3d25513ab8ad5bf85fbcf1bd0645f4dbc75504a52ed6a7e57531ab7e3ce3f88
Opcode Fuzzy Hash: 8aa3618f66151a5287bb04a58c8bbf4d9828269344a05479f5ff2b84188951ae
Instruction Fuzzy Hash: 56112CB6608313F9FA216634DC0BDA63BACEF21324B20002FFD14E42D5EF6D595145D4

Function 007FB2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007FB2D5
CoInitialize.OLE32(00000000), ref: 007FB302
CoUninitialize.OLE32 ref: 007FB30C
GetRunningObjectTable.OLE32(00000000,?), ref: 007FB40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 007FB539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 007FB56D
CoGetObject.OLE32(?,00000000,0082D91C,?), ref: 007FB590
SetErrorMode.KERNEL32(00000000), ref: 007FB5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 007FB623
VariantClear.OLEAUT32(0082D91C), ref: 007FB633

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 28a1ce859a23052a1c0e88e7800c7118cf9fa0500db9ef59ebe50b299afc87f1
Instruction ID: e3f53ac05159d49a3e4ee0d39cd70e134df9c5ddce5f1ba722f5a4d8e0b7fd6c
Opcode Fuzzy Hash: 28a1ce859a23052a1c0e88e7800c7118cf9fa0500db9ef59ebe50b299afc87f1
Instruction Fuzzy Hash: DFC1F171608305AFC700DF68C88492ABBE9BF89348F04491DF68A9B351DB75ED45CB52

Function 007CACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 007CACC1

Part of subcall function 007C7CF4: __mtinitlocknum.LIBCMT ref: 007C7D06
Part of subcall function 007C7CF4: EnterCriticalSection.KERNEL32(00000000,?,007C7ADD,0000000D), ref: 007C7D1F

__calloc_crt.LIBCMT ref: 007CACD2

Part of subcall function 007C6986: __calloc_impl.LIBCMT ref: 007C6995
Part of subcall function 007C6986: Sleep.KERNEL32(00000000,000003BC,007BF507,?,0000000E), ref: 007C69AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 007CACED
GetStartupInfoW.KERNEL32(?,00856E28,00000064,007C5E91,00856C70,00000014), ref: 007CAD46
__calloc_crt.LIBCMT ref: 007CAD91
GetFileType.KERNEL32(00000001), ref: 007CADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 007CAE11

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 50176da8fe0723dac2896e724884bb9a040d318cd9379d35208f5da9c56c9db0
Instruction ID: 59fa7bae52375580271e4f653b95e59fb470c624c71729c4324908d686f7139d
Opcode Fuzzy Hash: 50176da8fe0723dac2896e724884bb9a040d318cd9379d35208f5da9c56c9db0
Instruction Fuzzy Hash: 0E81F5709057499FDB24CF68C885AADBBF0BF09329B24425DD4A6AB3D1D738D803CB95

Function 007E67E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007E67FD
__swprintf.LIBCMT ref: 007E680A

Part of subcall function 007C172B: __woutput_l.LIBCMT ref: 007C1784

FindResourceW.KERNEL32(?,?,0000000E), ref: 007E6834
LoadResource.KERNEL32(?,00000000), ref: 007E6840
LockResource.KERNEL32(00000000), ref: 007E684D
FindResourceW.KERNEL32(?,?,00000003), ref: 007E686D
LoadResource.KERNEL32(?,00000000), ref: 007E687F
SizeofResource.KERNEL32(?,00000000), ref: 007E688E
LockResource.KERNEL32(?), ref: 007E689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 007E68F9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 7b1f86d0579274e03cd6b90efd12c776d5fca983dde27626f8cf3ca6eedeb720
Instruction ID: c3315aa7196fb94e62ffc6cbabe9a6f724c25b246390522ed94a0d6bf9510973
Opcode Fuzzy Hash: 7b1f86d0579274e03cd6b90efd12c776d5fca983dde27626f8cf3ca6eedeb720
Instruction Fuzzy Hash: 1C31AE7190125AEBDB109F61DD49EBE7BA8FF18380F008429F912D2141E778D912DBA0

Function 007E4025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007E4047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,007E30A5,?,00000001), ref: 007E405B
GetWindowThreadProcessId.USER32(00000000), ref: 007E4062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007E30A5,?,00000001), ref: 007E4071
GetWindowThreadProcessId.USER32(?,00000000), ref: 007E4083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,007E30A5,?,00000001), ref: 007E409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007E30A5,?,00000001), ref: 007E40AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,007E30A5,?,00000001), ref: 007E40F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,007E30A5,?,00000001), ref: 007E4108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,007E30A5,?,00000001), ref: 007E4113

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8ae3574d4da46b5ee6a0fe7d86207059ccf151996e6161c1a10f6d48c852b8a8
Instruction ID: f5870a1e9d769e6807384dbb04b2a0071dcfee90d24405b69da322f2d7477330
Opcode Fuzzy Hash: 8ae3574d4da46b5ee6a0fe7d86207059ccf151996e6161c1a10f6d48c852b8a8
Instruction Fuzzy Hash: DC318271501248AFDB20DF55EC89B697BB9BB68351F11C119F905E6290DBB8DE808BA0

Function 0081DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007BB496
SetTextColor.GDI32(?,000000FF), ref: 007BB4A0
SetBkMode.GDI32(?,00000001), ref: 007BB4B5
GetStockObject.GDI32(00000005), ref: 007BB4BD
GetClientRect.USER32(?), ref: 0081DD63
SendMessageW.USER32(?,00001328,00000000,?), ref: 0081DD7A
GetWindowDC.USER32(?), ref: 0081DD86
GetPixel.GDI32(00000000,?,?), ref: 0081DD95
ReleaseDC.USER32(?,00000000), ref: 0081DDA7
GetSysColor.USER32(00000005), ref: 0081DDC5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: a194c08e3a1d2f89ab664c2c8d2e73d69ff6d898bc0cf91d36892100c41372b5
Instruction ID: 68907432e4b802cbb242f792f9a9d909564ca1617dc6d5c090b7589f44a2903a
Opcode Fuzzy Hash: a194c08e3a1d2f89ab664c2c8d2e73d69ff6d898bc0cf91d36892100c41372b5
Instruction Fuzzy Hash: 2C114C31500345EFDB216BA4EC09BE97FA5FB05326F108625FA66950E2CB714952EB21

Function 007DCB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,007DCF50), ref: 007DCE90

Strings

INSTANCE, xrefs: 007DCD9E
REGEXPCLASS, xrefs: 007DCC56
CLASSNN, xrefs: 007DCC33
CLASS, xrefs: 007DCC10
NAME, xrefs: 007DCCC2
TEXT, xrefs: 007DCDC7

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: c55f80953d2e2065e7e952b7c97c330188dbba5a0238d52d73cbf6473c0c4481
Instruction ID: 9ef6b7bfb413ae6a1d342a0744f83377cba897042e0c7db6c0ff6d4b8c7c183f
Opcode Fuzzy Hash: c55f80953d2e2065e7e952b7c97c330188dbba5a0238d52d73cbf6473c0c4481
Instruction Fuzzy Hash: C991A170600207EACB19DFA0C485BEAFB75FF05310F54852AE949A7351DF38695ADBE0

Function 007A3093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007A30DC
CoUninitialize.OLE32(?,00000000), ref: 007A3181
UnregisterHotKey.USER32(?), ref: 007A32A9
DestroyWindow.USER32(?), ref: 00815079
FreeLibrary.KERNEL32(?), ref: 008150F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00815125

Strings

close all, xrefs: 007A30D7

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 49591ca42e2222886dbda4f3145d415a8b950b15d7c2854a566b20709106bee8
Instruction ID: 864152b04e4c908eb1d11f7c23d7c40aba51158d252bb9128cc3c5ec7176b336
Opcode Fuzzy Hash: 49591ca42e2222886dbda4f3145d415a8b950b15d7c2854a566b20709106bee8
Instruction Fuzzy Hash: 35914E70600606DFC715EF54C899FA9F3A4FF86304F5482A9F40AA7662DB38AE56CF50

Function 007BCB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 007BCC15

Part of subcall function 007BCCCD: GetClientRect.USER32(?,?), ref: 007BCCF6
Part of subcall function 007BCCCD: GetWindowRect.USER32(?,?), ref: 007BCD37
Part of subcall function 007BCCCD: ScreenToClient.USER32(?,?), ref: 007BCD5F

GetDC.USER32 ref: 0081D137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0081D14A
SelectObject.GDI32(00000000,00000000), ref: 0081D158
SelectObject.GDI32(00000000,00000000), ref: 0081D16D
ReleaseDC.USER32(?,00000000), ref: 0081D175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0081D200

Strings

U, xrefs: 0081D0D5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: a8795080e53c01999d506c41c9d3b2e295947311e85037cab4e59828668694a2
Instruction ID: bfd5a27f8cee1f31719aa478e34b6f5d8870e5d1e99f40d58da9b2e5244a0c1a
Opcode Fuzzy Hash: a8795080e53c01999d506c41c9d3b2e295947311e85037cab4e59828668694a2
Instruction Fuzzy Hash: 8171C031500309EFCF229F64CC85BEA7BB9FF58314F188269ED559A2A6C7359881DB60

Function 007F45C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007F45FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 007F462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 007F466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 007F4682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007F468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 007F46BF
InternetCloseHandle.WININET(00000000), ref: 007F4706

Part of subcall function 007F5052: GetLastError.KERNEL32(?,?,007F43CC,00000000,00000000,00000001), ref: 007F5067

Strings

, xrefs: 007F46B8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: a46073459875938a987114b28578bac7f5a20870fb7d3535b26312471718f659
Instruction ID: 466bd1e8a12d1e4965f6759b609eb6aac3eb1301985527bd5a844edaf60c7b82
Opcode Fuzzy Hash: a46073459875938a987114b28578bac7f5a20870fb7d3535b26312471718f659
Instruction Fuzzy Hash: 39417FB1501209BFEB119F54CC89FBB7BACFF09314F108126FA15DA241EBB899459BA4

Function 007FB644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0083DC00), ref: 007FB715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0083DC00), ref: 007FB749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 007FB8C1
SysFreeString.OLEAUT32(?), ref: 007FB8EB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: eb7a786d4c062a8022f64a8b8a15dfb8b4028505cde7caf622deca66d418f289
Instruction ID: 0d5f9446d03b801c48a29d8c54004f20170f2cda604a565008fc245c5d34fbfe
Opcode Fuzzy Hash: eb7a786d4c062a8022f64a8b8a15dfb8b4028505cde7caf622deca66d418f289
Instruction Fuzzy Hash: 45F12B75A00209EFCB14DF94C888EBEBBB9FF89311F108459FA15AB250DB75AD45CB90

Function 008024D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008024F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00802688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 008026AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 008026EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0080270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0080286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 008028A1
CloseHandle.KERNEL32(?), ref: 008028D0
CloseHandle.KERNEL32(?), ref: 00802947

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 10a7e42906dd229b8cc0084cfcfe435590dd273d98a07701f86fdc2e95c23d1c
Instruction ID: fb9685e21d27ba6c9fbde1a7caa4b7233b4e2667c0f4341dfbcf5a458e98f520
Opcode Fuzzy Hash: 10a7e42906dd229b8cc0084cfcfe435590dd273d98a07701f86fdc2e95c23d1c
Instruction Fuzzy Hash: 69D1BA31204200DFCB65EF24C899B6ABBE4FF89314F14856DF9999B2A2DB74DC41CB52

Function 0080B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0080B3F4

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 80e7acb337a873a5d43b501c2c6e7d01682c7dda6ef0c4dafa31ee78ccfdc32b
Instruction ID: 32e07001abe2a965279cea042a9f5140979a10d0163e0a5df8ba2b80d26fcdf3
Opcode Fuzzy Hash: 80e7acb337a873a5d43b501c2c6e7d01682c7dda6ef0c4dafa31ee78ccfdc32b
Instruction Fuzzy Hash: 57519F30600609BFEFB09F68CC89BAD7BA4FB05728F644121FA15D62E2D771E940CB55

Function 007BA699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0081DB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0081DB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0081DB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0081DB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0081DB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,007BA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0081DBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0081DBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,007BA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0081DBC8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 50f75e696661190ef156e1f81cc4d48725c673d747601d07b2e0dd873121de76
Instruction ID: 69b131daaa819345c6654f9cb164dd015453643413e925ff8511463af0eabc18
Opcode Fuzzy Hash: 50f75e696661190ef156e1f81cc4d48725c673d747601d07b2e0dd873121de76
Instruction Fuzzy Hash: 27514770604309EFDB20EF68CC85FAA7BB8FF58764F114518F946DA291DBB4A980DB50

Function 007E7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007E5FA6,?), ref: 007E6ED8

Part of subcall function 007E6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007E5FA6,?), ref: 007E6EF1

Part of subcall function 007E72CB: GetFileAttributesW.KERNEL32(?,007E6019), ref: 007E72CC

lstrcmpiW.KERNEL32(?,?), ref: 007E75CA
_wcscmp.LIBCMT ref: 007E75E2
MoveFileW.KERNEL32(?,?), ref: 007E75FB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 4d47018fa7b7885a04f629d6c084e58b255377d74b444453b55531e9ecc3cdbc
Instruction ID: d105006eac5a1c0d2bf8117bb1b3ca4e69ecbaae9f99c8da039406a1a8ba8efc
Opcode Fuzzy Hash: 4d47018fa7b7885a04f629d6c084e58b255377d74b444453b55531e9ecc3cdbc
Instruction Fuzzy Hash: 01512EB2A0A2599ADF64EB95D845DDE73BCAF0C310B1040AEF605E3141EA78D6C5CBA4

Function 007BEA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0081DAD1,00000004,00000000,00000000), ref: 007BEAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0081DAD1,00000004,00000000,00000000), ref: 007BEB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0081DAD1,00000004,00000000,00000000), ref: 0081DC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0081DAD1,00000004,00000000,00000000), ref: 0081DCF2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d950089cc428be390048df078f9f24700f609d23a33edbfd16b45bf2539a6f8b
Instruction ID: b3016e1eca54d4349d084ff743724e8eb8078313d08f2b09ba5db57d8415310f
Opcode Fuzzy Hash: d950089cc428be390048df078f9f24700f609d23a33edbfd16b45bf2539a6f8b
Instruction Fuzzy Hash: C441E6B1205780DAD73947288D8DFFB7E9AFF51305F19480DE04786BA2C678B881D751

Function 007DB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,007DAEF1,00000B00,?,?), ref: 007DB26C
HeapAlloc.KERNEL32(00000000,?,007DAEF1,00000B00,?,?), ref: 007DB273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,007DAEF1,00000B00,?,?), ref: 007DB288
GetCurrentProcess.KERNEL32(?,00000000,?,007DAEF1,00000B00,?,?), ref: 007DB290
DuplicateHandle.KERNEL32(00000000,?,007DAEF1,00000B00,?,?), ref: 007DB293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,007DAEF1,00000B00,?,?), ref: 007DB2A3
GetCurrentProcess.KERNEL32(007DAEF1,00000000,?,007DAEF1,00000B00,?,?), ref: 007DB2AB
DuplicateHandle.KERNEL32(00000000,?,007DAEF1,00000B00,?,?), ref: 007DB2AE
CreateThread.KERNEL32(00000000,00000000,007DB2D4,00000000,00000000,00000000), ref: 007DB2C8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: d6e8b8a6a3753cbbba2409424c55c857a12c965a215075997f90efd8f0d52f52
Instruction ID: a0b0e178264397d2689ee8a3f433fadcb89734d4cd7a84b125243efffa6fc64d
Opcode Fuzzy Hash: d6e8b8a6a3753cbbba2409424c55c857a12c965a215075997f90efd8f0d52f52
Instruction Fuzzy Hash: 9201A8B6240304BFE620ABA5DC4DF6B7BACFB88711F018415FA05DB2A1DA7498118B61

Function 007FC43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 007FC876, 007FC887
Not an Object type, xrefs: 007FC49E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 9243f03b4e56c92acb61bbe1ca9df9365711b71067e0a88a75187a726dc65599
Instruction ID: 00bea4dc35d2b1b20f7769c8c0d489953ccca044dd6344f65695b459dc009686
Opcode Fuzzy Hash: 9243f03b4e56c92acb61bbe1ca9df9365711b71067e0a88a75187a726dc65599
Instruction Fuzzy Hash: 36E19471A0021DABDF15DFA8CA85ABE77B5FF48354F144029FA05AB381D778AD41CBA0

Function 007FBB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007FBB5C
VariantInit.OLEAUT32(?), ref: 007FBC2D
VariantInit.OLEAUT32(?), ref: 007FBD2E
VariantClear.OLEAUT32(?), ref: 007FBD38
VariantClear.OLEAUT32(?), ref: 007FBD99

Strings

Null Object assignment in FOR..IN loop, xrefs: 007FBBBD, 007FBCEB, 007FBDA7
Incorrect Object type in FOR..IN loop, xrefs: 007FBD11

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 7a861c8d3c0774ec1279583b72f81a491ea6700b820186b7f050854c14ea1737
Instruction ID: a85dba294d1545186ebbff03a4800258f6024c9c887708b3e8352876c6644c85
Opcode Fuzzy Hash: 7a861c8d3c0774ec1279583b72f81a491ea6700b820186b7f050854c14ea1737
Instruction Fuzzy Hash: 9A91A071A00219EBDF24CFA5C848FAEBBB8EF45710F108159F615AB381DB789944CBA1

Function 00809A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00809B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 00809B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00809B47
_wcscat.LIBCMT ref: 00809BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00809BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00809BE7

Strings

SysListView32, xrefs: 00809AEB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 06666e33de19bc5085d8a7d125b476a30f2a3286ab4557dd1da3abd00e46c8a4
Instruction ID: 373d7d8d599c5fe743a788861fb69e0e703383e7209c17a46f984df02e84a1ea
Opcode Fuzzy Hash: 06666e33de19bc5085d8a7d125b476a30f2a3286ab4557dd1da3abd00e46c8a4
Instruction Fuzzy Hash: E341A271A00318EBEB219F64CC85BEA7BA8FB08350F10442AF585E72D2D6759D85CB60

Function 0080172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 007E6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 007E6554
Part of subcall function 007E6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 007E6564
Part of subcall function 007E6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 007E65F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0080179A
GetLastError.KERNEL32 ref: 008017AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 008017D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 00801855
GetLastError.KERNEL32(00000000), ref: 00801860
CloseHandle.KERNEL32(00000000), ref: 00801895

Strings

SeDebugPrivilege, xrefs: 008017B8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 31ca79b824f36233359c9f13bf0bb2b663ed4a9f4097efba39925743baa17f85
Instruction ID: 9694917e9cb283c49218afc7a838a9426aabb745f42ebb04b1e01f2babe29784
Opcode Fuzzy Hash: 31ca79b824f36233359c9f13bf0bb2b663ed4a9f4097efba39925743baa17f85
Instruction Fuzzy Hash: 14418C72600204AFDB15EF94CC99FAEBBA5BF58714F04C069F9069F2C2DB7899058B51

Function 007E5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 007E58B8

Strings

stop, xrefs: 007E5889
blank, xrefs: 007E583A
question, xrefs: 007E5871
warning, xrefs: 007E58A1
info, xrefs: 007E5859

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f2553e53d917ca46cb19b1317ce2b9e04e81d3f78bc83cb3d945274e7b30510d
Instruction ID: 8c5c91e2254a536d893f15e45b55c380c846d74ec795e7e77fbacff5c365fb20
Opcode Fuzzy Hash: f2553e53d917ca46cb19b1317ce2b9e04e81d3f78bc83cb3d945274e7b30510d
Instruction Fuzzy Hash: 9911203520E78AFEE7155B559C92D6A37DCEF2D358B30003EF950E6281E77CAA5043A4

Function 007EA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 007EA806

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 38a1f3cd6bafecfadf799be020fb8af73c75ba9719ffa38f96e0781e927f1b8a
Instruction ID: b807ce45e7c3c2946acfaa7e70f06e761729d62d4c1da4989bab34e01b475a8d
Opcode Fuzzy Hash: 38a1f3cd6bafecfadf799be020fb8af73c75ba9719ffa38f96e0781e927f1b8a
Instruction Fuzzy Hash: 27C17A75A0225AEFDB14DF99C485BAEBBF4FF0C315F208069E605E7241D738AA41CB91

Function 007E6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 007E6B63
LoadStringW.USER32(00000000), ref: 007E6B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 007E6B80
LoadStringW.USER32(00000000), ref: 007E6B87
_wprintf.LIBCMT ref: 007E6BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007E6BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 007E6BA8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 4cf0230e33d42123b0c1e57aa9bf467c65c60d9f560c85b766a78ad79b64dbae
Instruction ID: 55bf6c98ba74a82a0e0caf60164d5c723c90ee8fd64841864ae7447b18292ef8
Opcode Fuzzy Hash: 4cf0230e33d42123b0c1e57aa9bf467c65c60d9f560c85b766a78ad79b64dbae
Instruction Fuzzy Hash: AD0186F2500308BFEB11A7909D89EF7776CE708344F5084A5B746D2141EA74DE858F70

Function 00802B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00803C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00802BB5,?,?), ref: 00803C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00802BF6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: 503883c74ee7b1a4eb761415ce7c0ad5320ff5f7629e611c4d0327c5ede12011
Instruction ID: ba53b5d7d2375e0fb55390904d4649e0057a671eb3ec34da54cd90e1c9052d1f
Opcode Fuzzy Hash: 503883c74ee7b1a4eb761415ce7c0ad5320ff5f7629e611c4d0327c5ede12011
Instruction Fuzzy Hash: 97916771204204DFCB11EF54C899B6EBBE5FF89310F04881DF9969B2A2DB75A906CB42

Function 007F961C Relevance: 12.2, APIs: 8, Instructions: 220networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 007F9691
WSAGetLastError.WSOCK32(00000000), ref: 007F969E
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 007F96C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007F96E9
WSAGetLastError.WSOCK32(00000000), ref: 007F96F8
inet_ntoa.WSOCK32(?), ref: 007F9765
htons.WSOCK32(?,?,?,00000000,?), ref: 007F97AA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorLast$htonsinet_ntoaselect
String ID:
API String ID: 500251541-0
Opcode ID: d7ef71038517dd08879f44cccc63c9741a8656285c250c5c767b3e72a417d652
Instruction ID: 2da08a76edc28de19e183aab05a8d7942524cb400d2c23b565142b8e33d32153
Opcode Fuzzy Hash: d7ef71038517dd08879f44cccc63c9741a8656285c250c5c767b3e72a417d652
Instruction Fuzzy Hash: 3E71AA71504204EFC724EF64CC89F6BB7A8BB89714F104A1DF6569B2A1EB38D905CB62

Function 007CA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 007CA991

Part of subcall function 007C7D7C: __FF_MSGBANNER.LIBCMT ref: 007C7D91
Part of subcall function 007C7D7C: __NMSG_WRITE.LIBCMT ref: 007C7D98
Part of subcall function 007C7D7C: __malloc_crt.LIBCMT ref: 007C7DB8

__lock.LIBCMT ref: 007CA9A4
__lock.LIBCMT ref: 007CA9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00856DE0,00000018,007D5E7B,?,00000000,00000109), ref: 007CAA0C
EnterCriticalSection.KERNEL32(8000000C,00856DE0,00000018,007D5E7B,?,00000000,00000109), ref: 007CAA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 007CAA39

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 10a27216a0807fcef7949238ccbbf8afdcca66a3dc01b6b9851fd13f45ecf8a5
Instruction ID: 159c246792ec8f6f67c3f8356243e209e081a8b55ada9de8a3c1325abaef2f8d
Opcode Fuzzy Hash: 10a27216a0807fcef7949238ccbbf8afdcca66a3dc01b6b9851fd13f45ecf8a5
Instruction Fuzzy Hash: 16413B7190060AEBDB149F68D945F5CBBB0BF0532AF11C21DD425AB2D1DBBC9C00CB95

Function 00808ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00808EE4
GetDC.USER32(00000000), ref: 00808EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00808EF7
ReleaseDC.USER32(00000000,00000000), ref: 00808F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00808F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00808F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0080BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00808F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00808FAA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: f76dff22defe5838b1c66207ab5d38c17ea13084ac8d738de48e763d26466e12
Instruction ID: 96af13043fdfc378958b52f55eaef350611be9469a90a766ec86afcfc3f2154c
Opcode Fuzzy Hash: f76dff22defe5838b1c66207ab5d38c17ea13084ac8d738de48e763d26466e12
Instruction Fuzzy Hash: 34315E72101614BFEB208F60CC49FAA3FA9FB49715F044065FE48DA191CA759842CBB4

Function 007F16DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

Part of subcall function 007BC6F4: _wcscpy.LIBCMT ref: 007BC717

_wcstok.LIBCMT ref: 007F184E
_wcscpy.LIBCMT ref: 007F18DD
_memset.LIBCMT ref: 007F1910

Strings

X, xrefs: 007F1948

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 8da2fe889c97a0e7a9c14e9b592f085375873dbaf52d34ebc48e679559beaa7a
Instruction ID: 25ae10cf9779385d36916b8889727a4dd35710b951efad39d98067509a0ffe64
Opcode Fuzzy Hash: 8da2fe889c97a0e7a9c14e9b592f085375873dbaf52d34ebc48e679559beaa7a
Instruction Fuzzy Hash: 43C17F71504344DFC724EF24C945A6AB7E4BF86350F408A2DF99A973A2DB38ED05CB82

Function 00810133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

GetSystemMetrics.USER32(0000000F), ref: 0081016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 0081038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 008103AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 008103D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 008103FF
ShowWindow.USER32(00000003,00000000), ref: 00810421
DefDlgProcW.USER32(?,00000005,?,?), ref: 00810440

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: 43cd291d75836b57341b094350ce972b42805ea02d9e4c9975766f857f8ef246
Instruction ID: f8450e15f5a372b8231f1d4ad6e694575c28c4b54532c24f2b409ff6ac35e74e
Opcode Fuzzy Hash: 43cd291d75836b57341b094350ce972b42805ea02d9e4c9975766f857f8ef246
Instruction Fuzzy Hash: 65A19B35600616ABDB18CF68C9897EDBBB5FF08744F148115E858EA290D7B4ADD0CB90

Function 007BAE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8195977971aada7fa52554109b0224fe5292241da7abb22e8a0ff32f71cd4f04
Instruction ID: c289ca2fd7bc04d42a64e6bfff07ad5dd0c4f430a388dec63855a55fba7f2356
Opcode Fuzzy Hash: 8195977971aada7fa52554109b0224fe5292241da7abb22e8a0ff32f71cd4f04
Instruction Fuzzy Hash: A77148B1900109FFCB14DF98CC89AFEBB79FF85314F248159F915AA251C734AA42CB65

Function 00802230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0080225A
_memset.LIBCMT ref: 00802323
ShellExecuteExW.SHELL32(?), ref: 00802368

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

Part of subcall function 007BC6F4: _wcscpy.LIBCMT ref: 007BC717

CloseHandle.KERNEL32(00000000), ref: 0080242F
FreeLibrary.KERNEL32(00000000), ref: 0080243E

Strings

@, xrefs: 00802334

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: e70cda7769ddf455fe11c38c7358e49b83bfc332729337e0f6109550d0e7d5de
Instruction ID: 1b0eedd90369cd96a9aa0ebab5d78a63e21a282cd522dc77e8141a0666032e75
Opcode Fuzzy Hash: e70cda7769ddf455fe11c38c7358e49b83bfc332729337e0f6109550d0e7d5de
Instruction Fuzzy Hash: 5771B271A00619DFCF15EFA4C889A9EBBF5FF48310F118159E856AB3A1CB74AD40CB94

Function 007E3DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 007E3DE7
GetKeyboardState.USER32(?), ref: 007E3DFC
SetKeyboardState.USER32(?), ref: 007E3E5D
PostMessageW.USER32(?,00000101,00000010,?), ref: 007E3E8B
PostMessageW.USER32(?,00000101,00000011,?), ref: 007E3EAA
PostMessageW.USER32(?,00000101,00000012,?), ref: 007E3EF0
PostMessageW.USER32(?,00000101,0000005B,?), ref: 007E3F13

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 3f2d1bbb211cdf6cd1bd25244fc17bcf778a3e1165a49a6c68fc338e52ff9130
Instruction ID: fd92111080ed023ac456141183a46fe2c0cdfccbe1d9049d5f0b63620ead8175
Opcode Fuzzy Hash: 3f2d1bbb211cdf6cd1bd25244fc17bcf778a3e1165a49a6c68fc338e52ff9130
Instruction Fuzzy Hash: A751B2A0A057D53DFB3647358C4DBB67EA95B0A304F088589F0D59B8C3D2ADAEC4D760

Function 007E3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 007E3C02
GetKeyboardState.USER32(?), ref: 007E3C17
SetKeyboardState.USER32(?), ref: 007E3C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 007E3CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 007E3CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 007E3D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 007E3D26

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cf8b366d35f380337efb2d6b4cbeab9edc10b3d79554f8f83f923522140d4d61
Instruction ID: 79fb0ab25a3fe873f210c410791aef6d4759d80254954798ea2d45154d140c20
Opcode Fuzzy Hash: cf8b366d35f380337efb2d6b4cbeab9edc10b3d79554f8f83f923522140d4d61
Instruction Fuzzy Hash: B251EAA06057D53DFB3283368C49BB6BFA96B0E304F088489E0D55B4D2D69DEE94D760

Function 007E7DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 007E7DBE
_wcsncpy.LIBCMT ref: 007E7DF3
_wcsncpy.LIBCMT ref: 007E7E25
_wcsncpy.LIBCMT ref: 007E7E58
_wcsncpy.LIBCMT ref: 007E7E9A
_wcsncpy.LIBCMT ref: 007E7ED4
_wcsncpy.LIBCMT ref: 007E7F03

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6ba61967313c7269f9c3593b0d977f8f2814db43a7a700a6443119873333423e
Instruction ID: 5fc95ada4a98f2f60f198bd6cbe49d5e6eb4937065b67b0633fd59a61f93b0f2
Opcode Fuzzy Hash: 6ba61967313c7269f9c3593b0d977f8f2814db43a7a700a6443119873333423e
Instruction Fuzzy Hash: 34417F66C11354F6DB20ABF4884AECFB3AC9F45710F5489AAE504F3122FA38E611C7E5

Function 00803D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00803DA1
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00803DCB
FreeLibrary.KERNEL32(00000000), ref: 00803E80

Part of subcall function 00803D72: RegCloseKey.ADVAPI32(?), ref: 00803DE8
Part of subcall function 00803D72: FreeLibrary.KERNEL32(?), ref: 00803E3A
Part of subcall function 00803D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00803E5D

RegDeleteKeyW.ADVAPI32(?,?), ref: 00803E25

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 7d9275015258534f69b41a9445457e2926bea51671123babd70a5739b2b998e9
Instruction ID: 495c36d1cd1d8b9c16b8a906dbbed259803b8c6eed53122f39e0697b21ba485b
Opcode Fuzzy Hash: 7d9275015258534f69b41a9445457e2926bea51671123babd70a5739b2b998e9
Instruction Fuzzy Hash: 48310BB1901209BFDB559B94DC89EFFBBBCFF08300F10426AE512E2190D6749F499BA0

Function 00808FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00808FE7
GetWindowLongW.USER32(0131E300,000000F0), ref: 0080901A
GetWindowLongW.USER32(0131E300,000000F0), ref: 0080904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00809081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 008090AB
GetWindowLongW.USER32(00000000,000000F0), ref: 008090BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 008090D6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: df73e4d1a1c79e65a3101428442d373d64a9953091156d6fdc071544052cef04
Instruction ID: 0a50092b43a4c40eccec8e41eb7be9eac41c26946956ecd922da3b159f923945
Opcode Fuzzy Hash: df73e4d1a1c79e65a3101428442d373d64a9953091156d6fdc071544052cef04
Instruction Fuzzy Hash: B6313274600215EFEB60CF58DC88F6537A5FB5A314F194164F599CB2F2CBB1A841CB81

Function 007E08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007E08F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007E0918
SysAllocString.OLEAUT32(00000000), ref: 007E091B
SysAllocString.OLEAUT32(?), ref: 007E0939
SysFreeString.OLEAUT32(?), ref: 007E0942
StringFromGUID2.OLE32(?,?,00000028), ref: 007E0967
SysAllocString.OLEAUT32(?), ref: 007E0975

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: ea52774641c0932e4f1b1f251e99c41eb0fb2633b0d8188520f7ecd918d956b1
Instruction ID: 8a4c96648a9fe22d8919fd2fdb573f8905f3f7b160471d49889f32136347106d
Opcode Fuzzy Hash: ea52774641c0932e4f1b1f251e99c41eb0fb2633b0d8188520f7ecd918d956b1
Instruction Fuzzy Hash: 3C21C772601219AFAB109FB9CC88DBB77ECFB0C360B048125F945DB152D6B4ED85CBA4

Function 007E2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007E2485
__wcsnicmp.LIBCMT ref: 007E24A6
__wcsnicmp.LIBCMT ref: 007E24C0

Strings

#notrayicon, xrefs: 007E247D
#OnAutoItStartRegister, xrefs: 007E24BA
#requireadmin, xrefs: 007E24A0

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: eb3d12de7cc5a4ce968703c094bc9dc4fa137755dae6e120f632990567719002
Instruction ID: b53fc56d8f48df091dbee9272c90c5797a11664ee9700ee98f85f8ccb8130100
Opcode Fuzzy Hash: eb3d12de7cc5a4ce968703c094bc9dc4fa137755dae6e120f632990567719002
Instruction Fuzzy Hash: 97216A322056D1A7D321A6299D16FB7739CEFAA310F60402AF44697183E66D9D53C2E0

Function 007E0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007E09CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007E09F1
SysAllocString.OLEAUT32(00000000), ref: 007E09F4
SysAllocString.OLEAUT32 ref: 007E0A15
SysFreeString.OLEAUT32 ref: 007E0A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 007E0A38
SysAllocString.OLEAUT32(?), ref: 007E0A46

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c2ce68517ebc0b1bcfa8849595f3e1e92628aadf52e599c41ed61c90310f2a80
Instruction ID: 5deb0bed528d07849659d6d4f0e19ea1a30213bd3e90796fddc2aed68ff16058
Opcode Fuzzy Hash: c2ce68517ebc0b1bcfa8849595f3e1e92628aadf52e599c41ed61c90310f2a80
Instruction Fuzzy Hash: 3F216275201208AFDB10AFA9DC88DAAB7ECFF0C360700C135F909CB265D6B4ED858764

Function 0080A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007BD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007BD1BA
Part of subcall function 007BD17C: GetStockObject.GDI32(00000011), ref: 007BD1CE
Part of subcall function 007BD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 007BD1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0080A32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0080A33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0080A345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0080A354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0080A360

Strings

Msctls_Progress32, xrefs: 0080A2FE

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 5046b2cd31bbe80886f6b8b5add742555e8178dcd1e4efbd5aa44f2a471d7018
Instruction ID: f6144038e1db10c06e6101a7cb4c9b32caa048bddf07fae56db7e7fff39f8b3e
Opcode Fuzzy Hash: 5046b2cd31bbe80886f6b8b5add742555e8178dcd1e4efbd5aa44f2a471d7018
Instruction Fuzzy Hash: 4D1190B115021DBEEF255FA4CC85EEB7F6DFF09798F014114FA08A61A0C6729C21DBA4

Function 007BCCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 007BCCF6
GetWindowRect.USER32(?,?), ref: 007BCD37
ScreenToClient.USER32(?,?), ref: 007BCD5F
GetClientRect.USER32(?,?), ref: 007BCE8C
GetWindowRect.USER32(?,?), ref: 007BCEA5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 13544572c86281df308860c1884d51aeaed91be7f4533aeca5365656901e9d8d
Instruction ID: 73629ccffdf58559e3a6e82abcd7987f24d4dd57079f29903b23c577d16aa843
Opcode Fuzzy Hash: 13544572c86281df308860c1884d51aeaed91be7f4533aeca5365656901e9d8d
Instruction Fuzzy Hash: C7B12879A0064ADBDB11CFA8C5807EDBBB1FF08310F14D569EC59EB250DB74AA90CB64

Function 00801BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00801C18
Process32FirstW.KERNEL32(00000000,?), ref: 00801C26
__wsplitpath.LIBCMT ref: 00801C54

Part of subcall function 007C1DFC: __wsplitpath_helper.LIBCMT ref: 007C1E3C

_wcscat.LIBCMT ref: 00801C69
Process32NextW.KERNEL32(00000000,?), ref: 00801CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00801CF1

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: d24f55a1759569a55ad7a418c93a85ba0648ae0f2a15676a1edd1b18d98dafd6
Instruction ID: 1dcc1e537a57f4ec9b592648123c9f335f9c7c11a968f9d7c76c59b87c05df14
Opcode Fuzzy Hash: d24f55a1759569a55ad7a418c93a85ba0648ae0f2a15676a1edd1b18d98dafd6
Instruction Fuzzy Hash: 9A513CB11043009BD721EF64CC89EABBBE8FF88754F40491EF58597291EB74D905CBA2

Function 00802FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00803C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00802BB5,?,?), ref: 00803C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008030AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008030EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00803112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0080313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0080317E
RegCloseKey.ADVAPI32(00000000), ref: 0080318B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: bd8226b971c41fa0ba03abe90361bf797685324170abaf29f0a87a503895785c
Instruction ID: fcef6519fee5cefb7eccb3d067b06a321c71192b83c6b18a5dfa09412252443c
Opcode Fuzzy Hash: bd8226b971c41fa0ba03abe90361bf797685324170abaf29f0a87a503895785c
Instruction Fuzzy Hash: BB511332208344EFC715EF64CC89E6ABBA9FF89304F048A1DF555872A1DB75EA05CB52

Function 008084DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00808540
GetMenuItemCount.USER32(00000000), ref: 00808577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0080859F
GetMenuItemID.USER32(?,?), ref: 0080860E
GetSubMenu.USER32(?,?), ref: 0080861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 0080866D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 5c47cdac2eb8fe776414091f0a7175769ab1f6537f2db3689ac158080096fad0
Instruction ID: 3a158f0f2f229ef49a7fc4656c31e30ecd13d946669305f2257a8569be4b6056
Opcode Fuzzy Hash: 5c47cdac2eb8fe776414091f0a7175769ab1f6537f2db3689ac158080096fad0
Instruction Fuzzy Hash: 45519C71A00618EFCB11EF54CC49AAEBBB4FF58310F118459E955FB291CB75AE818B90

Function 007E4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E4B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007E4B5B
IsMenu.USER32(00000000), ref: 007E4B7B
CreatePopupMenu.USER32 ref: 007E4BAF
GetMenuItemCount.USER32(000000FF), ref: 007E4C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 007E4C3E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: cd3595564d63413af9ac05984ed8e61ee4cb348d720d0f7f4836985cfde3db5c
Instruction ID: aa29abf1de941d6d9d3842b42a498b14eb845648ddac944007cba790b4a2bc03
Opcode Fuzzy Hash: cd3595564d63413af9ac05984ed8e61ee4cb348d720d0f7f4836985cfde3db5c
Instruction Fuzzy Hash: 9051D6B0603389DFDF20CF66C988BADBBF4BF48318F244159E4159B2A1D3789945CB61

Function 007F8DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0083DC00), ref: 007F8E7C
WSAGetLastError.WSOCK32(00000000), ref: 007F8E89
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 007F8EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 007F8EC5
_strlen.LIBCMT ref: 007F8EF7
WSAGetLastError.WSOCK32(00000000), ref: 007F8F6A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: 308738b078977bcb599119aec28e483b2af5c354f9be806edbde675721aef9d1
Instruction ID: c19f5071fb3b18f25f14f3b85a3c27a62b3668aa974e15e0f7054d581222116f
Opcode Fuzzy Hash: 308738b078977bcb599119aec28e483b2af5c354f9be806edbde675721aef9d1
Instruction Fuzzy Hash: DF419271500208EFCB54EB64CD89EAEB7B9BF59310F104669F516972D1DF38AE00CB61

Function 007BABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

BeginPaint.USER32(?,?,?), ref: 007BAC2A
GetWindowRect.USER32(?,?), ref: 007BAC8E
ScreenToClient.USER32(?,?), ref: 007BACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007BACBC
EndPaint.USER32(?,?,?,?,?), ref: 007BAD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0081E673

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 12edeba76e6b8cedac3717a1e11f7518215626c39451e28d2863a6b9d797dd93
Instruction ID: 3c853f1ca7e31ab8b685d051b9fc0502cc32d16744d046ba4aece5c9da5f2443
Opcode Fuzzy Hash: 12edeba76e6b8cedac3717a1e11f7518215626c39451e28d2863a6b9d797dd93
Instruction Fuzzy Hash: 85419570104301AFCB10EF14DC88FB67BE8FF65320F180659F955872A2D7759885DB62

Function 0080E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00861628,00000000,00861628,00000000,00000000,00861628,?,0081DC5D,00000000,?,00000000,00000000,00000000,?,0081DAD1,00000004), ref: 0080E40B
EnableWindow.USER32(00000000,00000000), ref: 0080E42F
ShowWindow.USER32(00861628,00000000), ref: 0080E48F
ShowWindow.USER32(00000000,00000004), ref: 0080E4A1
EnableWindow.USER32(00000000,00000001), ref: 0080E4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0080E4E8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 185ef0e007d2fc5984ec55a9a741fbdfef6cd12e86ed2f0aafa7421a51f247da
Instruction ID: b0400c3d362c2eb62a440a7bebc02a29967b8591f81d8ea56ace90d57bed67cc
Opcode Fuzzy Hash: 185ef0e007d2fc5984ec55a9a741fbdfef6cd12e86ed2f0aafa7421a51f247da
Instruction Fuzzy Hash: CD416231601940EFDB65CF24C89AB957BE1FF05304F1885B9EA58CF2E2C731A842CB95

Function 007E98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 007E98D1

Part of subcall function 007BF4EA: std::exception::exception.LIBCMT ref: 007BF51E
Part of subcall function 007BF4EA: __CxxThrowException@8.LIBCMT ref: 007BF533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 007E9908
EnterCriticalSection.KERNEL32(?), ref: 007E9924
LeaveCriticalSection.KERNEL32(?), ref: 007E999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007E99B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 007E99D2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: c8df11a352ceaeec032fd37244ca63430e371435e1d9c655ac71fafa6d054409
Instruction ID: 8a9de7006472f78748ddae56fceb92ba6ecfefb183db463656c2ca9d876c9be5
Opcode Fuzzy Hash: c8df11a352ceaeec032fd37244ca63430e371435e1d9c655ac71fafa6d054409
Instruction Fuzzy Hash: A131A631900205EBDB10DF95DC89EAFBB78FF84710B148069F904AB246D734EE15CBA0

Function 007F9B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,007F77F4,?,?,00000000,00000001), ref: 007F9B53

Part of subcall function 007F6544: GetWindowRect.USER32(?,?), ref: 007F6557

GetDesktopWindow.USER32 ref: 007F9B7D
GetWindowRect.USER32(00000000), ref: 007F9B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 007F9BB6

Part of subcall function 007E7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007E7AD0

GetCursorPos.USER32(?), ref: 007F9BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007F9C44

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 269def16b143835de00276cc7d688d0939e4a5eb582af1283ee32021016d09dd
Instruction ID: 38a20ad2fd27828188cb64a0b41456ebb1dfe7b26d99805d0cfbcceac596f1fe
Opcode Fuzzy Hash: 269def16b143835de00276cc7d688d0939e4a5eb582af1283ee32021016d09dd
Instruction Fuzzy Hash: AE31E1B2104309ABD720DF18DC49FAABBE9FF88314F00492AF695D7281D674E905CB91

Function 007DAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007DAFAE
OpenProcessToken.ADVAPI32(00000000), ref: 007DAFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 007DAFC4
CloseHandle.KERNEL32(00000004), ref: 007DAFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007DAFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 007DB012

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 8aea80940e937e1c010e973eadfbd576ac7f236e383c2aa4c35885df2fb1f066
Instruction ID: 0799ba657d8ea9c09691b7a64cec5c8e994009c159be58926a070bd6db2b75a7
Opcode Fuzzy Hash: 8aea80940e937e1c010e973eadfbd576ac7f236e383c2aa4c35885df2fb1f066
Instruction Fuzzy Hash: FB214972100309BFDF128FA4DD09FAE7BB9BB44314F148056FA01A2261D37ADD65EB61

Function 0080EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 007BAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 007BAFE3
Part of subcall function 007BAF83: SelectObject.GDI32(?,00000000), ref: 007BAFF2
Part of subcall function 007BAF83: BeginPath.GDI32(?), ref: 007BB009
Part of subcall function 007BAF83: SelectObject.GDI32(?,00000000), ref: 007BB033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0080EC20
LineTo.GDI32(00000000,00000003,?), ref: 0080EC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0080EC42
LineTo.GDI32(00000000,00000000,?), ref: 0080EC52
EndPath.GDI32(00000000), ref: 0080EC62
StrokePath.GDI32(00000000), ref: 0080EC72

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 8515f5d5c4fdd44ef47f64c1e38d63c8fd068d57888ddaeaf61189233694f7bc
Instruction ID: 78d0617f8f9b0d032bf68ac8beba90d118fc5a022d4eacddad15f1043c032d82
Opcode Fuzzy Hash: 8515f5d5c4fdd44ef47f64c1e38d63c8fd068d57888ddaeaf61189233694f7bc
Instruction Fuzzy Hash: 62110976000249BFEF129F90DC88EEA7F6DFB08350F048122FA089A1B1D7719D56DBA0

Function 007DE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007DE1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 007DE1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007DE1D8
ReleaseDC.USER32(00000000,00000000), ref: 007DE1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 007DE1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 007DE209

Part of subcall function 007D9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,007D9A05,00000000,00000000,?,007D9DDB), ref: 007DA53A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: 90f319d459b604d771375bd48696e5a8156ad37dd22d1ecf82eccee2f79e9b9a
Instruction ID: 84c5c4e79ef7216de19d4c06c9fc2dcd8d998ccc8f1426cf8edcc65d2ca4530d
Opcode Fuzzy Hash: 90f319d459b604d771375bd48696e5a8156ad37dd22d1ecf82eccee2f79e9b9a
Instruction Fuzzy Hash: 690144B5A40719BFEB109BA59C45B5EBFB9FB48751F008066EA04AB390D6719C01CBA0

Function 007C7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 007C7B47

Part of subcall function 007C123A: __initp_misc_winsig.LIBCMT ref: 007C125E
Part of subcall function 007C123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 007C7F51
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 007C7F65
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 007C7F78
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 007C7F8B
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 007C7F9E
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 007C7FB1
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 007C7FC4
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 007C7FD7
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 007C7FEA
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 007C7FFD
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 007C8010
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 007C8023
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 007C8036
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 007C8049
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 007C805C
Part of subcall function 007C123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 007C806F

__mtinitlocks.LIBCMT ref: 007C7B4C

Part of subcall function 007C7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(0085AC68,00000FA0,?,?,007C7B51,007C5E77,00856C70,00000014), ref: 007C7E41

__mtterm.LIBCMT ref: 007C7B55

Part of subcall function 007C7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,007C7B5A,007C5E77,00856C70,00000014), ref: 007C7D3F
Part of subcall function 007C7BBD: _free.LIBCMT ref: 007C7D46
Part of subcall function 007C7BBD: DeleteCriticalSection.KERNEL32(0085AC68,?,?,007C7B5A,007C5E77,00856C70,00000014), ref: 007C7D68

__calloc_crt.LIBCMT ref: 007C7B7A
GetCurrentThreadId.KERNEL32 ref: 007C7BA3

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: b20ad63aa96586463a9ecf8734136afd9d3f0240339b71cd803f295bbabafb63
Instruction ID: c689fac0ca388f905179c6e4fd389ff71c1c7fc36019722af50cbd1bfa108579
Opcode Fuzzy Hash: b20ad63aa96586463a9ecf8734136afd9d3f0240339b71cd803f295bbabafb63
Instruction Fuzzy Hash: 45F06DB250D71699E62C7A747C4BF4A2B84AB02730B2046ADF860C51D2EF2C8C41C964

Function 007A27EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 007A281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 007A2825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 007A2830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 007A283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 007A2843
MapVirtualKeyW.USER32(00000012,00000000), ref: 007A284B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c3ae7e863cc8d53825b96b3acf5a1a1e1e3be39ec7001d133e705f5af916da23
Instruction ID: ef6a4d5dc676ac3bb0a078da6a7fa9c2b2628ba60c183aaf07ffb8bf84d005bd
Opcode Fuzzy Hash: c3ae7e863cc8d53825b96b3acf5a1a1e1e3be39ec7001d133e705f5af916da23
Instruction Fuzzy Hash: AC0167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 007E9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 98c55a2a12429bfb89a68330cc553eea4e04489488f83a7174d18fdf8cd5f27c
Instruction ID: 05abf54c3a0b40739edd9d6f6388349260cceb39c195c13aa853def0628869f7
Opcode Fuzzy Hash: 98c55a2a12429bfb89a68330cc553eea4e04489488f83a7174d18fdf8cd5f27c
Instruction Fuzzy Hash: FE018133102311EBD7295B55EC48EEB7B69FF8C702B149429F603921A1DB78A802DB60

Function 007E7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007E7C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 007E7C1D
GetWindowThreadProcessId.USER32(?,?), ref: 007E7C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007E7C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007E7C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007E7C4C

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 675fd0a0d0e9c799da43b9c108a7659d9a9943ba8e1a933916d3869dbb2b373d
Instruction ID: 3ef6c2b133232cdd731c63bc3b289fba6a3c84eed00013d9c55293cfe9660fbb
Opcode Fuzzy Hash: 675fd0a0d0e9c799da43b9c108a7659d9a9943ba8e1a933916d3869dbb2b373d
Instruction Fuzzy Hash: AAF03A72242298BBE7315B929C0EEEF7FBCEFCAB11F004018FA0191051E7A05A42C6B5

Function 007E9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 007E9A33
EnterCriticalSection.KERNEL32(?,?,?,?,00815DEE,?,?,?,?,?,007AED63), ref: 007E9A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,00815DEE,?,?,?,?,?,007AED63), ref: 007E9A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00815DEE,?,?,?,?,?,007AED63), ref: 007E9A5E

Part of subcall function 007E93D1: CloseHandle.KERNEL32(?,?,007E9A6B,?,?,?,00815DEE,?,?,?,?,?,007AED63), ref: 007E93DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 007E9A71
LeaveCriticalSection.KERNEL32(?,?,?,?,00815DEE,?,?,?,?,?,007AED63), ref: 007E9A78

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 66abb8297394fc480d7d405a3054bc89da3def125a0abd6b5483e38b8e1a6e2d
Instruction ID: 42a9540f3f01c996ff7b9979e2041a47855e87f5efdc5d42aeeb172329ca02af
Opcode Fuzzy Hash: 66abb8297394fc480d7d405a3054bc89da3def125a0abd6b5483e38b8e1a6e2d
Instruction Fuzzy Hash: A3F08233142311EBD7251BA4EC8DEEB7B39FF88302B149425F603910A1DB79A802DB60

Function 007A1CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 007BF4EA: std::exception::exception.LIBCMT ref: 007BF51E
Part of subcall function 007BF4EA: __CxxThrowException@8.LIBCMT ref: 007BF533

__swprintf.LIBCMT ref: 007A1EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 007A1D49

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: 947a5fed20742e1e688e14ed2338192157481c5e589332bc2c9ba1a13b7a44ea
Instruction ID: 38ba3583c2512d8d46f3ef5323b5cf43a87d51447934585b9d14dad9588237dc
Opcode Fuzzy Hash: 947a5fed20742e1e688e14ed2338192157481c5e589332bc2c9ba1a13b7a44ea
Instruction Fuzzy Hash: 81916D71108241EFD724EF24C899CAAB7A8FFD6700F444A1DF985972A2DB34ED45CB92

Function 007FAFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007FB006
CharUpperBuffW.USER32(?,?), ref: 007FB115
VariantClear.OLEAUT32(?), ref: 007FB298

Part of subcall function 007E9DC5: VariantInit.OLEAUT32(00000000), ref: 007E9E05
Part of subcall function 007E9DC5: VariantCopy.OLEAUT32(?,?), ref: 007E9E0E
Part of subcall function 007E9DC5: VariantClear.OLEAUT32(?), ref: 007E9E1A

Strings

AUTOIT.ERROR, xrefs: 007FB11B
Incorrect Parameter format, xrefs: 007FB03E, 007FB20B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: d5feb5c32c02b38ba8c74357e7ec2247e9cc526486699008551cfcf29dfec930
Instruction ID: be2bbc2f91d94c478a1aa60c2df6f3e2c6b66160718e35c56e8896c48cc71e87
Opcode Fuzzy Hash: d5feb5c32c02b38ba8c74357e7ec2247e9cc526486699008551cfcf29dfec930
Instruction Fuzzy Hash: DD916970608305DFCB10DF24C48596ABBF4BF89704F14896DF99A9B362DB39E905CB52

Function 007E5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007BC6F4: _wcscpy.LIBCMT ref: 007BC717

_memset.LIBCMT ref: 007E5438
GetMenuItemInfoW.USER32(?), ref: 007E5467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007E5513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 007E553D

Strings

0, xrefs: 007E5430

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: c04bbc56facec89c1a01619dc343183b4990ed25a080b14cf169c35438aaeb6a
Instruction ID: 549dd8d08dbe4f42dd3d6f870ffce3a2705b419d5865dff94f80402db8b5d245
Opcode Fuzzy Hash: c04bbc56facec89c1a01619dc343183b4990ed25a080b14cf169c35438aaeb6a
Instruction Fuzzy Hash: 7E5135712067899BD7109F29C8456ABB7E9EF8A31CF14062DF896C31D1DBB8CC448B52

Function 007E0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 007E027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007E02B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007E02C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007E0344

Strings

DllGetClassObject, xrefs: 007E02B7

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4c284dd5edb3e8f1c1283890a418beeebfe912a4977443bbb026fb928635ac2c
Instruction ID: 387bd116d1aa8bfe43bbf8d40b8c284eb57d6244f3db877a2e0def60f0ca9616
Opcode Fuzzy Hash: 4c284dd5edb3e8f1c1283890a418beeebfe912a4977443bbb026fb928635ac2c
Instruction Fuzzy Hash: 6D416B71601204EFDB15CF65C885B9ABBB9EF49310B1480ADAD09DF246D7F9D984CBE0

Function 007E5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E5075
GetMenuItemInfoW.USER32 ref: 007E5091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 007E50D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00861708,00000000), ref: 007E5120

Strings

0, xrefs: 007E506D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: f9db6ad26bffaaab9e7e0946f2e5e3c06ab86cdbd1e837ca2efb46c173763297
Instruction ID: fb0094e5a53e2eaf6d29fdfc4b07102618d3a27ed9e1d661f129929add87458c
Opcode Fuzzy Hash: f9db6ad26bffaaab9e7e0946f2e5e3c06ab86cdbd1e837ca2efb46c173763297
Instruction Fuzzy Hash: C941F570206789EFD720DF25DC84F2ABBE4AF89718F144A5EF95697291D734E800CB62

Function 00800567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00800587

Strings

winapi, xrefs: 008005F8
stdcall, xrefs: 00800609
none, xrefs: 00800662
cdecl, xrefs: 008005DE

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: fe3b57eb235128aaf25be071e94e5b71ecbd2f69de200771c21dcf7c8af80b1f
Instruction ID: 5aec5623125ba8a3505365653b261dddc53648dbb095b95d1bbe1198ba471b6a
Opcode Fuzzy Hash: fe3b57eb235128aaf25be071e94e5b71ecbd2f69de200771c21dcf7c8af80b1f
Instruction Fuzzy Hash: 4B31AD7060021AEBCB10EF94CC41AEEB3B5FF56314F008629E826A77D1DB76A915CB90

Function 007DB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 007DB88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 007DB8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 007DB8D1

Strings

ListBox, xrefs: 007DB84D
ComboBox, xrefs: 007DB815

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: be0d31d5f05dd2ec33c3c53bd42aea025af7cd004c20d6c4200f82a4f90721aa
Instruction ID: 42eeb03cd3309a00592539908f4f93659e09388837fe5714f707f17823238edd
Opcode Fuzzy Hash: be0d31d5f05dd2ec33c3c53bd42aea025af7cd004c20d6c4200f82a4f90721aa
Instruction Fuzzy Hash: 3821E4B5900204FFD7149B64DC8ADFE7778EF56350B11422AF421A72E0DB7C5D0A97A0

Function 007F43E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007F4401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007F4427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 007F4457
InternetCloseHandle.WININET(00000000), ref: 007F449E

Part of subcall function 007F5052: GetLastError.KERNEL32(?,?,007F43CC,00000000,00000000,00000001), ref: 007F5067

Strings

, xrefs: 007F4450

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 5dce64c02b64aa3827b7739ad327bb21befcaf6b927347f72f98d23ef838e5b2
Instruction ID: ef0d3a75520544d8739e06fdfb3824b60c21530dfdbec771d8299826362f5596
Opcode Fuzzy Hash: 5dce64c02b64aa3827b7739ad327bb21befcaf6b927347f72f98d23ef838e5b2
Instruction Fuzzy Hash: D12150B250020CBFE7219F64CC85EBB7AECFB49758F10851AF605E6240DA689D059771

Function 008090E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007BD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007BD1BA
Part of subcall function 007BD17C: GetStockObject.GDI32(00000011), ref: 007BD1CE
Part of subcall function 007BD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 007BD1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0080915C
LoadLibraryW.KERNEL32(?), ref: 00809163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00809178
DestroyWindow.USER32(?), ref: 00809180

Strings

SysAnimate32, xrefs: 00809137

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3bb6388a1dd91d5aa6d954985657b9dc38c4eed9b7b105ef441f41ce3556ff9f
Instruction ID: eeed19ddcf81bba88f3051c843eee7ee2a72247da929f640a7ec74eeb311c890
Opcode Fuzzy Hash: 3bb6388a1dd91d5aa6d954985657b9dc38c4eed9b7b105ef441f41ce3556ff9f
Instruction Fuzzy Hash: 99218B7120020ABBEF604E64DC88EBB37A9FF99364F114619F994D21D2D775DC42A760

Function 007E9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007E9588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007E95B9
GetStdHandle.KERNEL32(0000000C), ref: 007E95CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 007E9605

Strings

nul, xrefs: 007E9600

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: dcac4a29503ce7afbe741957ecc8787174b0c4beea66bd1ef521a7da82ec1598
Instruction ID: d5046067a4605d714ffd1d4716b40f30fc4db82f19d903d14234808300be7772
Opcode Fuzzy Hash: dcac4a29503ce7afbe741957ecc8787174b0c4beea66bd1ef521a7da82ec1598
Instruction Fuzzy Hash: 36218172501345ABDB219F2ADC05A9A7BB4FF49720F204A19FEA1D72D0D774E951CB10

Function 007E9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007E9653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007E9683
GetStdHandle.KERNEL32(000000F6), ref: 007E9694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 007E96CE

Strings

nul, xrefs: 007E96C9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: ce0b218c148fbe4d6c3e21201821c24198b183135991d27808c1c38690fd02d7
Instruction ID: 6d44073ea21a23323dc56dd106455cb9f9345ff16cec1e1b0a214b1e970c802e
Opcode Fuzzy Hash: ce0b218c148fbe4d6c3e21201821c24198b183135991d27808c1c38690fd02d7
Instruction Fuzzy Hash: A821AF726013459BDB209F6A8C04E9AB7F8FF49724F204A1AFEA1E72D1E7749841CB50

Function 007EDAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007EDB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 007EDB5E
__swprintf.LIBCMT ref: 007EDB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,0083DC00), ref: 007EDBB5

Strings

%lu, xrefs: 007EDB71

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: d6abea538b4bd2d748fd3ef5b6d0d1036e8f969c49d303f36b8f8ecc32073986
Instruction ID: b005c3d112111e2039369adb81a0ef75d667258952f8861827af54834050993f
Opcode Fuzzy Hash: d6abea538b4bd2d748fd3ef5b6d0d1036e8f969c49d303f36b8f8ecc32073986
Instruction Fuzzy Hash: 79217175A00248EFCB10EB65C985EAEBBB8FF89704B004069F505D7251DB75EA01CB61

Function 007DC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007DC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 007DC84A
Part of subcall function 007DC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 007DC85D
Part of subcall function 007DC82D: GetCurrentThreadId.KERNEL32 ref: 007DC864
Part of subcall function 007DC82D: AttachThreadInput.USER32(00000000), ref: 007DC86B

GetFocus.USER32 ref: 007DCA05

Part of subcall function 007DC876: GetParent.USER32(?), ref: 007DC884

GetClassNameW.USER32(?,?,00000100), ref: 007DCA4E
EnumChildWindows.USER32(?,007DCAC4), ref: 007DCA76
__swprintf.LIBCMT ref: 007DCA90

Strings

%s%d, xrefs: 007DCA8A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: 47fe6f7ca4b97dd50a503f418ee515fa2e609bdb6e8b2d96f44faad50626befb
Instruction ID: 01a4729cd4eb251cc53b13c32f7f18a9a0d920b0e796d7257c9a01b9eada1ff2
Opcode Fuzzy Hash: 47fe6f7ca4b97dd50a503f418ee515fa2e609bdb6e8b2d96f44faad50626befb
Instruction Fuzzy Hash: 0B11B775500206BBCB12BF508C89FA93B79AF85710F048066FD08AA282CB789546DB71

Function 00801945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 008019F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00801A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00801B49
CloseHandle.KERNEL32(?), ref: 00801BBF

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 2def41fc6239084d169d076419c610d80843fde5e3f62e35ca76ae7659af966f
Instruction ID: 94205eabe48b1d4ac20f64e3bb3520c79285c711ed0a5161ee760f160c40a9ed
Opcode Fuzzy Hash: 2def41fc6239084d169d076419c610d80843fde5e3f62e35ca76ae7659af966f
Instruction Fuzzy Hash: 91814271600214EBDF119F64CC9ABAEBBE5FF48720F148459F905AF3C2D7B9A9418B90

Function 007E1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007E1CB4
VariantClear.OLEAUT32(00000013), ref: 007E1D26
VariantClear.OLEAUT32(00000000), ref: 007E1D81
VariantClear.OLEAUT32(?), ref: 007E1DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 007E1E26

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 2fc14ba80d6ebdc937b006a644a9d8624b8709ef55bcaa82689fc5f3b7874a55
Instruction ID: 65924349fa25f57007755e85a9bc234e1ec23791987337220dbfaf58b58cd412
Opcode Fuzzy Hash: 2fc14ba80d6ebdc937b006a644a9d8624b8709ef55bcaa82689fc5f3b7874a55
Instruction Fuzzy Hash: E45158B5A00249EFDB24CF58C884AAAB7B8FF4C314B158559ED59DB305E334EA51CFA0

Function 00800688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 008006EE
GetProcAddress.KERNEL32(00000000,?), ref: 0080077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 0080079B
GetProcAddress.KERNEL32(00000000,?), ref: 008007E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 008007FB

Part of subcall function 007BE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,007EA574,?,?,00000000,00000008), ref: 007BE675
Part of subcall function 007BE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,007EA574,?,?,00000000,00000008), ref: 007BE699

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 6db0106180d881866e88b592675d4a93380a298b6a340f51d453e666a9ef968e
Instruction ID: a38a52de3cc53ee47f1258cb391d96c2b466b3ca6b48580d795f6a255a76ff98
Opcode Fuzzy Hash: 6db0106180d881866e88b592675d4a93380a298b6a340f51d453e666a9ef968e
Instruction Fuzzy Hash: 21513875A00209DFCB10EFA8C885AADB7B5FF49310F148155EA16AB392DB35ED42CF50

Function 00802E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00803C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00802BB5,?,?), ref: 00803C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00802EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00802F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00802F75
RegCloseKey.ADVAPI32(?,?), ref: 00802FA1
RegCloseKey.ADVAPI32(00000000), ref: 00802FAE

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: 480f4129d22fdfde90081828cf986b317170f195c8c07e7b99f77c415318c1ae
Instruction ID: af5d083c46c91788fa9208d302b3a9c73fc53579dce9be31f8c67f99e894e48c
Opcode Fuzzy Hash: 480f4129d22fdfde90081828cf986b317170f195c8c07e7b99f77c415318c1ae
Instruction Fuzzy Hash: D5515772208205EFD715EB64CC89E6ABBF8FF88304F00891DF596972A1DB75E905CB52

Function 0080CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c252ff541039b58c27d25a81270d59388b46f571942c51d6fa635ac8417913e0
Instruction ID: 589b46d822494cc270bdbdeda5584f62f97d09069b5053dd4aa1f6ae903a87a5
Opcode Fuzzy Hash: c252ff541039b58c27d25a81270d59388b46f571942c51d6fa635ac8417913e0
Instruction Fuzzy Hash: E4418E79900209AFDBA0DF68CC58FA9BF68FB09310F154365FD5AE72E1C770AD419A90

Function 007F1206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007F12B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007F12DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 007F131C

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 007F1341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 007F1349

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 7357d976680c763b090bd6d0a657aca02e891271166645743363d5c58ccb9428
Instruction ID: 70495d14eac2159525eb4f6e38e08d0fbc8e52e1a2da65f2572b67ae6bfcbaf5
Opcode Fuzzy Hash: 7357d976680c763b090bd6d0a657aca02e891271166645743363d5c58ccb9428
Instruction Fuzzy Hash: A7411C35600209DFCF01EF64C985AAEBBF5FF49314B148095E906AB362CB35ED11DB61

Function 007BB63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 007BB64F
ScreenToClient.USER32(00000000,000000FF), ref: 007BB66C
GetAsyncKeyState.USER32(00000001), ref: 007BB691
GetAsyncKeyState.USER32(00000002), ref: 007BB69F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 2783ab110b64e57bc26a8741f20eb6f386cd60ae2497d8cc663f3a13632821dc
Instruction ID: c7bc19acdf2ef6348cfef1fc81b54535dca84ad7fab340d4b0ce234a467e60bf
Opcode Fuzzy Hash: 2783ab110b64e57bc26a8741f20eb6f386cd60ae2497d8cc663f3a13632821dc
Instruction Fuzzy Hash: 1D416D71504219FBCF159F68C844BE9BBB4FF05328F20431AF86996290CB74AE94DF91

Function 007DB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007DB369
PostMessageW.USER32(?,00000201,00000001), ref: 007DB413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 007DB41B
PostMessageW.USER32(?,00000202,00000000), ref: 007DB429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 007DB431

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: c2d5f17a3f61f7faff438e944f2890883647e65572bf775fb0355a23a02646a3
Instruction ID: fbfc23a0410e6ea4686608b87add997bd5bdae63021ddb49480a4635b690c942
Opcode Fuzzy Hash: c2d5f17a3f61f7faff438e944f2890883647e65572bf775fb0355a23a02646a3
Instruction Fuzzy Hash: 9C31CEB1900219EBEF14CFA8D94DA9E7BB5FB04315F11822AF921AA2D1C3B49915DB90

Function 007DDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 007DDBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 007DDBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 007DDC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 007DDC52
_wcsstr.LIBCMT ref: 007DDC5C

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: f54a625a27151e5f01dd28cb35015deb58a927689f55d33a1d0ff9e86104d064
Instruction ID: 7be11f27ba808091c429feb7e89946fc8a59d49d98d867483995a435fbacda2f
Opcode Fuzzy Hash: f54a625a27151e5f01dd28cb35015deb58a927689f55d33a1d0ff9e86104d064
Instruction Fuzzy Hash: 3921A772214244BFEB355B399C49F7B7BB8EF45750F10803AF80DDA291EAA9DC41D6A0

Function 007DBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007DBC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007DBCC2
__itow.LIBCMT ref: 007DBCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007DBD00
__itow.LIBCMT ref: 007DBD11

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: f74c1d5de1ff31fd9708badbb7d8ea368e0846cee565d91b63985285db60e802
Instruction ID: 79833abee0781032dc3c553aa2fad450769a9605fa58b75afe2fd2d804844db5
Opcode Fuzzy Hash: f74c1d5de1ff31fd9708badbb7d8ea368e0846cee565d91b63985285db60e802
Instruction Fuzzy Hash: 1121F975700308FADB20AA649C49FDE7B79FF9A310F11406AF905EB382DB68890583A1

Function 007E6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 007A50E6: _wcsncpy.LIBCMT ref: 007A50FA

GetFileAttributesW.KERNEL32(?,?,?,?,007E60C3), ref: 007E6369
GetLastError.KERNEL32(?,?,?,007E60C3), ref: 007E6374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007E60C3), ref: 007E6388
_wcsrchr.LIBCMT ref: 007E63AA

Part of subcall function 007E6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007E60C3), ref: 007E63E0

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: f2b4edef2b224c4dd2e94db87ced7b1f22ccdd9f6632ea852d2391d45d1d2226
Instruction ID: 0168527e8217679dd6d3abc57743f3f7c6a5c405ead43222bd8e3045b2653a04
Opcode Fuzzy Hash: f2b4edef2b224c4dd2e94db87ced7b1f22ccdd9f6632ea852d2391d45d1d2226
Instruction Fuzzy Hash: 1721C331506355DBDF25AB79AC4AFEA33ACFF2D3E0F10446AF045D3081EB68D9858A64

Function 007F8B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007FA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 007FA84E

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 007F8BD3
WSAGetLastError.WSOCK32(00000000), ref: 007F8BE2
connect.WSOCK32(00000000,?,00000010), ref: 007F8BFE

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 1c7518b48acbe9ab224144c6e1062bc06588ca02be3510c1aea91e9c61a421e5
Instruction ID: 6f70e4f346d494b5d6916fb0c669d6204a111d64d2d380df5310513fa0396ba2
Opcode Fuzzy Hash: 1c7518b48acbe9ab224144c6e1062bc06588ca02be3510c1aea91e9c61a421e5
Instruction Fuzzy Hash: 082193312002189FCB10AF68CC49F7E77A9FF48710F048559FA569B3D2CB78AC028761

Function 007F8420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 007F8441
GetForegroundWindow.USER32 ref: 007F8458
GetDC.USER32(00000000), ref: 007F8494
GetPixel.GDI32(00000000,?,00000003), ref: 007F84A0
ReleaseDC.USER32(00000000,00000003), ref: 007F84DB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: f7f7614340183d735ddfabe06aa81cea1831f07f9d978c4df484e855af339591
Instruction ID: 0ba7f89433aef8008efd30539ff6b11fb4d1c8c52dfca1d720e59ef24ba5603a
Opcode Fuzzy Hash: f7f7614340183d735ddfabe06aa81cea1831f07f9d978c4df484e855af339591
Instruction Fuzzy Hash: 83215E75A00204EFD750DFA4C989AAEBBE5FF48301F148469E95A97351DA74AD01CBA0

Function 007BAF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 007BAFE3
SelectObject.GDI32(?,00000000), ref: 007BAFF2
BeginPath.GDI32(?), ref: 007BB009
SelectObject.GDI32(?,00000000), ref: 007BB033

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 2b6a7009f4224fb3a72b63aa06210ce31d63dab4107b964dea7761e3d9cdaa16
Instruction ID: cb555533d560cce740725b72637508ed53a89ddc0c4491be1085bdbc26ac850b
Opcode Fuzzy Hash: 2b6a7009f4224fb3a72b63aa06210ce31d63dab4107b964dea7761e3d9cdaa16
Instruction Fuzzy Hash: DE21AFB4804309EFDF20AF54EC48BEA7B68FB20355F19521AF821921A1D3F48896CB90

Function 007C217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007C21A9
CreateThread.KERNEL32(?,?,007C22DF,00000000,?,?), ref: 007C21ED
GetLastError.KERNEL32 ref: 007C21F7
_free.LIBCMT ref: 007C2200
__dosmaperr.LIBCMT ref: 007C220B

Part of subcall function 007C7C0E: __getptd_noexit.LIBCMT ref: 007C7C0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 0cc57f3f478db159daee664344c0668e963bf0de93c5df8f9d5713d1b235793a
Instruction ID: 78e09797f64312e42eb90da581255f92f0d1ca0613a301c0812eb2bd1f41f17f
Opcode Fuzzy Hash: 0cc57f3f478db159daee664344c0668e963bf0de93c5df8f9d5713d1b235793a
Instruction Fuzzy Hash: 8011A573204306AF9B25AF69DC46F5B3B98FF05770B10442DF91486152EB79D8128AA1

Function 007DABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 007DABD7
GetLastError.KERNEL32(?,007DA69F,?,?,?), ref: 007DABE1
GetProcessHeap.KERNEL32(00000008,?,?,007DA69F,?,?,?), ref: 007DABF0
HeapAlloc.KERNEL32(00000000,?,007DA69F,?,?,?), ref: 007DABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 007DAC0E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 273003c16beb49742ea0a0e076d630e74c77661af09fdc224195d2b7312e74e4
Instruction ID: ff06496ece6b4821045792370609fe05c20b38af4b1d937da8dc2b643ee1a2f8
Opcode Fuzzy Hash: 273003c16beb49742ea0a0e076d630e74c77661af09fdc224195d2b7312e74e4
Instruction Fuzzy Hash: 2701F671210204BFDB214FA9DC48DAB7EBDFF8A765710442AF949D2260DA719C51CAB1

Function 007E7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007E7A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 007E7A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007E7A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 007E7A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007E7AD0

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ee3995544a1cba39a8a7dc099ed64c51a7e4c9455bca94b1700e6744cb8a6777
Instruction ID: 4ea9f083b2fa044aeea6c6f306368c272e05c829a792c9941aeb64962749d3f3
Opcode Fuzzy Hash: ee3995544a1cba39a8a7dc099ed64c51a7e4c9455bca94b1700e6744cb8a6777
Instruction Fuzzy Hash: 9B012931C05619EBDF14AFEADC88ADDBB78FF0C711F108465E502B2250DB389651C7A1

Function 007D9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 007D9ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 007D9AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 007D9B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 007D9B15
CLSIDFromString.OLE32(?,?), ref: 007D9B21

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: dc6060faf14c98a992549671242159341a062ba0fc0bc348926e6b31d46b3257
Instruction ID: 89738250859f28724e6d40ba9716df24ec58f780b0da1c582e9268aab1880cb0
Opcode Fuzzy Hash: dc6060faf14c98a992549671242159341a062ba0fc0bc348926e6b31d46b3257
Instruction Fuzzy Hash: 95018FB6610204FFDB204F54EC44B9A7EFDEB44361F158436FA05E2210D774DD019BA0

Function 007DAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007DAA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007DAA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007DAA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007DAA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007DAAAF

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c51417bd12649fb0be21c39668204ea3ae259819ef2269228615f5e3c60806b2
Instruction ID: 8af36bad8c05863b6bd2bedc50cf70f2cbd91d02b741f8ec3cb14f6084d0d996
Opcode Fuzzy Hash: c51417bd12649fb0be21c39668204ea3ae259819ef2269228615f5e3c60806b2
Instruction Fuzzy Hash: 47F03C712003047FEB215FA4EC89E677FBCFB89754B10851AF941C62A0DA649C42CA61

Function 007DAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 007DAADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 007DAAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007DAAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 007DAAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007DAB10

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 949e7f81274446652b8c3fa4bb6f9b961612e66ca75b2321284bbb96833abbdc
Instruction ID: eed1e86b216e5151c9ef8e0ac2acf2625a4e2ef176d9fedd06a8ebccaf620e14
Opcode Fuzzy Hash: 949e7f81274446652b8c3fa4bb6f9b961612e66ca75b2321284bbb96833abbdc
Instruction Fuzzy Hash: 73F04F712003087FEB210FA4EC88E673B7EFF45754F10442AF941C72A0DA6498138A71

Function 007DEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 007DEC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 007DECAB
MessageBeep.USER32(00000000), ref: 007DECC3
KillTimer.USER32(?,0000040A), ref: 007DECDF
EndDialog.USER32(?,00000001), ref: 007DECF9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 28fae805b8ddde0aff4bbac0d40029b92ad862a088afc22871eae96417eddf8b
Instruction ID: 19d3ef199341c9646ccb9a240b39054aba30aa121201dee015182d5f74596d67
Opcode Fuzzy Hash: 28fae805b8ddde0aff4bbac0d40029b92ad862a088afc22871eae96417eddf8b
Instruction Fuzzy Hash: 9001F430510704AFEB316B10DE5EB967BB8FF00B05F00465AB587A55E0DBF8AA85CB90

Function 007BB0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 007BB0BA
StrokeAndFillPath.GDI32(?,?,0081E680,00000000,?,?,?), ref: 007BB0D6
SelectObject.GDI32(?,00000000), ref: 007BB0E9
DeleteObject.GDI32 ref: 007BB0FC
StrokePath.GDI32(?), ref: 007BB117

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 7e5e15d39baa6a4878f740910040ac58df74c242f7cd2197f86a2f92187aaf30
Instruction ID: a55f93d6dafe3f91feaa910bc731e37f9248dfc270fc140c058eb5f5b08ab662
Opcode Fuzzy Hash: 7e5e15d39baa6a4878f740910040ac58df74c242f7cd2197f86a2f92187aaf30
Instruction Fuzzy Hash: 65F0C938008648EFDF219F69EC0D7A53F65B720362F099315E825850F2C7B58966DF54

Function 007EF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007EF2DA
CoCreateInstance.OLE32(0082DA7C,00000000,00000001,0082D8EC,?), ref: 007EF2F2
CoUninitialize.OLE32 ref: 007EF555

Strings

.lnk, xrefs: 007EF28B, 007EF290, 007EF29E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: a698de2fd4228a648ffd064cd8228b58bf5ddb93d6988cdaf4aaf3db555f3040
Instruction ID: 66d9011eb7babde4b7ac98fcba567981a14c99d423e2614cfb9ccaf061502d06
Opcode Fuzzy Hash: a698de2fd4228a648ffd064cd8228b58bf5ddb93d6988cdaf4aaf3db555f3040
Instruction Fuzzy Hash: 40A13BB1104201AFD301EF64C885EABB7E8EF99314F004A5DF55597292DB74EA4ACB62

Function 007EE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 007A660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007A53B1,?,?,007A61FF,?,00000000,00000001,00000000), ref: 007A662F

CoInitialize.OLE32(00000000), ref: 007EE85D
CoCreateInstance.OLE32(0082DA7C,00000000,00000001,0082D8EC,?), ref: 007EE876
CoUninitialize.OLE32 ref: 007EE893

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

Strings

.lnk, xrefs: 007EE83B, 007EE84D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 0fb84ad037be04f6ef220ab043846849f6e44e930dd982e49f2fffdcad86d3bb
Instruction ID: 659b1ff0f22c0124dbef5240a5a1a5fb8fe98f99e6f72f53453724262edc1779
Opcode Fuzzy Hash: 0fb84ad037be04f6ef220ab043846849f6e44e930dd982e49f2fffdcad86d3bb
Instruction Fuzzy Hash: C5A14635604341DFCB14DF15C88896ABBE5FF89310F058A58F9969B3A2CB39EC45CB92

Function 007C325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 007C32ED

Part of subcall function 007CE0D0: __87except.LIBCMT ref: 007CE10B

Strings

pow, xrefs: 007C32C5, 007C32E2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: c4a6ca6826c2fccbe0d709c33f063270c872cc8c09d37b9745c4c9ffea701c51
Instruction ID: 32805b688f0acba582e2eec9d997aa2c7fb91762572730fe60fe4ef2c29adadd
Opcode Fuzzy Hash: c4a6ca6826c2fccbe0d709c33f063270c872cc8c09d37b9745c4c9ffea701c51
Instruction Fuzzy Hash: A1515631A08605D7CB15AB14C945F7A2B98BB80720F34CD6CE4C6822E9EF3D8ED49A46

Function 007E4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0083DC50,?,0000000F,0000000C,00000016,0083DC50,?), ref: 007E4645

Part of subcall function 007A936C: __swprintf.LIBCMT ref: 007A93AB
Part of subcall function 007A936C: __itow.LIBCMT ref: 007A93DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 007E46C5

Strings

REMOVE, xrefs: 007E4676
THIS, xrefs: 007E4703

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 393cf79fa423e766b27358e9ba6d635f1fecbfadd5f443fc3d8a670889821c4b
Instruction ID: dafc0afdc01c0d9d6c9efc059f4c107a714abfdf990166908e8458979d886d55
Opcode Fuzzy Hash: 393cf79fa423e766b27358e9ba6d635f1fecbfadd5f443fc3d8a670889821c4b
Instruction Fuzzy Hash: 1441A474A00259DFCF01EFA5C885AAEB7B5FF4A304F148059E916AB392D738ED45CB90

Function 007DC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007DBC08,?,?,00000034,00000800,?,00000034), ref: 007E4335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 007DC1D3

Part of subcall function 007E42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007DBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 007E4300

Part of subcall function 007E422F: GetWindowThreadProcessId.USER32(?,?), ref: 007E425A
Part of subcall function 007E422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,007DBBCC,00000034,?,?,00001004,00000000,00000000), ref: 007E426A
Part of subcall function 007E422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,007DBBCC,00000034,?,?,00001004,00000000,00000000), ref: 007E4280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007DC240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007DC28D

Strings

@, xrefs: 007DC2A5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 9421b3849077c1e180a275776c610e18558c69b5796a44627c9b1b65bd2fb064
Instruction ID: 6d2c2de3aef6d2fc9bf6a7a946213dc25e62d4eb778fc35cb330569d2bafae9c
Opcode Fuzzy Hash: 9421b3849077c1e180a275776c610e18558c69b5796a44627c9b1b65bd2fb064
Instruction Fuzzy Hash: F6416A72901218BFDB11DFA4CD85AEEBBB8FF49300F104095FA45B7281DA756E45CBA1

Function 0080A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0083DC00,00000000,?,?,?,?), ref: 0080A6D8
GetWindowLongW.USER32 ref: 0080A6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0080A705

Strings

SysTreeView32, xrefs: 0080A6AA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 6a3da868589c358702c0b87815e068cc6fc7ceff1cddcbfaa6c2a909b39af256
Instruction ID: 128c44711ed3d6fc5a104dcdfc430b579938610fa1d0ac6865be888c3934eee5
Opcode Fuzzy Hash: 6a3da868589c358702c0b87815e068cc6fc7ceff1cddcbfaa6c2a909b39af256
Instruction Fuzzy Hash: BC31CD31200309ABDB658E38CC45BEA7BA9FB59324F248724F875D22E0C775EC518B90

Function 0080A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0080A15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 0080A172
SendMessageW.USER32(?,00001002,00000000,?), ref: 0080A196

Strings

SysMonthCal32, xrefs: 0080A129

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: a9a740758e623c69bbc64681a9fb714783a8e58c74f6e77921ddfc69e49b1be0
Instruction ID: c4ba7c7f3186617740b93e1bdf2cf18a27ce46df9303ced99340bde4c4af53e7
Opcode Fuzzy Hash: a9a740758e623c69bbc64681a9fb714783a8e58c74f6e77921ddfc69e49b1be0
Instruction Fuzzy Hash: DB218D32510218ABEF258FA4CC86FEA3B79FF48714F110214FA56AB1D0D6B5AC55CB90

Function 0080A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0080A941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0080A94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0080A956

Strings

msctls_updown32, xrefs: 0080A8BB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 6a5c3487fb9815e385afca2dfc65ad8ea087f7a898657bb81d9052b348c8d01f
Instruction ID: 659faed72e3a860911e2d79124e3fb6b7fb9f4205d54bddf2bb2f36f94c36f49
Opcode Fuzzy Hash: 6a5c3487fb9815e385afca2dfc65ad8ea087f7a898657bb81d9052b348c8d01f
Instruction Fuzzy Hash: E32195B5600209AFDB14DF68CC85D6737ADFF5A354B050059FA15DB3A1CB71EC118B61

Function 008099A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00809A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00809A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00809A65

Strings

Listbox, xrefs: 008099FD

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: d77b454986c7392ed5b7b248a53d839c28ca0b4339e6880c8b88c59deff451f2
Instruction ID: 01bcd24a203c4407c99dede9dcbd5cf494b8f0a2acaba4dacb9095d873d6385c
Opcode Fuzzy Hash: d77b454986c7392ed5b7b248a53d839c28ca0b4339e6880c8b88c59deff451f2
Instruction Fuzzy Hash: D521B072610118BFDF618F54CC85EBB3BAAFB89754F018128F9949B1E1C6719C5287A0

Function 0080A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0080A46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0080A482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0080A48F

Strings

msctls_trackbar32, xrefs: 0080A444

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 962818cd39a7f21da9c8d2475536ac51ecc744eb85c7a0ecff8382ff5bfd742f
Instruction ID: 48f6da30d91ca25c3365dc2d4479e0af0938354ce8715e7eb447c0abbc65be3b
Opcode Fuzzy Hash: 962818cd39a7f21da9c8d2475536ac51ecc744eb85c7a0ecff8382ff5bfd742f
Instruction Fuzzy Hash: 5811E775200308BEEF245F64CC49FAB3B69FF89754F014118FA45E60D1D2B6E811C724

Function 007C2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,007C2350,?), ref: 007C22A1
GetProcAddress.KERNEL32(00000000), ref: 007C22A8

Strings

RoInitialize, xrefs: 007C2290
combase.dll, xrefs: 007C229C

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 2a5f8cc6e34f372af39652bce26823ef7ddea72932f8cba937f7ac1c54c602e4
Instruction ID: 5e9dca6a8923ca14cc2b57a28cd9cb6ac8965c7860fe2e262cbf984c598ea1f9
Opcode Fuzzy Hash: 2a5f8cc6e34f372af39652bce26823ef7ddea72932f8cba937f7ac1c54c602e4
Instruction Fuzzy Hash: B8E01A706A0310ABDB645F70EC8AF163A64B701702F515428F102D61E0DBF98081CF08

Function 007C235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,007C2276), ref: 007C2376
GetProcAddress.KERNEL32(00000000), ref: 007C237D

Strings

combase.dll, xrefs: 007C2371
RoUninitialize, xrefs: 007C2365

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: cfc9201b3c229c897a206161d0db46f519203d6b3fe2089752a72655da1e9a70
Instruction ID: 70a73f94025c4908c6ea1111dcc6a0944c806bd57600330a534faa5daad56c26
Opcode Fuzzy Hash: cfc9201b3c229c897a206161d0db46f519203d6b3fe2089752a72655da1e9a70
Instruction Fuzzy Hash: 72E0BD70694300EFDB616F60ED4EF063AA4B721703F225428F20AEA1F0CBFD94518E18

Function 0081AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0081AC60
__swprintf.LIBCMT ref: 0081AC94

Strings

%.3d, xrefs: 0081AC6E
WIN_XPe, xrefs: 0081ACD3

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: a26c2d925b2ffa202bdb02c61c0102a580f76d55723b17ee9e17b7837f2cf2be
Instruction ID: 041d3ae322c5526660b598a7d2fafd08727f73eed0d90044c06465cd5544151f
Opcode Fuzzy Hash: a26c2d925b2ffa202bdb02c61c0102a580f76d55723b17ee9e17b7837f2cf2be
Instruction Fuzzy Hash: 22E0127180561CDBCB24D750CD05DF9737CFF04745F5000D2F906E1104E639ABC8AA52

Function 00802205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,008021FB,?,008023EF), ref: 00802213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00802225

Strings

GetProcessId, xrefs: 0080221F
kernel32.dll, xrefs: 0080220E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: e0b7037d1a7c591a475134d8c2b3b56e12d560cfe4a2a15df93eeb0bd45d3efd
Instruction ID: d1f19ac69a6c984ac3bdc93fda8c09e609b56ed7c69fd609f9653da0077b2002
Opcode Fuzzy Hash: e0b7037d1a7c591a475134d8c2b3b56e12d560cfe4a2a15df93eeb0bd45d3efd
Instruction Fuzzy Hash: FFD0A734400712AFD7314F70FC0C641FAD4FB05305B11D419ECA2E2690EBB4D8888650

Function 007A42F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,007A42EC,?,007A42AA,?), ref: 007A4304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007A4316

Strings

Wow64RevertWow64FsRedirection, xrefs: 007A4310
kernel32.dll, xrefs: 007A42FF

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 833f0b32af3f61ed0f23f70729d112a64ea6b9d8d0a90f22753242cb21d4daab
Instruction ID: b9f1338a3fc8153a7078c6d1cebaac0525c1287178b6001093820ecf4239407b
Opcode Fuzzy Hash: 833f0b32af3f61ed0f23f70729d112a64ea6b9d8d0a90f22753242cb21d4daab
Instruction Fuzzy Hash: 1CD0A7704007129FDF304F24E80C645BAE4FB46302B10C419E851E2660DBF8C8848610

Function 007A434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,007A41BB,007A4341,?,007A422F,?,007A41BB,?,?,?,?,007A39FE,?,00000001), ref: 007A4359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007A436B

Strings

kernel32.dll, xrefs: 007A4354
Wow64DisableWow64FsRedirection, xrefs: 007A4365

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 319e1840105bf985da05df54c43e9ae30ef73c08945a2be21de1835da1d24623
Instruction ID: bc73d60629d65e9ffdc6975e2aa7de5f538f6a98f18577f572eac85a5da30715
Opcode Fuzzy Hash: 319e1840105bf985da05df54c43e9ae30ef73c08945a2be21de1835da1d24623
Instruction Fuzzy Hash: 45D0A770400712AFDB308F30E808641BAD4FB53716B20C519E891E2650DBF8D8848A10

Function 007E0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,007E052F,?,007E06D7), ref: 007E0572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 007E0584

Strings

oleaut32.dll, xrefs: 007E056D
UnRegisterTypeLibForUser, xrefs: 007E057E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 5bd9a831d9586edccc64b1880f8b4e0adbe309fc2149c7c9288582b6b7a81466
Instruction ID: 57cedb2910119c68750d49291775a5e72f020eefd141ebb14a4eab7a4ef505e3
Opcode Fuzzy Hash: 5bd9a831d9586edccc64b1880f8b4e0adbe309fc2149c7c9288582b6b7a81466
Instruction Fuzzy Hash: 5BD05E304017129AD7305F21A808A42BBE4BB0A301B10C429EC91D2650DEB8C4D48A60

Function 007E0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,007E051D,?,007E05FE), ref: 007E0547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 007E0559

Strings

RegisterTypeLibForUser, xrefs: 007E0553
oleaut32.dll, xrefs: 007E0542

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: 8ca703974f49f751dda2bbe009f2f401c4f6ff8b2cd1dd48f12a7be6cf331c7b
Instruction ID: 7ab7ce648dd848efb84c6bacf4adc171acf45bf025d8e6e9b2dcd4d2e99e145f
Opcode Fuzzy Hash: 8ca703974f49f751dda2bbe009f2f401c4f6ff8b2cd1dd48f12a7be6cf331c7b
Instruction Fuzzy Hash: 1DD0C7745457129FD7309F65F808A41BBE4FB15712B10C85DE856D2650DEB8C8D58A50

Function 007FECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007FECBE,?,007FEBBB), ref: 007FECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 007FECE8

Strings

GetSystemWow64DirectoryW, xrefs: 007FECE2
kernel32.dll, xrefs: 007FECD1

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: dd15cdb0bdfb1e5a2a44f33e467119b7ac5fff87d747c8d3757ecee75a87118a
Instruction ID: 091dc5df7ea9a868ea31fe4bdb37d8bfc240c80aa3c4496da7e1975237ffe6b7
Opcode Fuzzy Hash: dd15cdb0bdfb1e5a2a44f33e467119b7ac5fff87d747c8d3757ecee75a87118a
Instruction Fuzzy Hash: 1FD0A7304007239FDB305F60E848652BAE4FB00701B10C41AFC65D2761DF78C884C630

Function 007FBADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,007FBAD3,00000001,007FB6EE,?,0083DC00), ref: 007FBAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 007FBAFD

Strings

GetModuleHandleExW, xrefs: 007FBAF7
kernel32.dll, xrefs: 007FBAE6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f5156b6a532ecbac91bf2ee1d0fe4088d95930de5629f1cda9bfaf595ebf0574
Instruction ID: a5f2820a10ec9a622fa3859717e8e1cab0a008cf3ab69da49a56eeb7b76624a5
Opcode Fuzzy Hash: f5156b6a532ecbac91bf2ee1d0fe4088d95930de5629f1cda9bfaf595ebf0574
Instruction Fuzzy Hash: 07D0A7708007129FD7305F20EC48F62BAD4FB00341B10C419ED53D2750DB78C884CA10

Function 00803BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00803BD1,?,00803E06), ref: 00803BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00803BFB

Strings

advapi32.dll, xrefs: 00803BE4
RegDeleteKeyExW, xrefs: 00803BF5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 609d2667632b06ccf301ba0f88fc8ec5420ae5713a6e26bc3ccf9f377d17e04c
Instruction ID: 7fa304b29b189813e8c40b70fe38847cc0928705449cc5dab4bd4577cd5e36a3
Opcode Fuzzy Hash: 609d2667632b06ccf301ba0f88fc8ec5420ae5713a6e26bc3ccf9f377d17e04c
Instruction Fuzzy Hash: 23D05E704007129AE7605B62AC08643BEF8FB11319B108419E855E2690D6B4C4848A10

Function 007D9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7e6646adcf77554d25a469c98bd0f2e2564cfcb2302c7ed4d7f2db02d1cdda
Instruction ID: bf1fbe8fcb1af0a97adb38a285201e5656576ef85020cefed63f7e2236d71bdf
Opcode Fuzzy Hash: ba7e6646adcf77554d25a469c98bd0f2e2564cfcb2302c7ed4d7f2db02d1cdda
Instruction Fuzzy Hash: ABC16D75A1021AEFCB14DFA4C884AAEB7B5FF48710F10459AEA05EB351D734EE41DBA0

Function 007FAA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007FAAB4
CoUninitialize.OLE32 ref: 007FAABF

Part of subcall function 007E0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 007E027B

VariantInit.OLEAUT32(?), ref: 007FAACA
VariantClear.OLEAUT32(?), ref: 007FAD9D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 4a1c24678a2bf5286d327106a0865a9a4501da99f37b530531e582b48d60b2e7
Instruction ID: 3e53ad5e61fa622bba70f55696866920f5c6053f02bf5c416b20c4fd3689b87c
Opcode Fuzzy Hash: 4a1c24678a2bf5286d327106a0865a9a4501da99f37b530531e582b48d60b2e7
Instruction Fuzzy Hash: D7A16BB5204705EFCB10DF14C485B6AB7E4BF89710F148549FA9A9B3A2CB38ED44CB96

Function 007D91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007D91DD
SysAllocString.OLEAUT32(?), ref: 007D9286
VariantCopy.OLEAUT32 ref: 007D92B5
VariantClear.OLEAUT32(?), ref: 007D92DC

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: bdad94369c8cfc66903512fd80e709bd329ddd7bd768ded8057c7079981cf2ad
Instruction ID: a4ed908b37b919c83288ac457b192ab23d3af517737a37028ca61f6646db7963
Opcode Fuzzy Hash: bdad94369c8cfc66903512fd80e709bd329ddd7bd768ded8057c7079981cf2ad
Instruction Fuzzy Hash: D0517130604306EBDB24AF69D895B6EB7F5AF45310F20881FE646DB3D1EB78D8408715

Function 0080C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01326FC8,?), ref: 0080C544
ScreenToClient.USER32(?,00000002), ref: 0080C574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0080C5DA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 12ba27ed7d208cebc520c941a73df2b87fbdd2816a0546419cef460a2b914755
Instruction ID: 7a216f0c2fc763e95a31eb1ead88a3c9dff7ac7fdec2a8a92af6551f92efbd7d
Opcode Fuzzy Hash: 12ba27ed7d208cebc520c941a73df2b87fbdd2816a0546419cef460a2b914755
Instruction Fuzzy Hash: F8516975A00204EFCF60CF68CC85AAE7BB6FB65320F208259F865DB291D770AD41CB90

Function 007DC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 007DC462
__itow.LIBCMT ref: 007DC49C

Part of subcall function 007DC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 007DC753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 007DC505
__itow.LIBCMT ref: 007DC55A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 8889110ef05a6f8e5abd0c50758dc062557a74d9a922ccee978ded8dcd637667
Instruction ID: 3223bdc1e41454eb9bdba3304d8879cac6268d97ff4be2615aba7bfc87ff0ae7
Opcode Fuzzy Hash: 8889110ef05a6f8e5abd0c50758dc062557a74d9a922ccee978ded8dcd637667
Instruction Fuzzy Hash: 1941D671600209EFDF22DF54D855FEE7BB9AF89700F00005AF906A7382DB789A55CBA1

Function 007E390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 007E3966
SetKeyboardState.USER32(00000080,?,00000001), ref: 007E3982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 007E39EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 007E3A4D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2a245b9bb3b1e89fbe344c38bf7a5a1698aef48cbcc3524816f46f6ce6a1638d
Instruction ID: 0a5fa77ce17d13d94ccd706b6beb2b2ab4115f318e78e7cc93dd491b0eb0c371
Opcode Fuzzy Hash: 2a245b9bb3b1e89fbe344c38bf7a5a1698aef48cbcc3524816f46f6ce6a1638d
Instruction Fuzzy Hash: 10413C70A06298AAEF308B66880DBFDBBB9AB4D314F04415AF4C1531C2C7BC9E85D765

Function 007EE698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 007EE742
GetLastError.KERNEL32(?,00000000), ref: 007EE768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007EE78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007EE7B9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 23cb62cfd55111da3db8174cce0d4cabb710669af8a940041e899cb218c298c0
Instruction ID: c871e85a839e792374b65fe1edf5d1e4816b38adbc970ce2c7f35e3351e57b3c
Opcode Fuzzy Hash: 23cb62cfd55111da3db8174cce0d4cabb710669af8a940041e899cb218c298c0
Instruction Fuzzy Hash: 65412B35600650DFCF11EF15C448A4DBBF5BF9A710B198498EA46AB3A2CB38FD41CB92

Function 0080B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0080B5D1

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 9cc36a67c0dfa1fd105bbae54cff4f9c88b7b4d89690038d7682d111d6525b9b
Instruction ID: 69b60ee0d66f14850cc94758285560f7c952f7ed3cd196d7d2af506a5cfaef0e
Opcode Fuzzy Hash: 9cc36a67c0dfa1fd105bbae54cff4f9c88b7b4d89690038d7682d111d6525b9b
Instruction Fuzzy Hash: A731C074601208BFEFB09F58CC89FA87B65FB25314F648551FA61D72E2C731A9409B51

Function 0080D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0080D807
GetWindowRect.USER32(?,?), ref: 0080D87D
PtInRect.USER32(?,?,0080ED5A), ref: 0080D88D
MessageBeep.USER32(00000000), ref: 0080D8FE

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 16d2339f528de33f2dbe55bbffdc10d13b24edc7d7bd57735f0fb42ee8656bb4
Instruction ID: ad49bcce1f7fcbaca0136d8d63f5ca23d9a7b3bd553e37ff139405ecfa944894
Opcode Fuzzy Hash: 16d2339f528de33f2dbe55bbffdc10d13b24edc7d7bd57735f0fb42ee8656bb4
Instruction Fuzzy Hash: 51417774A00319DFDB61DF98C884AA97BB5FB48314F1985B9E815CB2A1D730E942CB50

Function 007E3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 007E3AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 007E3AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 007E3B34
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 007E3B92

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: be453990090d05496f160e41ca2c4f0d03a2b12abc3d414542c2ec7c3288f3b0
Instruction ID: 50f06bbb695d4f0c3a7ba2552b8500bf2cf90e9267e5595b22f241354b48e440
Opcode Fuzzy Hash: be453990090d05496f160e41ca2c4f0d03a2b12abc3d414542c2ec7c3288f3b0
Instruction Fuzzy Hash: 0F3109B0A022D8AEEF308B66881DBFD7BB99B5D314F04015AE482971D1C77D8F46C761

Function 007D4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 007D4038
__isleadbyte_l.LIBCMT ref: 007D4066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 007D4094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 007D40CA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 052d98dd1f2d17c31969fbb34d526e7bd4ff043f28eeb888fe9d11358470ac4a
Instruction ID: bfe73eb02bc1621ea860696b98425e57d17361ddd0915482cf45d6f2add50572
Opcode Fuzzy Hash: 052d98dd1f2d17c31969fbb34d526e7bd4ff043f28eeb888fe9d11358470ac4a
Instruction Fuzzy Hash: E331F331600206EFDF21DF34C845BBA7BB5FF41310F1980AAE6619B2A1E739D891DB90

Function 00807CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00807CB9

Part of subcall function 007E5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 007E5F6F
Part of subcall function 007E5F55: GetCurrentThreadId.KERNEL32 ref: 007E5F76
Part of subcall function 007E5F55: AttachThreadInput.USER32(00000000,?,007E781F), ref: 007E5F7D

GetCaretPos.USER32(?), ref: 00807CCA
ClientToScreen.USER32(00000000,?), ref: 00807D03
GetForegroundWindow.USER32 ref: 00807D09

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: c50497e314613025ca20c4b114817235792ce7afba9fb82ce38d2b11eefd3f9b
Instruction ID: ecdb132874788bd86565916244c726bcce5e5487f99593fbf154e0c25b345ba0
Opcode Fuzzy Hash: c50497e314613025ca20c4b114817235792ce7afba9fb82ce38d2b11eefd3f9b
Instruction Fuzzy Hash: 0F31FF72D00108AFDB11EFA5DC859EFBBF9EF58314B108466E815E7211DA35AE058BA0

Function 0080F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

GetCursorPos.USER32(?), ref: 0080F211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0081E4C0,?,?,?,?,?), ref: 0080F226
GetCursorPos.USER32(?), ref: 0080F270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0081E4C0,?,?,?), ref: 0080F2A6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: cc4fd74ac2841daffdd87f57bf4188226293d41965c0e6fb7861b21e5af3796a
Instruction ID: 9270e89adae09fde1f634a4b7a43faf5870fa755de32ead2c2f31e39b2bd7f07
Opcode Fuzzy Hash: cc4fd74ac2841daffdd87f57bf4188226293d41965c0e6fb7861b21e5af3796a
Instruction Fuzzy Hash: A0217C39601118FFCB658F94CC58EEA7BB9FF09710F088069FA058B6A2D3749951DBA0

Function 007F431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007F4358

Part of subcall function 007F43E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007F4401
Part of subcall function 007F43E2: InternetCloseHandle.WININET(00000000), ref: 007F449E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 0c126b0bcc9dee58af566dfc01f716d0dedb55502501c1e27db07c289bca179c
Instruction ID: f2bf5673807a5b51978c36e661ade13781a9eb199baa4f60d3d14ffb6a1c3584
Opcode Fuzzy Hash: 0c126b0bcc9dee58af566dfc01f716d0dedb55502501c1e27db07c289bca179c
Instruction Fuzzy Hash: A021A131200709BFEB219F60DC00FBBBBA9FF44710F10801ABB15A6750DB799821AB90

Function 007F8A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 007F8AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 007F8AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 007F8AFF
WSAGetLastError.WSOCK32(00000000), ref: 007F8B16

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 2a98703ee3efdb34d2bd612228527a7b6b0980368b35fcf9ac118fdb48ef31eb
Instruction ID: eb7cb6bc38a1cb4458fb3416fca7d6a138f9d9587c77d0bc6b083a05acda7c44
Opcode Fuzzy Hash: 2a98703ee3efdb34d2bd612228527a7b6b0980368b35fcf9ac118fdb48ef31eb
Instruction Fuzzy Hash: 41216672A001249FC7619F69CC85AAE7FECFF49350F008169F949D7291DB7899418F90

Function 00808A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00808AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00808AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00808ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00808ADC

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 99abb4fea956e07ea3b5ed3b795d39e88018c64f3bdd0bc5722333afca90879f
Instruction ID: 3769d365ba5a942258b560452fe9c3f10868a7284a90dbee485a0a1b5c6000c1
Opcode Fuzzy Hash: 99abb4fea956e07ea3b5ed3b795d39e88018c64f3bdd0bc5722333afca90879f
Instruction Fuzzy Hash: 2711AF31305125EFD754AB18CC09FAE7799FF86320F148119F856C72E2CB78AC418795

Function 007E0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,007E0ABB,?,?,?,007E187A,00000000,000000EF,00000119,?,?), ref: 007E1E77
Part of subcall function 007E1E68: lstrcpyW.KERNEL32(00000000,?,?,007E0ABB,?,?,?,007E187A,00000000,000000EF,00000119,?,?,00000000), ref: 007E1E9D
Part of subcall function 007E1E68: lstrcmpiW.KERNEL32(00000000,?,007E0ABB,?,?,?,007E187A,00000000,000000EF,00000119,?,?), ref: 007E1ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,007E187A,00000000,000000EF,00000119,?,?,00000000), ref: 007E0AD4
lstrcpyW.KERNEL32(00000000,?,?,007E187A,00000000,000000EF,00000119,?,?,00000000), ref: 007E0AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,007E187A,00000000,000000EF,00000119,?,?,00000000), ref: 007E0B2E

Strings

cdecl, xrefs: 007E0B25

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: b57fcfcdc554eb31ae586afd1eba48aec851e59be37384116d30fe26cbb9e60b
Instruction ID: 62be436813b29bdba9aeb5499bc16a7141c4b64f661809a09a7924fc25d5b958
Opcode Fuzzy Hash: b57fcfcdc554eb31ae586afd1eba48aec851e59be37384116d30fe26cbb9e60b
Instruction Fuzzy Hash: 7711D376201345EFDB25AF35DC09E7A77A9FF49314B80806AF806CB250EBB59891C7E0

Function 007D2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007D2FB5

Part of subcall function 007C395C: __FF_MSGBANNER.LIBCMT ref: 007C3973
Part of subcall function 007C395C: __NMSG_WRITE.LIBCMT ref: 007C397A
Part of subcall function 007C395C: RtlAllocateHeap.NTDLL(01300000,00000000,00000001,00000001,00000000,?,?,007BF507,?,0000000E), ref: 007C399F

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a8d9c8242896b3ae8d3e974c27c523812204903c840b0e0d1cce5e4e0e65ae40
Instruction ID: d82ad6e8fe5e76bc9bd3903fec17c22098503fd69827d9f1b444a2f49b6dc0fd
Opcode Fuzzy Hash: a8d9c8242896b3ae8d3e974c27c523812204903c840b0e0d1cce5e4e0e65ae40
Instruction Fuzzy Hash: 1E11AB32509212DBDB353B70AC49B5A3FB9AF14361F20492EF8499A352DE7CC941DAA1

Function 007BEB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007BEBB2

Part of subcall function 007A51AF: _memset.LIBCMT ref: 007A522F
Part of subcall function 007A51AF: _wcscpy.LIBCMT ref: 007A5283
Part of subcall function 007A51AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 007A5293

KillTimer.USER32(?,00000001,?,?), ref: 007BEC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007BEC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00813C88

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: b17836e91d902087e808cf933f6148b3d056e39ee1945425a88733fb3e51a596
Instruction ID: 28d238ff7f164dbc2874224a88fc9ee4b7dc4a7a70d41b4a783e248f5e4f7c38
Opcode Fuzzy Hash: b17836e91d902087e808cf933f6148b3d056e39ee1945425a88733fb3e51a596
Instruction Fuzzy Hash: 7921AA705047949FE7329728C859BE7FFECEF05308F04044DE69AA6242C3742A85CB91

Function 007E058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 007E05AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 007E05C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007E05DD
FreeLibrary.KERNEL32(?), ref: 007E0632

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: c33e1feff471d368c1839a109fdcc48cf6e99d4989dea792879910c8bd78701f
Instruction ID: b499d90ac907026f60b07ed2a2a8c2b3220d6cd7edd67734cdcd008325eab05b
Opcode Fuzzy Hash: c33e1feff471d368c1839a109fdcc48cf6e99d4989dea792879910c8bd78701f
Instruction Fuzzy Hash: 8D21A271901358EFDB208F92DC88BDABBB8FF44300F008469E51692050D7B8EA95DF90

Function 007E6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 007E6733
_memset.LIBCMT ref: 007E6754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007E67A6
CloseHandle.KERNEL32(00000000), ref: 007E67AF

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: f7b84eedf3cad43fa58e1ce8a50d185e4e62407366eccf41e2d03db078b38b36
Instruction ID: cd8a7c6130993c722b6a7d3e580b4291e9dc54b45a4283b22a5a85b6a06dba4b
Opcode Fuzzy Hash: f7b84eedf3cad43fa58e1ce8a50d185e4e62407366eccf41e2d03db078b38b36
Instruction Fuzzy Hash: FA110A72901228BAE73097A5AC4DFABBBBCEF48764F10419AF504E71C0D2744E808BA4

Function 007DB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007DAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007DAA79
Part of subcall function 007DAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007DAA83
Part of subcall function 007DAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007DAA92
Part of subcall function 007DAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007DAA99
Part of subcall function 007DAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007DAAAF

GetLengthSid.ADVAPI32(?,00000000,007DADE4,?,?), ref: 007DB21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 007DB227
HeapAlloc.KERNEL32(00000000), ref: 007DB22E
CopySid.ADVAPI32(?,00000000,?), ref: 007DB247

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: de366991b80fb50483d4f36cdfb0186a64d9d8d23c4dc9a62c62edd6d4d4cca4
Instruction ID: 7d310a4b5a041c16f1402c92ae7671316c68644fa14dd12520b27312a47dabca
Opcode Fuzzy Hash: de366991b80fb50483d4f36cdfb0186a64d9d8d23c4dc9a62c62edd6d4d4cca4
Instruction Fuzzy Hash: AB118F72A00205FFDB149F94DC85EAEBBB9FF85304B15842EE94297310D739AE45CB50

Function 007DB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 007DB498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007DB4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007DB4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007DB4DB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e034b04770bf80e5c8daa8065bde2398ab8c86569164a9c51719adf769c3664
Instruction ID: b240ed1904d701495f348c0f6c5604a2fd7596e8bd9d258668281def110a5094
Opcode Fuzzy Hash: 3e034b04770bf80e5c8daa8065bde2398ab8c86569164a9c51719adf769c3664
Instruction Fuzzy Hash: EB112A7A900218FFEB11DFA9C985E9DBBB4FB08710F214092EA04B7295D771AE11DB94

Function 007BB55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 007BB34E: GetWindowLongW.USER32(?,000000EB), ref: 007BB35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 007BB5A5
GetClientRect.USER32(?,?), ref: 0081E69A
GetCursorPos.USER32(?), ref: 0081E6A4
ScreenToClient.USER32(?,?), ref: 0081E6AF

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 1b069640d0419ce03020296fbfd30b1b4d0d9c3831370523ce18109fe5143393
Instruction ID: dff1d6cc2de258086e77e8632aae84852f344e9fd234ce1d8f32b134797efad1
Opcode Fuzzy Hash: 1b069640d0419ce03020296fbfd30b1b4d0d9c3831370523ce18109fe5143393
Instruction Fuzzy Hash: E0113631900129FFCB20DFA8CD499EE7BB9FF18304F404451E941E7141D7B4AA92CBA2

Function 007E732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007E7352
MessageBoxW.USER32(?,?,?,?), ref: 007E7385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 007E739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007E73A2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 564d6e0adf9550d523c8c73b8f8e42f9594c87794daae960f5d09df02747b4b0
Instruction ID: b69cdf97dd1e9214511a821841cef8858317480b44e943f433fb006289864aa8
Opcode Fuzzy Hash: 564d6e0adf9550d523c8c73b8f8e42f9594c87794daae960f5d09df02747b4b0
Instruction Fuzzy Hash: 89110472A04284BFD7059FA8DC09E9E7FADAB49311F144319F821D33A1D7B48D01C7A0

Function 007BD17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007BD1BA
GetStockObject.GDI32(00000011), ref: 007BD1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 007BD1D8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 6fc16eb880b067606353d34f03b6f912221515a0f25e36e3aac797258ea4f12e
Instruction ID: 6d0728566f33374a2a24b98e0999d367b7337b63f7a8980f10fddbdaa518573c
Opcode Fuzzy Hash: 6fc16eb880b067606353d34f03b6f912221515a0f25e36e3aac797258ea4f12e
Instruction Fuzzy Hash: 7911ADB210160DBFEF224F98DC54EEABF6AFF18365F054111FA0552050D739DC61ABA0

Function 007D4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 007D4E16

Part of subcall function 007D54F5: __fltout2.LIBCMT ref: 007D551E

__cftog_l.LIBCMT ref: 007D4E3C
__cftoe_l.LIBCMT ref: 007D4E6E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 3fc1e60b8877f85446cc22a48d0d5334f418440523270c2640db01f897c92a16
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 1F01483200014EFBCF125E94DC458EE3F33BB18354B588456FA6859231D33ACAB2AB81

Function 007C7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007C7A0D: __getptd_noexit.LIBCMT ref: 007C7A0E

__lock.LIBCMT ref: 007C748F
InterlockedDecrement.KERNEL32(?), ref: 007C74AC
_free.LIBCMT ref: 007C74BF
InterlockedIncrement.KERNEL32(013265B8), ref: 007C74D7

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 37cf3d6977a797f7cb932d002463a2750d45eebb402c3d44bf16b85e260eba28
Instruction ID: e55b3984be4264bd58706cc50e20b151b85577a409232d7518bb664c817780f3
Opcode Fuzzy Hash: 37cf3d6977a797f7cb932d002463a2750d45eebb402c3d44bf16b85e260eba28
Instruction Fuzzy Hash: F701AD3290A721EBC72EAF64944AF5DBB60BB04712F14810DF814A7790CF2C5A01CFD2

Function 007C7A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 007C7AD8

Part of subcall function 007C7CF4: __mtinitlocknum.LIBCMT ref: 007C7D06
Part of subcall function 007C7CF4: EnterCriticalSection.KERNEL32(00000000,?,007C7ADD,0000000D), ref: 007C7D1F

InterlockedIncrement.KERNEL32(?), ref: 007C7AE5
__lock.LIBCMT ref: 007C7AF9
___addlocaleref.LIBCMT ref: 007C7B17

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: 70fc0818e3007831768085766689ad46b5689ac3601631e2447f805d4efbda29
Instruction ID: ffc112a7031b5a7782cac794ffa0af0ecf397b3a7f5c54cef3c284e7c64d3240
Opcode Fuzzy Hash: 70fc0818e3007831768085766689ad46b5689ac3601631e2447f805d4efbda29
Instruction Fuzzy Hash: E1013C71404700DED7209F65D949B49B7E0FF50321F20890EA5A6966A0CB78A644CF55

Function 0080E32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0080E33D
_memset.LIBCMT ref: 0080E34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00863D00,00863D44), ref: 0080E37B
CloseHandle.KERNEL32 ref: 0080E38D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 6c3990bd2e16cd8cfae16955bc0a45951c1ac77e92f2f69f62c81dfecffce121
Instruction ID: 55fa7beb39435f13ed7ebf0b003d7e7239277944a68570c3146fc22dbc17efd8
Opcode Fuzzy Hash: 6c3990bd2e16cd8cfae16955bc0a45951c1ac77e92f2f69f62c81dfecffce121
Instruction Fuzzy Hash: 5BF05EF1640304BEF2105FA0AC4AF777E5CFB04754F025425FF09E61A2D3B59E0086A8

Function 0080EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007BAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 007BAFE3
Part of subcall function 007BAF83: SelectObject.GDI32(?,00000000), ref: 007BAFF2
Part of subcall function 007BAF83: BeginPath.GDI32(?), ref: 007BB009
Part of subcall function 007BAF83: SelectObject.GDI32(?,00000000), ref: 007BB033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0080EA8E
LineTo.GDI32(00000000,?,?), ref: 0080EA9B
EndPath.GDI32(00000000), ref: 0080EAAB
StrokePath.GDI32(00000000), ref: 0080EAB9

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: e746445e859afc5e83e16419d2c78ce1afa5eac8f1f2fe9ea1225f3c6d1fb166
Instruction ID: 0c258b113fa801a58061e814b9e6f234132c1c2769e3b93c20a4bc0ca0fababc
Opcode Fuzzy Hash: e746445e859afc5e83e16419d2c78ce1afa5eac8f1f2fe9ea1225f3c6d1fb166
Instruction Fuzzy Hash: DBF05E31105669BBDF22AF94AC0DFCA3F19BF1A311F088101FA11610F287B89562CBA9

Function 007DC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 007DC84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 007DC85D
GetCurrentThreadId.KERNEL32 ref: 007DC864
AttachThreadInput.USER32(00000000), ref: 007DC86B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 14ededfb789347bf412651872eab8ea5409f2c9be371a6f9d4a3c5d0994e61e1
Instruction ID: 2bdc50728e149c901df3318e0df1c534779cb5e3099a06b5ffb441c50718a3d0
Opcode Fuzzy Hash: 14ededfb789347bf412651872eab8ea5409f2c9be371a6f9d4a3c5d0994e61e1
Instruction Fuzzy Hash: 6BE03971541328BAEB311BA29C0DEDB7F2CEF167A1F408022B609845A1C7B58582DBE0

Function 007DB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 007DB0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,007DAC9D), ref: 007DB0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007DAC9D), ref: 007DB0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,007DAC9D), ref: 007DB0F1

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: b40f868ff6a53334e449fde3a6a3f4c474c2e2138e8c6778847e8b5aefc34cb9
Instruction ID: 82e9b3d2cd1c4ba438a79b0c9e70b2d7b51ddb21ed3d9d41e6a957c1ce10a5b6
Opcode Fuzzy Hash: b40f868ff6a53334e449fde3a6a3f4c474c2e2138e8c6778847e8b5aefc34cb9
Instruction Fuzzy Hash: 5DE04F32601311DBD7305FB29C0CB473FA8BF55791F12C818A241D6090EA2894428760

Function 007BB47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007BB496
SetTextColor.GDI32(?,000000FF), ref: 007BB4A0
SetBkMode.GDI32(?,00000001), ref: 007BB4B5
GetStockObject.GDI32(00000005), ref: 007BB4BD
GetWindowDC.USER32(?,00000000), ref: 0081DE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 0081DE38
GetPixel.GDI32(00000000,?,00000000), ref: 0081DE51
GetPixel.GDI32(00000000,00000000,?), ref: 0081DE6A
GetPixel.GDI32(00000000,?,?), ref: 0081DE8A
ReleaseDC.USER32(?,00000000), ref: 0081DE95

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 0636badba622d7e0ced6d6f6ee2546bb77f3e936d27a3f89b1e0616da4bb24b1
Instruction ID: f3e7fc2a3e0b3dadd2c38e259a1f7607cf94b02c9abca33b878473f8c3897f14
Opcode Fuzzy Hash: 0636badba622d7e0ced6d6f6ee2546bb77f3e936d27a3f89b1e0616da4bb24b1
Instruction Fuzzy Hash: 50E0ED31100340EBDB315B68AC0DBD87F15FB55336F14C666FA69980E2C7B58592DB11

Function 0081B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0081B29A
GetDC.USER32(00000000), ref: 0081B2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0081B2C3
ReleaseDC.USER32 ref: 0081B2E2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d0c4ead6d52f7787842ceec97c67a138201463114f403f314e480168099a55dc
Instruction ID: 8b9844dc2780b06310a40360b48848fb61f8a7067a70c608f452266ed5c1ad98
Opcode Fuzzy Hash: d0c4ead6d52f7787842ceec97c67a138201463114f403f314e480168099a55dc
Instruction Fuzzy Hash: 70E01AB1100304EFDB105F708C4C66D7FA9FB5C351F11C816F85A87211DA7898428B90

Function 007DB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 007DB2DF
UnloadUserProfile.USERENV(?,?), ref: 007DB2EB
CloseHandle.KERNEL32(?), ref: 007DB2F4
CloseHandle.KERNEL32(?), ref: 007DB2FC

Part of subcall function 007DAB24: GetProcessHeap.KERNEL32(00000000,?,007DA848), ref: 007DAB2B
Part of subcall function 007DAB24: HeapFree.KERNEL32(00000000), ref: 007DAB32

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 2dcfc7cd17a0fcd30fdbf2ffe5cf0a6b1afb0fbcff30f0149619681f4c91ad7e
Instruction ID: b646cbb079cac29c7178ffd88a7ab2c5b7be1c218761d90eb8c966ae72c78548
Opcode Fuzzy Hash: 2dcfc7cd17a0fcd30fdbf2ffe5cf0a6b1afb0fbcff30f0149619681f4c91ad7e
Instruction Fuzzy Hash: 94E0B63A104105FFCB116BA5EC08859FFB6FF89322310C222F62581671DB36A872EB91

Function 0081B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0081B2AE
GetDC.USER32(00000000), ref: 0081B2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0081B2C3
ReleaseDC.USER32 ref: 0081B2E2

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 28f0ac813897634373ba986b7237367bdd3d5c1875e239674cc3580ba767f478
Instruction ID: 5beb3dd97a62b2b61eba1cba10b681025c5422c77305d5ba33cfcbcb15754157
Opcode Fuzzy Hash: 28f0ac813897634373ba986b7237367bdd3d5c1875e239674cc3580ba767f478
Instruction Fuzzy Hash: F8E046B1500300EFDB205F70CC4C66D7FAAFB5C351F11C81AF95A8B221DB78A8028B90

Function 007DDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 007DDEAA

Strings

AutoIt3GUI, xrefs: 007DDE22
Container, xrefs: 007DDE29

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 9a8aebe316b01bbd5a52ac0051f5ce54fff1c15505dbf550f4935579a42361cc
Instruction ID: da4ecd79cdbdd551aa5ccfd3ee91cd90867dcb79a7a9cc2bf9d7e49fd9b7178a
Opcode Fuzzy Hash: 9a8aebe316b01bbd5a52ac0051f5ce54fff1c15505dbf550f4935579a42361cc
Instruction Fuzzy Hash: 53911470600701EFDB24DF64C888B6ABBB9FF49710B10856AF95ACB391DB74E945CB60

Function 007BBCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 007BBCDA
GlobalMemoryStatusEx.KERNEL32 ref: 007BBCF3

Strings

@, xrefs: 007BBCE8

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 5c64d664d0dc7a1965a051f2f35d56ec15e55bc1cc7f08d1a1628c8980c3eab0
Instruction ID: 08404d1680b3347e4352691337fefc64a901aa08381b99b222cc3f4ed35a6d86
Opcode Fuzzy Hash: 5c64d664d0dc7a1965a051f2f35d56ec15e55bc1cc7f08d1a1628c8980c3eab0
Instruction Fuzzy Hash: 66513571409748DBE320AF14DC8ABAFBBE8FF95354F41484EF1C8410A2EF7495A98762

Function 007EC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 007A44ED: __fread_nolock.LIBCMT ref: 007A450B

_wcscmp.LIBCMT ref: 007EC65D
_wcscmp.LIBCMT ref: 007EC670

Strings

FILE, xrefs: 007EC5A5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 393e84bea55e7e2b792ae468cdde5a52a732bb3c2348b27caaaa54de8e28a846
Instruction ID: 450098522cfc0b4965477d12825d1562adafed73576aecb1c38cbe89bf596f8b
Opcode Fuzzy Hash: 393e84bea55e7e2b792ae468cdde5a52a732bb3c2348b27caaaa54de8e28a846
Instruction Fuzzy Hash: 4E41F976A0024AFBDF119AA4DC46FEF7BB9EF8D704F004069F501EB181D6B99A05C750

Function 0080A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 0080A85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0080A86F

Strings

', xrefs: 0080A7C3

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: edb12b2c64a40e92df914befbf01c37e5e19157d76a95f8860c123a9a61f8b7e
Instruction ID: a58077e060fe5e04db9012f996158aa6f5a4753bd373c5b4e2d4e707b1d5b346
Opcode Fuzzy Hash: edb12b2c64a40e92df914befbf01c37e5e19157d76a95f8860c123a9a61f8b7e
Instruction Fuzzy Hash: ED41E875A013099FDB58CF68C881BDA7BB5FB09704F14416AE905EB391D770A941CFA1

Function 007F5180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F5190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 007F51C6

Strings

|, xrefs: 007F51B5

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 93cb0bf6bd62b2bcfaa486e255fccab6032ed417bde12c184fb9770d249cfe01
Instruction ID: 75ef09f1e6cac40d9a2bedbeb9029021bbe689783c22219afa12b74b3255a083
Opcode Fuzzy Hash: 93cb0bf6bd62b2bcfaa486e255fccab6032ed417bde12c184fb9770d249cfe01
Instruction Fuzzy Hash: 84312A71C00119EBCF11EFA4CD85AEE7FB9FF55700F000119F915AA266DB35A906CBA0

Function 0080975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 0080980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0080984A

Strings

static, xrefs: 008097AA

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 2870f9e4825c4f70101cc5159ff24acd6553186aecde4e1d7470f8e47fa54875
Instruction ID: 6adee1dfdc7a1058a7c675fc15e0ef1af28ac4a0c644f864ba1d44f9bb2cd596
Opcode Fuzzy Hash: 2870f9e4825c4f70101cc5159ff24acd6553186aecde4e1d7470f8e47fa54875
Instruction Fuzzy Hash: 72318D71110604AEEB609F78CC84BFB77ADFF59764F008629F9A9C7291DA35AC81C760

Function 007E5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E51C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007E5201

Strings

0, xrefs: 007E51BF

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 8b6ce674b5d959138dc41adc297e15a51d9c46c5d9970a319125d92dac2f48cd
Instruction ID: e2f2b1f5ade10fecd8838b70568e93d47b575d5de29985f9766505d60387ad43
Opcode Fuzzy Hash: 8b6ce674b5d959138dc41adc297e15a51d9c46c5d9970a319125d92dac2f48cd
Instruction Fuzzy Hash: B03136B160134CDBEB24CF8AC848B9EBBFCFF49358F144029EA81A61A0D7789944CB11

Function 007F658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 007F6608

Strings

AUTOITCALLVARIABLE%d, xrefs: 007F65FA
, $, xrefs: 007F6648

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: 34c1be1106d8604ff10a7d16c79bf468958fe58452fe86b473b06c5880700c63
Instruction ID: 1215eaa1bea7ed1b64bad4ceef15326fbd0bede5f5d46026c0ff175bafae218b
Opcode Fuzzy Hash: 34c1be1106d8604ff10a7d16c79bf468958fe58452fe86b473b06c5880700c63
Instruction Fuzzy Hash: 6D216D71600218EBCF11EFA4C886EAE77B5BF85741F000559F505EB282DB78EA59CBA1

Function 008093CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0080945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00809467

Strings

Combobox, xrefs: 00809429

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 475829ec339f7c9d0caf4e749e6dcff5851e7bffbb1c6114ee25d288cd58531e
Instruction ID: ad8dc0e2fe795a584da4e9c2430ef682860831d2fd9755e965d83589154a9879
Opcode Fuzzy Hash: 475829ec339f7c9d0caf4e749e6dcff5851e7bffbb1c6114ee25d288cd58531e
Instruction Fuzzy Hash: 7011E2B1300608AFEF618E58CC80EBB376EFB883A4F110125F958D72E1D6319C528B64

Function 008098FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 007BD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007BD1BA
Part of subcall function 007BD17C: GetStockObject.GDI32(00000011), ref: 007BD1CE
Part of subcall function 007BD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 007BD1D8

GetWindowRect.USER32(00000000,?), ref: 00809968
GetSysColor.USER32(00000012), ref: 00809982

Strings

static, xrefs: 00809945

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 73559c1ce94059ba8a5a79da01becde356a33bcf0dd17060a9d163988c76f26f
Instruction ID: 210111ca6701ae09deae65bb9db21de5568e33756d5adf0b94d235ca624e7159
Opcode Fuzzy Hash: 73559c1ce94059ba8a5a79da01becde356a33bcf0dd17060a9d163988c76f26f
Instruction Fuzzy Hash: 24116772520209AFDF14DFB8CC45AEA7BA8FF08304F015628F995E3291E734E811DB60

Function 00809617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00809699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 008096A8

Strings

edit, xrefs: 0080967D

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 452a8bdeff0eab5d41607647b844c53a065126ad3b9515ad86b1c2c27519e8b1
Instruction ID: 3abc0d13df0e2f48f699050684f30fe17fceb1ed9d0dc3446e4bd25099ac8e08
Opcode Fuzzy Hash: 452a8bdeff0eab5d41607647b844c53a065126ad3b9515ad86b1c2c27519e8b1
Instruction Fuzzy Hash: 2C116AB1100208AAEB605FA8DC44AEB3B6AFB25368F104714F9B5D71E1C7769C5197A0

Function 007E5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E52D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 007E52F4

Strings

0, xrefs: 007E52CE

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 92e6e2971c4807a8ea15a05f40a8a4ecc1a7b71eded3f6b67c5502b9bb7bb760
Instruction ID: 2d5766db0e4b5146261a65c359f9de0c8abe5d0981d7aa6d7bc8a8ee08618c99
Opcode Fuzzy Hash: 92e6e2971c4807a8ea15a05f40a8a4ecc1a7b71eded3f6b67c5502b9bb7bb760
Instruction Fuzzy Hash: 6611D3B1A02658EBDB20DA99D904B9977A8BB0D75CF190025E901E7190D3B4AD04D790

Function 007F4D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 007F4DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 007F4E1E

Strings

<local>, xrefs: 007F4DE6

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 5366e588732253470acc5c272d5d5e392f4bd22b4959d88879448c863f6e5492
Instruction ID: be603176509d7e74d2869c764153d206c3db3afa23206ed69dd7277ec779e45f
Opcode Fuzzy Hash: 5366e588732253470acc5c272d5d5e392f4bd22b4959d88879448c863f6e5492
Instruction Fuzzy Hash: 1D11A070601229BBDB258F55C888EFBFAA8FF06765F10822AF71596240D3785985C6E0

Function 007FA82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 007FA84E
htons.WSOCK32(00000000,?,00000000), ref: 007FA88B

Strings

255.255.255.255, xrefs: 007FA866

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 6feaaa6ba62abe0beeb9c454435e59a405223669d7bebb368afcbc524377c23e
Instruction ID: dfd0c5a2ad4249e984f1fe68b9fe8d8407d7211ba2a887bd2461b32315e2e9d3
Opcode Fuzzy Hash: 6feaaa6ba62abe0beeb9c454435e59a405223669d7bebb368afcbc524377c23e
Instruction Fuzzy Hash: AB0126B5200308BBCB229F64C84AFA9B364FF44750F108426F61A9B3D1C7B9E806C752

Function 007DB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 007DB7EF

Strings

ListBox, xrefs: 007DB7B9
ComboBox, xrefs: 007DB78B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 844c6bf0e3e90345b9394bf9c22357038f55695268c2f5215ee7cd28223b557b
Instruction ID: 49b9db73a8fa4e41363d939184d92b834524701051464fab9d05d10174517cf8
Opcode Fuzzy Hash: 844c6bf0e3e90345b9394bf9c22357038f55695268c2f5215ee7cd28223b557b
Instruction Fuzzy Hash: 5701F1B1600114FBCB05EBA4CC469FE33B9BF56310B04061AF462A73C2EB785C1887A0

Function 007DB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 007DB6EB

Strings

ListBox, xrefs: 007DB6B5
ComboBox, xrefs: 007DB687

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: fe18e6d30115887b2b1e3767854ee14470384c3ac10b019b9236aa3f00858ed0
Instruction ID: 09ca93a0b79ec897f48d2f1f5437570e7a0bfe00ed681ac560137333e8e7bd21
Opcode Fuzzy Hash: fe18e6d30115887b2b1e3767854ee14470384c3ac10b019b9236aa3f00858ed0
Instruction Fuzzy Hash: 7C01A2B1641104FBDB15EBA4C956BFE77B8AF5A340F10001AB402B3381EF58AE1887B5

Function 007DB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 007DB76C

Strings

ListBox, xrefs: 007DB738
ComboBox, xrefs: 007DB70A

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: dc1dbc15945bff403ddb810ce767fd1501bc34e50af535026ceaedae0f0287da
Instruction ID: 28fbdaa917207d7b39058ec3c633cb04234857230e921eb916018dbcb7c6832f
Opcode Fuzzy Hash: dc1dbc15945bff403ddb810ce767fd1501bc34e50af535026ceaedae0f0287da
Instruction Fuzzy Hash: 8201ADB1640104FBDB16EBA4D906BFE73BCAB56340B50011AB842B3392DB689E1987B5

Function 007A4024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadImageW.USER32(007A0000,00000063,00000001,00000010,00000010,00000000), ref: 007A4048
EnumResourceNamesW.KERNEL32(00000000,0000000E,007E67E9,00000063,00000000,75C10280,?,?,007A3EE1,?,?,000000FF), ref: 008141B3

Strings

>z, xrefs: 007A4028

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: EnumImageLoadNamesResource
String ID: >z
API String ID: 1578290342-354686915
Opcode ID: 733a0135281da98c02757be982049ec35c1413414428f125105639cf2fc2bc53
Instruction ID: 729db8dccdae9d5a09617947b3ede5fcc2a90dc0186cf3976c09faa43a338b7f
Opcode Fuzzy Hash: 733a0135281da98c02757be982049ec35c1413414428f125105639cf2fc2bc53
Instruction Fuzzy Hash: E8F0CD31240310BBEA204B1AAC4EFD23EA9F745BB1F001106F610EA0D0C2F590809A90

Function 007E7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 007E7762
_wcscmp.LIBCMT ref: 007E7774

Strings

#32770, xrefs: 007E776E

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 80415eedabadad5427d5750f10aaa750a2021dca129d5321023a559c751ca7f4
Instruction ID: 49b4085ffcb809fdfa2e1473972c47fcd683ecf4a38c8b5e0c78b2664acee86d
Opcode Fuzzy Hash: 80415eedabadad5427d5750f10aaa750a2021dca129d5321023a559c751ca7f4
Instruction Fuzzy Hash: 3CE0927760432467D720AAA5AC0AE87FBACFB65760F01402AF915D3241E668A60587D0

Function 007DA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 007DA63F

Part of subcall function 007C13F1: _doexit.LIBCMT ref: 007C13FB

Strings

Error allocating memory., xrefs: 007DA638
AutoIt, xrefs: 007DA633

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 8d7654d33bc45fbe1c644d6cae2b4e50ec326d18b8f079ec430a6ed02c284f69
Instruction ID: 278bad0ca5dcb3e8784a27689a3752b76eefdcd0c24772805260607befb3caff
Opcode Fuzzy Hash: 8d7654d33bc45fbe1c644d6cae2b4e50ec326d18b8f079ec430a6ed02c284f69
Instruction Fuzzy Hash: 86D0123228431872D62426A86C1BFC57A48AB56B65F144066BB08956C259EAD59041D9

Function 0081AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 0081ACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0081AEBD

Strings

WIN_XPe, xrefs: 0081ACD3

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: adef745337983466370c9b50ec68c219cb4f28a0307487767230261507f1c0a6
Instruction ID: be97c324f86410790ee83f23bd396f51415f5d483f23fb3e1d6b4ec32ff9094e
Opcode Fuzzy Hash: adef745337983466370c9b50ec68c219cb4f28a0307487767230261507f1c0a6
Instruction Fuzzy Hash: F4E039B0C00609DFCB25DBA8D944AECBBBCFF48300F108081E142F2260DB706A84DF62

Function 00808698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 008086A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 008086B5

Part of subcall function 007E7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007E7AD0

Strings

Shell_TrayWnd, xrefs: 0080869B

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4da64c925d81eba2c4be2d15560c1bf76967a19c4173f66505f90e2b6bcc7a60
Instruction ID: 260302f890a5bbd81439e0238ebeb86a60e4a47e978393ec55cae74bace0eef7
Opcode Fuzzy Hash: 4da64c925d81eba2c4be2d15560c1bf76967a19c4173f66505f90e2b6bcc7a60
Instruction Fuzzy Hash: 58D0C971385354B7E2786770AC0BFD66E18AB14B11F104815BA49AA1D0C9E8A941C654

Function 008086CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 008086E2
PostMessageW.USER32(00000000), ref: 008086E9

Part of subcall function 007E7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007E7AD0

Strings

Shell_TrayWnd, xrefs: 008086DB

Memory Dump Source

Source File: 00000000.00000002.1703401808.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000000.00000002.1703388460.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000082D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703440508.000000000084E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703486953.000000000085A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703504217.0000000000864000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a0000_aS39AS7b0P.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ddb2e50ae721e089bb88a9ec0f6b78dcede0d30f319464dea956c00c6e49b843
Instruction ID: 310e109b5254837eea98909819253b1f5b9603cbb4feb8a4c2c6ad0b5d0dcde3
Opcode Fuzzy Hash: ddb2e50ae721e089bb88a9ec0f6b78dcede0d30f319464dea956c00c6e49b843
Instruction Fuzzy Hash: DFD0C971385354BBF2786770AC0BFC66A18AB18B11F504815BA45EA1D0C9E8A941C654

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aS39AS7b0P.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autFFFD.tmp

C:\Users\user\AppData\Local\Temp\tapestring

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
aS39AS7b0P.exe

Function 007CB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 007A3D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Function 007BDDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 007A406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 007EFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Function 007A3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 007EBFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Function 007A3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 007A3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 01562048 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 007A49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 007A36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01561E08 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Function 007A51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre