Edit tour

Windows Analysis Report
dZIZhRHDXv.exe

Overview

General Information

Sample name:	dZIZhRHDXv.exe renamed because original name is a hash value
Original sample name:	e5a12459a39aa142a12c58d9afbe5b0d.exe
Analysis ID:	1543219
MD5:	e5a12459a39aa142a12c58d9afbe5b0d
SHA1:	bebd558572194c56815a2fbaf016d1d4d0922ed3
SHA256:	a45e9fae49d4af114a252f3cd5b69f33cb5994915a75cb51983910c9f21d81e5
Tags:	exeuser-abuse_ch
Infos:

Detection

RHADAMANTHYS

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected RHADAMANTHYS Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

One or more processes crash

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

dZIZhRHDXv.exe (PID: 7624 cmdline: "C:\Users\user\Desktop\dZIZhRHDXv.exe" MD5: E5A12459A39AA142A12C58D9AFBE5B0D)

dialer.exe (PID: 7684 cmdline: "C:\Windows\system32\dialer.exe" MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

WerFault.exe (PID: 7756 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 708 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7788 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 704 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/ https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://138.201.226.224:9292/bcacc1e7778c536b694/6wlh52ro.x0plp"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1791313957.00000000006A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000001.00000003.1822087119.0000000005475000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000001.00000003.1794640183.00000000033E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000003.1796910103.0000000005720000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1798820760.0000000003B30000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: dZIZhRHDXv.exe PID: 7624	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: dialer.exe PID: 7684	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.dZIZhRHDXv.exe.4250000.8.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.3.dialer.exe.5720000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.dZIZhRHDXv.exe.4030000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.dZIZhRHDXv.exe.4250000.8.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.3.dialer.exe.5500000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.1757931236.0000000002880000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://138.201.226.224:9292/bcacc1e7778c536b694/6wlh52ro.x0plp"}

Multi AV Scanner detection for submitted file

Source: dZIZhRHDXv.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: dZIZhRHDXv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dZIZhRHDXv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wkernel32.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1793076231.0000000002A90000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793169848.00000000040B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796451170.0000000003460000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796547390.0000000005580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796910103.0000000005720000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1792273411.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792472803.0000000004220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795816573.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795591609.0000000005500000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1792713277.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792865220.00000000041D0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796048912.0000000005500000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796213656.00000000056A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1792273411.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792472803.0000000004220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795816573.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795591609.0000000005500000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1792713277.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792865220.00000000041D0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796048912.0000000005500000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796213656.00000000056A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: E:\cpp\Notepad3\Bin\Release_x86_v143\minipath.pdb source: dZIZhRHDXv.exe
Source:	Binary string: wkernel32.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1793076231.0000000002A90000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793169848.00000000040B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796451170.0000000003460000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796547390.0000000005580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796910103.0000000005720000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E4CEA5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00E4CEA5

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://138.201.226.224:9292/bcacc1e7778c536b694/6wlh52ro.x0plp

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 138.201.226.224:9292

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224
Source: unknown	TCP traffic detected without corresponding DNS query: 138.201.226.224

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 1_2_057C9F64 memset,memset,WSARecv,GetLastError,WSAGetLastError,WSAGetLastError,WSAGetLastError,RegisterWaitForSingleObject,

1_2_057C9F64

Source: dialer.exe, 00000001.00000002.3000230789.000000000303C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://138.201.226.224:9292/bcacc1e7778c536b694/6wlh52ro.x0plp
Source: dZIZhRHDXv.exe	String found in binary or memory: https://www.flos-freeware.chopenmailto:florian.balmer
Source: dZIZhRHDXv.exe	String found in binary or memory: https://www.rizonesoft.com

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E02050 GetFileAttributesW,GetFileAttributesW,MessageBeep,DialogBoxIndirectParamW,LocalFree,ShellExecuteExW,GetShortPathNameW,StrCatBuffW,StrCatBuffW,StrCatBuffW,StrCatBuffW,lstrlenW,GlobalAlloc,GlobalLock,lstrcpyW,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,SendMessageW,SendMessageW,SendMessageW,LdrInitializeThunk,StrRetToBufW,PathRemoveBackslashW,PathIsSameRootW,SetFocus,SendMessageW,SendMessageW,SendMessageW,SendMessageW,PostMessageW,GetFocus,GetDlgCtrlID,GetDlgItem,SetFocus,GetDlgItem,SetFocus,PathFileExistsW,lstrcpyW,StrRChrW,PathIsRootW,SetCurrentDirectoryW,SendMessageW,SendMessageW,lstrcpynW,MessageBeep,lstrcpynW,PathIsRootW,PathIsRootW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,

0_2_00E02050

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

0_2_00E02050

Source: dZIZhRHDXv.exe, 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_cd5390ae-4

Source: dZIZhRHDXv.exe, 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_c3e6f367-8

Source: Yara match	File source: 0.3.dZIZhRHDXv.exe.4250000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dialer.exe.5720000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.dZIZhRHDXv.exe.4030000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.dZIZhRHDXv.exe.4250000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dialer.exe.5500000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1796910103.0000000005720000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dZIZhRHDXv.exe PID: 7624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 7684, type: MEMORYSTR

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02902F40	0_3_02902F40
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02902640	0_3_02902640
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02901A40	0_3_02901A40
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02901FA0	0_3_02901FA0
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02901710	0_3_02901710
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00DEA0B0	0_2_00DEA0B0
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00DFEFB0	0_2_00DFEFB0
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E1A080	0_2_00E1A080
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E30020	0_2_00E30020
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E3037E	0_2_00E3037E
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E306EB	0_2_00E306EB
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E1A620	0_2_00E1A620
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E009E0	0_2_00E009E0
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E5690C	0_2_00E5690C
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E1AA70	0_2_00E1AA70
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E30A49	0_2_00E30A49
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E2EC1F	0_2_00E2EC1F
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E30E3D	0_2_00E30E3D
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E2EF61	0_2_00E2EF61
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E2F2B2	0_2_00E2F2B2
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E31240	0_2_00E31240
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E5F21D	0_2_00E5F21D
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E173E0	0_2_00E173E0
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E554EF	0_2_00E554EF
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E2F5F4	0_2_00E2F5F4
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D83987	0_2_00D83987
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E2F953	0_2_00E2F953
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E2FCC1	0_2_00E2FCC1
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E0DFC9	0_2_00E0DFC9
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E17F77	0_2_00E17F77
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057D3573	1_2_057D3573
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E3524	1_2_057E3524
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057DC458	1_2_057DC458
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057DBC11	1_2_057DBC11
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E2CBD	1_2_057E2CBD
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057CD73D	1_2_057CD73D
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E2721	1_2_057E2721
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057DC7EB	1_2_057DC7EB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E7FA2	1_2_057E7FA2
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E3F8C	1_2_057E3F8C
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057C8653	1_2_057C8653
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E2009	1_2_057E2009
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057D38DB	1_2_057D38DB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057C834D	1_2_057C834D
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E3BC5	1_2_057E3BC5
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E5BA4	1_2_057E5BA4
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E22B4	1_2_057E22B4

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: String function: 00E09F70 appears 52 times
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: String function: 00E49B2C appears 34 times
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: String function: 00D9C0C3 appears 111 times

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 708

Source: dZIZhRHDXv.exe, 00000000.00000003.1792273411.00000000041A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1794274856.0000000002986000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashDevelop.exe vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1792865220.00000000042FD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1793076231.0000000002A90000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000000.1757297443.0000000000E82000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameminipath.exeD vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1793547768.0000000004431000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1757931236.0000000002880000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFlashDevelop.exe vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1792472803.00000000043A6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1793076231.0000000002B22000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1793169848.00000000040B0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1792713277.0000000004153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe, 00000000.00000003.1793169848.0000000004100000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs dZIZhRHDXv.exe
Source: dZIZhRHDXv.exe	Binary or memory string: OriginalFilenameminipath.exeD vs dZIZhRHDXv.exe

Source: dZIZhRHDXv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@5/0@0/1

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00DF86E0 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalFree,GetFocus,MessageBoxExW,LocalFree,LocalFree,

0_2_00DF86E0

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00DFB810 CoCreateInstance,lstrcpyW,ExpandEnvironmentStringsW,lstrcpynW,

0_2_00DFB810

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00DFD1D0 FindResourceW,LoadResource,LockResource,SizeofResource,LocalAlloc,FreeResource,lstrlenW,lstrlenW,FreeResource,

0_2_00DFD1D0

Source: C:\Windows\SysWOW64\dialer.exe

Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\302c6948-e75b-4b17-9040-ca23feb115ae

Jump to behavior

Source: dZIZhRHDXv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dZIZhRHDXv.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\dZIZhRHDXv.exe "C:\Users\user\Desktop\dZIZhRHDXv.exe"
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 708
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 704
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: dZIZhRHDXv.exe

Static file information: File size 1374208 > 1048576

Source: dZIZhRHDXv.exe	Static PE information: section name: RT_CURSOR
Source: dZIZhRHDXv.exe	Static PE information: section name: RT_BITMAP
Source: dZIZhRHDXv.exe	Static PE information: section name: RT_ICON
Source: dZIZhRHDXv.exe	Static PE information: section name: RT_MENU
Source: dZIZhRHDXv.exe	Static PE information: section name: RT_DIALOG
Source: dZIZhRHDXv.exe	Static PE information: section name: RT_STRING
Source: dZIZhRHDXv.exe	Static PE information: section name: RT_ACCELERATOR
Source: dZIZhRHDXv.exe	Static PE information: section name: RT_GROUP_ICON

Source: dZIZhRHDXv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: dZIZhRHDXv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: dZIZhRHDXv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: dZIZhRHDXv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: dZIZhRHDXv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: dZIZhRHDXv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: dZIZhRHDXv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: dZIZhRHDXv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1793076231.0000000002A90000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793169848.00000000040B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796451170.0000000003460000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796547390.0000000005580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796910103.0000000005720000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1792273411.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792472803.0000000004220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795816573.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795591609.0000000005500000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1792713277.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792865220.00000000041D0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796048912.0000000005500000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796213656.00000000056A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1792273411.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792472803.0000000004220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795816573.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1795591609.0000000005500000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: dZIZhRHDXv.exe, 00000000.00000003.1792713277.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1792865220.00000000041D0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796048912.0000000005500000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796213656.00000000056A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: E:\cpp\Notepad3\Bin\Release_x86_v143\minipath.pdb source: dZIZhRHDXv.exe
Source:	Binary string: wkernel32.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1793076231.0000000002A90000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793169848.00000000040B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796451170.0000000003460000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796547390.0000000005580000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: dZIZhRHDXv.exe, 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp, dZIZhRHDXv.exe, 00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796910103.0000000005720000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp

Source: dZIZhRHDXv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: dZIZhRHDXv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: dZIZhRHDXv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: dZIZhRHDXv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: dZIZhRHDXv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E009E0 SendMessageW,LoadLibraryW,GetProcAddress,FreeLibrary,CreateWindowExW,SendMessageW,LoadImageW,CopyImage,GetObjectW,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetSysColor,ImageList_Create,ImageList_AddMasked,DeleteObject,SendMessageW,GetObjectW,ImageList_Create,ImageList_AddMasked,DeleteObject,SendMessageW,GetObjectW,ImageList_Create,ImageList_AddMasked,DeleteObject,SendMessageW,GetSysColor,GetObjectW,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetObjectW,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetSysColor,ImageList_Create,ImageList_AddMasked,SendMessageW,DeleteObject,wsprintfW,lstrcmpiW,lstrcmpiW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,CreateWindowExW,SystemParametersInfoW,SystemParametersInfoW,CreateWindowExW,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,SystemParametersInfoW,SendMessageW,SystemParametersInfoW,GetSysColor,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,SystemParametersInfoW,SystemParametersInfoW,GetSysColor,SendMessageW,SetWindowPos,GetWindowRect,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,

0_2_00E009E0

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02914285 push F693B671h; retf	0_3_0291428A
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02913AF4 pushad ; retf	0_3_02913B03
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02914F48 push es; ret	0_3_02914F49
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02910F4E push eax; retf	0_3_02910F4F
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02913DCE push edi; iretd	0_3_02913DD5
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_0291212F pushad ; ret	0_3_02912137
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_0291457C push esi; ret	0_3_02914580
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_0291216F push ecx; iretd	0_3_0291217B
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D861D5 push 9D679010h; ret	0_2_00D861EE
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D861EF push 9D679010h; ret	0_2_00D861EE
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E605E7 push ecx; ret	0_2_00E605FA
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D84A01 push ebx; retf	0_2_00D84A14
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D8546E push cs; ret	0_2_00D854B8
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D83400 push ebp; retf	0_2_00D83406
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D8383E push ebx; iretd	0_2_00D83840
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00D83901 push ebx; iretd	0_2_00D83983
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_03074305 push F693B671h; retf	1_3_0307430A
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_03073B74 pushad ; retf	1_3_03073B83
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_030721AF pushad ; ret	1_3_030721B7
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_03070FCE push eax; retf	1_3_03070FCF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_03074FC8 push es; ret	1_3_03074FC9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_030721EF push ecx; iretd	1_3_030721FB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_030745FC push esi; ret	1_3_03074600
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_03073E4E push edi; iretd	1_3_03073E55
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_03075CD2 push dword ptr [edx+ebp+3Bh]; retf	1_3_03075CDF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_2_057E98F0 push eax; ret	1_2_057E991E

Source: dZIZhRHDXv.exe

Static PE information: section name: .text entropy: 7.308659196103948

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E06140 GetSysColor,EnumWindows,IsWindowEnabled,IsIconic,ShowWindowAsync,IsWindowVisible,SendMessageW,SendMessageW,SendMessageW,SetForegroundWindow,GlobalSize,PathIsRelativeW,GetCurrentDirectoryW,PathAppendW,lstrcpyW,GlobalSize,SendMessageW,GlobalFree,LoadStringW,LoadStringW,LoadStringW,StrChrW,MessageBoxW,	0_2_00E06140
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00DFEFB0 DefWindowProcW,SendMessageW,DefWindowProcW,WaitForSingleObject,FindNextChangeNotification,SendMessageW,SetWindowPos,SetWindowPos,DefWindowProcW,ShowOwnedPopups,ShowOwnedPopups,SystemParametersInfoW,GetWindowRect,DrawAnimatedRects,ShowWindow,SetBkColor,SetTextColor,SendMessageW,SetWindowPos,RedrawWindow,IsIconic,ShowWindow,DragQueryFileW,DragQueryFileW,DragQueryFileW,DragFinish,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,SetWindowPos,SendMessageW,SendMessageW,SendMessageW,DestroyWindow,DestroyWindow,DestroyWindow,DestroyWindow,GetClientRect,SendMessageW,SendMessageW,UpdateWindow,IsWindowVisible,LoadMenuW,GetSubMenu,SetForegroundWindow,GetCursorPos,SetMenuDefaultItem,TrackPopupMenu,PostMessageW,DestroyMenu,PostMessageW,ShowOwnedPopups,	0_2_00DFEFB0
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E066D0 lstrcpyW,lstrcpyW,EnumWindows,IsWindowEnabled,IsIconic,ShowWindowAsync,SetForegroundWindow,lstrlenW,GlobalAlloc,GlobalLock,lstrcpyW,GlobalUnlock,PostMessageW,StrChrW,MessageBoxW,GetShortPathNameW,StrCatBuffW,StrCpyNW,StrCatBuffW,StrCatBuffW,lstrcpyW,ShellExecuteExW,lstrcpynW,wsprintfW,DdeInitializeW,DdeCreateStringHandleW,DdeCreateStringHandleW,DdeCreateStringHandleW,DdeFreeStringHandle,DdeConnect,lstrlenW,DdeClientTransaction,DdeDisconnect,DdeFreeStringHandle,DdeFreeStringHandle,DdeFreeStringHandle,DdeUninitialize,GetShortPathNameW,StrCatBuffW,StrCpyNW,StrCatBuffW,StrCatBuffW,lstrcpyW,ExpandEnvironmentStringsW,lstrcpynW,ShellExecuteExW,DialogBoxIndirectParamW,LocalFree,	0_2_00E066D0

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\dialer.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\dialer.exe	API/Special instruction interceptor: Address: 57F483A

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXEWINDANR.EXE
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EVERYWHERE.EXEFIDDLER.EXEIDA.EXEIDA64.EXEIMMU
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEPROCESSHA
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TORUNS.EXEDUMPCAP.EXEDE4
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDANR.EXE

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

API coverage: 6.4 %

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E4CEA5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00E4CEA5

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E0874A VirtualQuery,GetSystemInfo,

0_2_00E0874A

Source: dialer.exe, 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: dialer.exe, 00000001.00000002.3000293279.00000000032D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dialer.exe, 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_3_029102CC VirtualAlloc,VirtualAlloc,VirtualProtect,LdrInitializeThunk,VirtualFree,

0_3_029102CC

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E503BC IsDebuggerPresent,OutputDebugStringW,

0_2_00E503BC

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

0_2_00E009E0

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_3_02910277 mov eax, dword ptr fs:[00000030h]		0_3_02910277
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_0307027F mov eax, dword ptr fs:[00000030h]		1_3_0307027F

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E0934F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E0934F
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E377CE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E377CE
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: 0_2_00E09D68 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E09D68

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"

Jump to behavior

Source: dZIZhRHDXv.exe, 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmp, dZIZhRHDXv.exe, 00000000.00000000.1757261691.0000000000E65000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: uxtheme.dllIsAppThemed - []\]%i %i%CSIDL:MYDOCUMENTS%.lnk"...%1%.2i"%s"Segoe UIMicrosoft JhengHei UIMicrosoft YaHei UIYu Gothic UIMalgun GothicWINDOWSTYLE;WINDOWShell_TrayWndTrayNotifyWndaf-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-TR vi-VN zh-CN zh-TW,; :en-USlng/mplng.dllTaskbarCreatedMinPathNotepad3...sdgfdhgfddgnhgsdfsdfggdhffdAutoRefreshRateSysListView32ComboBoxEx32ToolbarWindow32Toolbar Labels%02i(none)msctls_statusbar32ReBarWindow32Toolbar -f0 -n -p %i,%i,%i,%iok\A-RHS%s \| %s %s \| %s%u-/%i,%i,%i,%iNotepad3.exe
Source: dZIZhRHDXv.exe	Binary or memory string: Shell_TrayWnd
Source: dZIZhRHDXv.exe	Binary or memory string: Guxtheme.dllIsAppThemed - []\]%i %i%CSIDL:MYDOCUMENTS%.lnk"...%1%.2i"%s"Segoe UIMicrosoft JhengHei UIMicrosoft YaHei UIYu Gothic UIMalgun GothicWINDOWSTYLE;WINDOWShell_TrayWndTrayNotifyWndaf-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-TR vi-VN zh-CN zh-TW,; :en-USlng/mplng.dllTaskbarCreatedMinPathNotepad3...sdgfdhgfddgnhgsdfsdfggdhffdAutoRefreshRateSysListView32ComboBoxEx32ToolbarWindow32Toolbar Labels%02i(none)msctls_statusbar32ReBarWindow32Toolbar -f0 -n -p %i,%i,%i,%iok\A-RHS%s \| %s %s \| %s%u-/%i,%i,%i,%iNotepad3.exe

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E09B84 cpuid

0_2_00E09B84

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetUserPreferredUILanguages,GetUserPreferredUILanguages,LocalAlloc,GetUserPreferredUILanguages,LocalFree,GetLocaleInfoEx,	0_2_00DFE070
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: EnumSystemLocalesW,	0_2_00E52DDB
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: EnumSystemLocalesW,	0_2_00E52D72
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: EnumSystemLocalesW,	0_2_00E52E76
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E52F01
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetLocaleInfoW,	0_2_00E53154
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetLocaleInfoW,	0_2_00E0710F
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00E5327D
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetLocaleInfoW,	0_2_00E53383
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: LCIDToLocaleName,GetLocaleInfoEx,	0_2_00E07391
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E53459
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: EnumSystemLocalesW,	0_2_00E49502
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: EnumSystemLocalesW,	0_2_00E496A1
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: ResolveLocaleName,GetLocaleInfoEx,	0_2_00DFDD80
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetLocaleInfoEx,SendMessageW,lstrlenW,ResetEvent,lstrlenW,CharPrevW,lstrlenW,CharPrevW,lstrlenW,	0_2_00DFBE60
Source: C:\Users\user\Desktop\dZIZhRHDXv.exe	Code function: GetLocaleInfoW,	0_2_00E49FE8

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00E4A027 GetSystemTimeAsFileTime,

0_2_00E4A027

Source: C:\Users\user\Desktop\dZIZhRHDXv.exe

Code function: 0_2_00DFE360 GetVersion,SetErrorMode,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,OleInitialize,InitCommonControlsEx,RegisterWindowMessageW,GetSysColor,CreateSolidBrush,CreateSolidBrush,GetSysColor,CreateSolidBrush,StrStrIW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,#381,#381,#381,LoadCursorW,RegisterClassW,LoadAcceleratorsW,GetMessageW,GetMessageW,TranslateAcceleratorW,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,GetMessageW,OleUninitialize,SetThreadPreferredUILanguages,CreateSolidBrush,SetThreadUILanguage,lstrcmpW,CreateSolidBrush,CreateSolidBrush,InitMUILanguage,

0_2_00DFE360

Source: dialer.exe, 00000001.00000002.3000441616.0000000003510000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OllyDbg.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000000.00000003.1791313957.00000000006A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1822087119.0000000005475000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1794640183.00000000033E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1798820760.0000000003B30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000000.00000003.1791313957.00000000006A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1822087119.0000000005475000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1794640183.00000000033E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1798820760.0000000003B30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 1_2_057C9A57 socket,WSAGetLastError,SetHandleInformation,GetLastError,closesocket,bind,WSAGetLastError,

1_2_057C9A57

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	2 Virtualization/Sandbox Evasion	21 Input Capture	1 System Time Discovery	Remote Services	21 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	125 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dZIZhRHDXv.exe	47%	ReversingLabs	Win32.Trojan.Generic

Name	Malicious	Antivirus Detection	Reputation
https://138.201.226.224:9292/bcacc1e7778c536b694/6wlh52ro.x0plp	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rizonesoft.com	dZIZhRHDXv.exe	false		unknown
https://www.flos-freeware.chopenmailto:florian.balmer	dZIZhRHDXv.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
138.201.226.224	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543219
Start date and time:	2024-10-27 13:33:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dZIZhRHDXv.exe renamed because original name is a hash value
Original Sample Name:	e5a12459a39aa142a12c58d9afbe5b0d.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@5/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: dZIZhRHDXv.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	nklmpsl.elf	Get hash	malicious	Unknown	Browse	5.75.234.236
	splppc.elf	Get hash	malicious	Unknown	Browse	144.77.227.183
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	78.46.37.121
	nklmips.elf	Get hash	malicious	Unknown	Browse	46.4.109.36
	SecuriteInfo.com.Trojan.Agent.GMXD.11819.15970.exe	Get hash	malicious	Unknown	Browse	95.217.6.16
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	136.243.215.170
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	148.251.20.73
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	95.216.40.126
	https://developmentltd.online/	Get hash	malicious	Captcha Phish	Browse	78.46.40.242
	https://developmentltd.online/	Get hash	malicious	Captcha Phish	Browse	78.46.40.242

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.058694163921743
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dZIZhRHDXv.exe
File size:	1'374'208 bytes
MD5:	e5a12459a39aa142a12c58d9afbe5b0d
SHA1:	bebd558572194c56815a2fbaf016d1d4d0922ed3
SHA256:	a45e9fae49d4af114a252f3cd5b69f33cb5994915a75cb51983910c9f21d81e5
SHA512:	471c88d109ebabc6d288a19f604ccabdc6ad6709acabc5bee1f3885ac917870f4349a98b03ec62d89b3c40e9f8477dfc1faf735484dc750ecb6111dcbd824086
SSDEEP:	24576:E/Pa9WKjYx31wk3AKLbTuruhXaJYKwcC4nS/AildFu8hod/zodlY:KQWKjc1wk3AKLbCZYKwcC4nSZFadkd
TLSH:	7955D041B580C032D9B66570443AEBB5497EBC708B261ACF6BC4793B6F325C19A36B1F
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................C....$.......$.......$.......................$..........................I....$.......$........o....

File Icon


Icon Hash:	3fc7a3c665f3c37d

Static PE Info

General

Entrypoint:	0x489903
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C782C5 [Sat Feb 10 14:05:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c18bcc1175f8fcf1adc36bc1ee87c82a

Entrypoint Preview

Instruction
call 00007F7BC8B5B7C3h
jmp 00007F7BC8B5AE78h
retn 0000h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+08h]
xchg dword ptr [ecx], eax
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 004F5980h
mov ecx, 004F5980h
sub eax, edx
sub ecx, edx
cmp eax, ecx
jnbe 00007F7BC8B5B053h
int3
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 004F5980h
mov ecx, 004F5980h
sub eax, edx
sub ecx, edx
cmp eax, ecx
jnbe 00007F7BC8B5B057h
push 00000041h
pop ecx
int 29h
pop ebp
ret
retn 0000h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 004F5980h
mov ecx, 004F5980h
sub eax, edx
sub ecx, edx
cmp eax, ecx
jnbe 00007F7BC8B5B05Eh
mov eax, dword ptr [004E5644h]
test eax, eax
je 00007F7BC8B5B055h
pop ebp
jmp eax
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [004E5644h]
test eax, eax
je 00007F7BC8B5B055h
pop ebp
jmp eax
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 004F5980h
mov ecx, 004F5980h
sub eax, edx
sub ecx, edx
cmp eax, ecx
jnbe 00007F7BC8B5B06Ch
push esi
mov esi, dword ptr [004FC194h]
test esi, esi
je 00007F7BC8B5B060h
push dword ptr [ebp+08h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf8210	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x102000	0x502e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x153000	0x51d8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf58d0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf59c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xec5f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe5000	0x63c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xf8000	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe379a	0xe3800	b44216b9d2fe6c289604c8df6be3b335	False	0.6444013993818681	data	7.308659196103948	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe5000	0x15504	0x15600	356232fdefb6b47702c1b772e1c7f498	False	0.5792443347953217	data	6.150072189047563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xfb000	0x6d10	0x1000	95cc1f43963611e0dc709b32d9d6a0e9	False	0.201904296875	data	2.8247194529459554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x102000	0x502e8	0x50400	2e7224c2f3367da182f384150418a77f	False	0.5011378017912772	data	5.821073929631435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x153000	0x51d8	0x5200	1cd1efc4664cbefcafddbec54260c8d1	False	0.7885861280487805	data	6.787527296370238	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x12b588	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.4935064935064935
RT_BITMAP	0x12b6d8	0x3c28	Device independent bitmap graphic, 240 x 16 x 32, image size 15360, resolution 3779 x 3779 px/m	English	United States	0.3574675324675325
RT_BITMAP	0x12f300	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024, resolution 3779 x 3779 px/m	English	United States	0.46522556390977443
RT_ICON	0x102c00	0x1011a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9996657449329971
RT_ICON	0x112d20	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.3587927363066367
RT_ICON	0x123548	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.49120217288615964
RT_ICON	0x127770	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5267634854771784
RT_ICON	0x129d18	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6088180112570356
RT_ICON	0x12adc0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.775709219858156
RT_ICON	0x12b288	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.1303763440860215
RT_ICON	0x12faf8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.35873358570921565
RT_ICON	0x140320	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.4910840812470477
RT_ICON	0x144548	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.5263485477178423
RT_ICON	0x146af0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.6074108818011257
RT_ICON	0x147b98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7695035460992907
RT_ICON	0x148050	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.31636960600375236
RT_ICON	0x149110	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.17659474671669795
RT_ICON	0x14a1d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2598499061913696
RT_ICON	0x14b290	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2298311444652908
RT_ICON	0x14c350	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.34139784946236557
RT_ICON	0x14c650	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.3334896810506567
RT_ICON	0x14d710	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.21370967741935484
RT_MENU	0x14da10	0x53e	data	English	United States	0.39046199701937406
RT_DIALOG	0x14df50	0x1a8	data	English	United States	0.46226415094339623
RT_DIALOG	0x14e0f8	0x1b0	data	English	United States	0.5393518518518519
RT_DIALOG	0x14e480	0x1dc	data	English	United States	0.5315126050420168
RT_DIALOG	0x14e660	0x1dc	data	English	United States	0.5294117647058824
RT_DIALOG	0x14e840	0x130	data	English	United States	0.569078947368421
RT_DIALOG	0x14eaa0	0x210	data	English	United States	0.48295454545454547
RT_DIALOG	0x14e2a8	0x1d4	data	English	United States	0.5512820512820513
RT_DIALOG	0x14e970	0x130	data	English	United States	0.5756578947368421
RT_DIALOG	0x14fbe0	0x560	data	English	United States	0.375
RT_DIALOG	0x150140	0x244	data	English	United States	0.5017241379310344
RT_DIALOG	0x14ecb0	0x4a2	data	English	United States	0.3979763912310287
RT_DIALOG	0x14f158	0x4ae	data	English	United States	0.43906510851419034
RT_DIALOG	0x14f608	0x3ba	data	English	United States	0.40146750524109015
RT_DIALOG	0x14f9c8	0x218	data	English	United States	0.5093283582089553
RT_STRING	0x150928	0xa6	data	English	United States	0.6204819277108434
RT_STRING	0x151510	0x1e0	Matlab v4 mat-file (little endian) i, numeric, rows 0, columns 0	English	United States	0.40625
RT_STRING	0x151738	0x1b0	data	English	United States	0.41203703703703703
RT_STRING	0x150800	0x124	data	English	United States	0.6027397260273972
RT_STRING	0x1509d0	0xb3e	data	English	United States	0.24009728978457262
RT_STRING	0x150388	0x478	data	English	United States	0.388986013986014
RT_STRING	0x1516f0	0x48	data	English	United States	0.6111111111111112
RT_ACCELERATOR	0x12f728	0x1a0	data	English	United States	0.5913461538461539
RT_GROUP_CURSOR	0x12b6c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x12b228	0x5a	Targa image data - Map 32 x 282 x 1 +1	English	United States	0.7777777777777778
RT_GROUP_ICON	0x1490f8	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x14c638	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x14b278	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x14c338	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x14d6f8	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x14a1b8	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x14d9f8	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x12b570	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x148000	0x4c	data	English	United States	0.8157894736842105
RT_VERSION	0x12f8c8	0x22c	data	English	United States	0.5269784172661871
RT_MANIFEST	0x1518e8	0x9fb	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2495), with CRLF line terminators	English	United States	0.30176125244618396

Imports

DLL	Import
SHLWAPI.dll	PathGetDriveNumberW, StrCmpNIW, StrDupW, StrChrA, PathRelativePathToW, PathIsPrefixW, PathUnExpandEnvStringsW, PathIsRootW, PathCanonicalizeW, PathFindExtensionW, PathFindFileNameW, PathCommonPrefixW, PathCompactPathExW, PathRemoveExtensionW, StrStrIW, StrFormatByteSizeW, PathStripPathW, PathRemoveBackslashW, StrRetToBufW, PathMatchSpecW, StrCatBuffW, PathUnquoteSpacesW, StrChrW, StrTrimW, SHAutoComplete, StrCpyNW, PathQuoteSpacesW, PathRenameExtensionW, PathIsDirectoryW, StrRChrW, PathAppendW, PathIsRelativeW, PathFileExistsW, PathAddBackslashW, PathRemoveFileSpecW, PathIsSameRootW
PSAPI.DLL	EnumProcessModules, GetModuleFileNameExW
USER32.dll	LoadAcceleratorsW, DeleteMenu, ShowOwnedPopups, CopyImage, MessageBoxW, EqualRect, IsWindowVisible, ShowWindowAsync, GetMessagePos, LoadMenuW, CharUpperW, GetKeyState, DefWindowProcW, GetMenuItemInfoW, DeferWindowPos, GetMessageW, GetSubMenu, BeginDeferWindowPos, OpenClipboard, OffsetRect, SetTimer, CloseClipboard, SetMenuItemInfoW, EmptyClipboard, RegisterClassW, SetWindowPlacement, FrameRect, SetMenuDefaultItem, EnumWindows, GetMessageTime, CreateWindowExA, IntersectRect, SetFocus, BringWindowToTop, TranslateAcceleratorW, GetWindowDC, EndDeferWindowPos, SetClipboardData, CheckMenuItem, IsZoomed, KillTimer, PostQuitMessage, GetSysColorBrush, EnableMenuItem, RegisterWindowMessageW, UpdateWindow, IsIconic, GetWindowThreadProcessId, DrawAnimatedRects, FindWindowExW, GetDC, MonitorFromRect, SetActiveWindow, LoadStringA, TrackPopupMenu, SetWindowCompositionAttribute, SystemParametersInfoW, SetPropW, RedrawWindow, SendMessageW, wsprintfW, GetSysColor, CharPrevW, GetWindowPlacement, GetSystemMetrics, SetWindowTextW, LoadStringW, DdeCreateStringHandleW, DdeConnect, GetMonitorInfoW, DdeInitializeW, DdeUninitialize, DialogBoxIndirectParamW, DdeClientTransaction, SetLayeredWindowAttributes, CharUpperBuffW, DdeDisconnect, DdeFreeStringHandle, SetForegroundWindow, LoadImageW, ReleaseDC, GetPropW, RemovePropW, DispatchMessageW, PeekMessageW, TranslateMessage, GetWindowLongW, GetWindowTextLengthW, GetSystemMenu, AdjustWindowRectEx, PostMessageW, CheckMenuRadioItem, GetWindowRect, GetFocus, DestroyWindow, SetWindowPos, CheckRadioButton, MessageBoxExW, CreateWindowExW, EndDialog, MessageBeep, CreatePopupMenu, WindowFromPoint, DestroyCursor, ShowWindow, DestroyIcon, GetDlgCtrlID, SetDlgItemTextW, MapWindowPoints, GetDlgItemTextW, SendDlgItemMessageW, IsWindowEnabled, IsDlgButtonChecked, DestroyMenu, GetMenuStringW, CharNextW, LoadIconW, LoadCursorW, GetClassNameW, SetCapture, InsertMenuW, SetCursor, SetWindowLongW, TrackPopupMenuEx, GetComboBoxInfo, GetClientRect, GetDlgItem, AppendMenuW, CheckDlgButton, GetParent, ReleaseCapture, InvalidateRect, ChildWindowFromPoint, GetCursorPos, EnableWindow, GetWindowTextW, SetRect
KERNEL32.dll	RaiseException, GetSystemInfo, VirtualQuery, GetModuleHandleW, LoadLibraryExA, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, DecodePointer, WakeAllConditionVariable, SleepConditionVariableSRW, UnhandledExceptionFilter, ReadConsoleW, GetConsoleMode, VirtualProtect, CompareStringOrdinal, FreeLibrary, LoadLibraryExW, ReadFile, lstrlenW, WriteFile, lstrcpynW, ExpandEnvironmentStringsW, GetModuleFileNameW, SetFilePointer, SetEndOfFile, UnlockFileEx, CreateFileW, GetSystemDirectoryW, MultiByteToWideChar, lstrcatW, CloseHandle, LockFileEx, GetFileSize, WideCharToMultiByte, lstrcpyW, lstrcmpiW, lstrcmpW, FlushFileBuffers, GetShortPathNameW, LocalAlloc, GetFileAttributesW, SetFileAttributesW, FormatMessageW, GetLastError, GetCurrentDirectoryW, LocalFree, WaitForSingleObject, CreateEventW, SetEvent, GlobalAlloc, GlobalFree, ResetEvent, SizeofResource, SearchPathW, GetLocaleInfoEx, FreeResource, OpenProcess, LockResource, LoadLibraryW, LoadResource, FindResourceW, GetWindowsDirectoryW, GetProcAddress, GlobalLock, GlobalUnlock, MulDiv, CreateDirectoryW, FindFirstFileW, GetCommandLineW, SetThreadUILanguage, SetErrorMode, FindClose, GetUserPreferredUILanguages, FindFirstChangeNotificationW, GetVersion, ResolveLocaleName, GlobalSize, FileTimeToSystemTime, FindCloseChangeNotification, FileTimeToLocalFileTime, FindNextChangeNotification, SetCurrentDirectoryW, GetTimeFormatW, VerSetConditionMask, CopyFileW, VerifyVersionInfoW, SetThreadPreferredUILanguages, IsValidLocaleName, GetDateFormatW, MapViewOfFile, CreateFileMappingW, LocaleNameToLCID, FindResourceExW, LCIDToLocaleName, UnmapViewOfFile, GetVersionExW, GetLocaleInfoW, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, SetLastError, SetUnhandledExceptionFilter, GetConsoleOutputCP, HeapReAlloc, HeapSize, SetFilePointerEx, GetFileSizeEx, GetStringTypeW, SetStdHandle, OutputDebugStringW, SetConsoleCtrlHandler, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, LCMapStringW, CompareStringW, GetTempPathW, GetFileType, HeapAlloc, HeapFree, GetCurrentThread, GetStdHandle, ExitProcess, GetModuleHandleExW, FreeLibraryAndExitThread, ResumeThread, ExitThread, CreateThread, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, EncodePointer, InterlockedFlushSList, InterlockedPushEntrySList, RtlUnwind, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, WriteConsoleW
GDI32.dll	GetStockObject, SetBkColor, ExtTextOutW, EnumFontsW, GetDeviceCaps, SetTextColor, GetObjectW, DeleteObject, CreateSolidBrush, CreateFontIndirectW
COMDLG32.dll	GetOpenFileNameW, ChooseColorW, GetSaveFileNameW
ADVAPI32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
SHELL32.dll	SHGetFolderPathW, SHGetSpecialFolderPathW, ShellExecuteW, SHCreateDirectoryExW, SHFileOperationW, SHBrowseForFolderW, SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHGetFileInfoW, SHGetDesktopFolder, SHAppBarMessage, DragQueryFileW, Shell_NotifyIconW, DragAcceptFiles, DragFinish, SHGetDataFromIDListW
ole32.dll	OleUninitialize, CoCreateInstance, OleInitialize, CoUninitialize, CoTaskMemAlloc, CoTaskMemFree, CoInitialize, DoDragDrop
ntdll.dll	RtlGetNtVersionNumbers
COMCTL32.dll	ImageList_Create, PropertySheetW, ImageList_Destroy, InitCommonControlsEx, InitMUILanguage, ImageList_AddMasked

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 13:34:11.783355951 CET	49730	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:11.789092064 CET	9292	49730	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:11.789196014 CET	49730	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:11.789288044 CET	49730	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:11.794573069 CET	9292	49730	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:16.787244081 CET	49730	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:16.833224058 CET	9292	49730	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:20.280524969 CET	9292	49730	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:20.280611992 CET	49730	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:21.799123049 CET	49732	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:21.805236101 CET	9292	49732	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:21.805329084 CET	49732	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:21.805419922 CET	49732	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:21.810806036 CET	9292	49732	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:26.819540024 CET	49732	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:26.869214058 CET	9292	49732	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:30.277496099 CET	9292	49732	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:30.277601004 CET	49732	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:31.814790964 CET	57285	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:31.820261955 CET	9292	57285	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:31.820384979 CET	57285	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:31.826812983 CET	57285	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:31.832305908 CET	9292	57285	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:36.817424059 CET	57285	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:36.864985943 CET	9292	57285	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:40.304459095 CET	9292	57285	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:40.304517984 CET	57285	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:41.830601931 CET	61613	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:41.836396933 CET	9292	61613	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:41.836488008 CET	61613	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:41.836597919 CET	61613	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:41.841995001 CET	9292	61613	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:46.835638046 CET	61613	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:46.885063887 CET	9292	61613	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:50.330899954 CET	9292	61613	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:50.330985069 CET	61613	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:51.846118927 CET	61614	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:51.851573944 CET	9292	61614	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:51.851684093 CET	61614	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:51.851799965 CET	61614	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:51.857112885 CET	9292	61614	138.201.226.224	192.168.2.4
Oct 27, 2024 13:34:56.864299059 CET	61614	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:34:56.916925907 CET	9292	61614	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:00.346184015 CET	9292	61614	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:00.346270084 CET	61614	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:01.861726999 CET	61656	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:01.867188931 CET	9292	61656	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:01.867331028 CET	61656	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:01.869628906 CET	61656	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:01.875085115 CET	9292	61656	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:06.864937067 CET	61656	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:06.912849903 CET	9292	61656	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:10.350969076 CET	9292	61656	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:10.351082087 CET	61656	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:11.861601114 CET	61703	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:11.868324995 CET	9292	61703	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:11.868417978 CET	61703	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:11.868556023 CET	61703	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:11.874031067 CET	9292	61703	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:16.880661011 CET	61703	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:16.932826042 CET	9292	61703	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:20.352214098 CET	9292	61703	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:20.352279902 CET	61703	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:21.877628088 CET	61763	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:21.883035898 CET	9292	61763	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:21.883117914 CET	61763	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:21.885938883 CET	61763	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:21.891283989 CET	9292	61763	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:26.879899025 CET	61763	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:26.928884983 CET	9292	61763	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:30.373018026 CET	9292	61763	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:30.373071909 CET	61763	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:31.877552986 CET	61815	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:31.883064032 CET	9292	61815	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:31.883183002 CET	61815	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:31.883372068 CET	61815	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:31.888717890 CET	9292	61815	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:36.895448923 CET	61815	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:36.944798946 CET	9292	61815	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:40.615582943 CET	9292	61815	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:40.615657091 CET	61815	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:40.615808964 CET	9292	61815	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:40.615875006 CET	61815	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:40.621521950 CET	9292	61815	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:41.908468962 CET	61870	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:41.913906097 CET	9292	61870	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:41.914000988 CET	61870	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:41.914097071 CET	61870	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:41.919430017 CET	9292	61870	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:46.926808119 CET	61870	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:46.972876072 CET	9292	61870	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:50.421715021 CET	9292	61870	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:50.421792984 CET	61870	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:51.924335957 CET	61886	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:52.008287907 CET	9292	61886	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:52.008548021 CET	61886	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:52.008642912 CET	61886	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:52.014027119 CET	9292	61886	138.201.226.224	192.168.2.4
Oct 27, 2024 13:35:56.943942070 CET	61886	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:35:56.992861032 CET	9292	61886	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:00.754256010 CET	9292	61886	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:00.754374027 CET	61886	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:36:00.754688978 CET	9292	61886	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:00.754750013 CET	61886	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:36:00.760144949 CET	9292	61886	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:01.956406116 CET	61887	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:36:01.961944103 CET	9292	61887	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:01.962044954 CET	61887	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:36:01.962173939 CET	61887	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:36:01.967758894 CET	9292	61887	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:06.959000111 CET	61887	9292	192.168.2.4	138.201.226.224
Oct 27, 2024 13:36:07.005232096 CET	9292	61887	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:10.440973043 CET	9292	61887	138.201.226.224	192.168.2.4
Oct 27, 2024 13:36:10.441144943 CET	61887	9292	192.168.2.4	138.201.226.224

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 13:34:25.540486097 CET	53	51059	1.1.1.1	192.168.2.4
Oct 27, 2024 13:34:39.244575977 CET	53	54382	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	08:34:03
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\dZIZhRHDXv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dZIZhRHDXv.exe"
Imagebase:	0xd80000
File size:	1'374'208 bytes
MD5 hash:	E5A12459A39AA142A12C58D9AFBE5B0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.1791313957.00000000006A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1793547768.0000000004250000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1793351393.0000000004030000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000002.1798820760.0000000003B30000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:34:07
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\dialer.exe"
Imagebase:	0x340000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000003.1822087119.0000000005475000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000003.1794640183.00000000033E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000003.1796910103.0000000005720000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000003.1796719456.0000000005500000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:34:07
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 708
Imagebase:	0x570000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:34:07
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 704
Imagebase:	0x570000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.3%
Total number of Nodes:	787
Total number of Limit Nodes:	17

Executed Functions

Function 00DEA0B0 Relevance: 130.0, APIs: 18, Strings: 56, Instructions: 534
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DE7E40: PathFileExistsW.SHLWAPI(00E7D538,?,?,00DE9F72,98D825DA), ref: 00DE7E57
Part of subcall function 00DE7E40: PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE7E6A

SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,C:\Users\user\Documents), ref: 00DEA349
GetSystemDirectoryW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,00000104), ref: 00DEA39A
PathAddBackslashW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 00DEA3A5
lstrcatW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,Viewers\Quikview.exe), ref: 00DEA3B5
lstrcpyW.KERNEL32(00E7F77C,%USERPROFILE%\Desktop), ref: 00DEA417

Part of subcall function 00DFB620: StrCmpNIW.SHLWAPI(C:\Users\user\Documents,%CSIDL:MYDOCUMENTS%,00000013,?,00000002), ref: 00DFB643
Part of subcall function 00DFB620: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000002), ref: 00DFB663
Part of subcall function 00DFB620: PathAppendW.SHLWAPI(?,?,?,00000002), ref: 00DFB675
Part of subcall function 00DFB620: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,?,00000002), ref: 00DFB69B
Part of subcall function 00DFB620: lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 00DFB6BA
Part of subcall function 00DFB620: PathIsRelativeW.SHLWAPI(?,?,00000002), ref: 00DFB6C4
Part of subcall function 00DFB620: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,?,00000002), ref: 00DFB6DA
Part of subcall function 00DFB620: PathRemoveFileSpecW.SHLWAPI(?,?,00000002), ref: 00DFB6E5
Part of subcall function 00DFB620: PathAppendW.SHLWAPI(?,?,?,00000002), ref: 00DFB6F8
Part of subcall function 00DFB620: PathCanonicalizeW.SHLWAPI(?,?,?,00000002), ref: 00DFB71C
Part of subcall function 00DFB620: lstrcpyW.KERNEL32(?,?,?,00000002), ref: 00DFB733
Part of subcall function 00DFB620: PathGetDriveNumberW.SHLWAPI(?,?,00000002), ref: 00DFB73E
Part of subcall function 00DFB620: CharUpperBuffW.USER32(00000001,00000001,?,00000002), ref: 00DFB750
Part of subcall function 00DFB620: lstrcpynW.KERNEL32(C:\Users\user\Documents,00000104,00000104,?,00000002), ref: 00DFB776

Part of subcall function 00DFB620: lstrcpynW.KERNEL32(?,C:\Users\user\Documents,00000104,?,00000002), ref: 00DFB684
Part of subcall function 00DFB620: lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 00DFB70D

Part of subcall function 00DE89E0: lstrlenW.KERNEL32(?,00000000,Settings2,?,?,?), ref: 00DE8A9D

SHGetSpecialFolderPathW.SHELL32(00000000,C:\Users\user\Desktop,00000010,00000001), ref: 00DEA47F
lstrcpyW.KERNEL32(*.*,*.*), ref: 00DEA532
lstrcpynW.KERNEL32(00E81AFC,00000000,00000100), ref: 00DEA585
GetSysColor.USER32(00000008), ref: 00DEA5ED
GetSysColor.USER32(0000000D), ref: 00DEA615
lstrcpyW.KERNEL32(00E7F984,1 2 3 4 5 0 8), ref: 00DEA645
lstrcpyW.KERNEL32(00E810E4,00E7F984), ref: 00DEA676
GetSystemMetrics.USER32(00000000), ref: 00DEA772
GetSystemMetrics.USER32(00000001), ref: 00DEA778
wsprintfW.USER32 ref: 00DEA7FD
wsprintfW.USER32 ref: 00DEA80D
wsprintfW.USER32 ref: 00DEA81D
wsprintfW.USER32 ref: 00DEA82D

Strings

ShowStatusbar, xrefs: 00DEA6A2
Favorites, xrefs: 00DEA2D8, 00DEA315
CopyMoveDlgSizeX, xrefs: 00DEA74D
ToolbarButtons, xrefs: 00DEA656
GotoDlgSizeX, xrefs: 00DEA6DE
%ix%i PosY, xrefs: 00DEA801
ShowDriveBox, xrefs: 00DEA6C0
OpenWithDir, xrefs: 00DEA428, 00DEA44D
DefColorFilter, xrefs: 00DEA5D3
%ix%i SizeX, xrefs: 00DEA811
NoConfirmDelete, xrefs: 00DEA194
ColorNoFilter, xrefs: 00DEA5F5
%ix%i PosX, xrefs: 00DEA7EE
FillMask, xrefs: 00DEA4A8
SortReverse, xrefs: 00DEA516
NegativeFilter, xrefs: 00DEA597
BitmapHot, xrefs: 00DEA7AC
SingleClick, xrefs: 00DEA11C
TrackSelect, xrefs: 00DEA13A
UseRecycleBin, xrefs: 00DEA176
C:\Users\user\Desktop, xrefs: 00DEA41E, 00DEA443, 00DEA466, 00DEA478, 00DEA48C
*.*, xrefs: 00DEA52D, 00DEA547
OpenWithDlgSizeY, xrefs: 00DEA728
Settings, xrefs: 00DEA26B, 00DEA2A1, 00DEA2DD, 00DEA31A, 00DEA37F, 00DEA3FA, 00DEA42D, 00DEA452, 00DEA4AD, 00DEA4E6, 00DEA551, 00DEA5FA, 00DEA622, 00DEA65B, 00DEA6E3, 00DEA708, 00DEA72D, 00DEA752
C:\Windows\system32\Viewers\Quikview.exe, xrefs: 00DEA370, 00DEA395, 00DEA3A0, 00DEA3B0, 00DEA3C2, 00DEA3CF
ColorFilter, xrefs: 00DEA61D
%ix%i SizeY, xrefs: 00DEA821
BitmapDefault, xrefs: 00DEA78B
1 2 3 4 5 0 8, xrefs: 00DEA63B
RenameOnCollision, xrefs: 00DEA1D0
SaveSettings, xrefs: 00DEA0FE
FocusLostOpacity, xrefs: 00DEA8F3
C:\Users\user\Documents, xrefs: 00DEA2CE, 00DEA30B, 00DEA32E, 00DEA33C, 00DEA356
%USERPROFILE%\Desktop, xrefs: 00DEA407
AlwaysOnTop, xrefs: 00DEA20C
Window, xrefs: 00DEA83B, 00DEA859, 00DEA877, 00DEA895
MinimizeToTray, xrefs: 00DEA22A
FileFilter, xrefs: 00DEA54C
Toolbar Images, xrefs: 00DEA790, 00DEA7B1, 00DEA7D2
FocusEdit, xrefs: 00DEA1EE
Settings2, xrefs: 00DEA8CC, 00DEA8F8
EscFunction, xrefs: 00DEA266
SortOptions, xrefs: 00DEA4E1
Quikview.exe, xrefs: 00DEA37A
BitmapDisabled, xrefs: 00DEA7CD
FullRowSelect, xrefs: 00DEA158
ShowToolbar, xrefs: 00DEA684
OpenWithDlgSizeX, xrefs: 00DEA703
DefColorNoFilter, xrefs: 00DEA5B5
*.*, xrefs: 00DEA528
TransparentMode, xrefs: 00DEA248
StartupDirectory, xrefs: 00DEA29C
ClearReadOnly, xrefs: 00DEA1B2
OpacityLevel, xrefs: 00DEA8C7
QuikviewParams, xrefs: 00DEA3F5
Viewers\Quikview.exe, xrefs: 00DEA3AB

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$lstrcpylstrcpyn$wsprintf$FileFolderSystem$AppendColorDirectoryMetrics$BackslashBuffCanonicalizeCharDriveEnvironmentExistsExpandModuleNameNumberRelativeRemoveSpecSpecialStringsUpperlstrcatlstrlen
String ID: %USERPROFILE%\Desktop$%ix%i PosX$%ix%i PosY$%ix%i SizeX$%ix%i SizeY$*.*$*.*$1 2 3 4 5 0 8$AlwaysOnTop$BitmapDefault$BitmapDisabled$BitmapHot$C:\Users\user\Desktop$C:\Users\user\Documents$C:\Windows\system32\Viewers\Quikview.exe$ClearReadOnly$ColorFilter$ColorNoFilter$CopyMoveDlgSizeX$DefColorFilter$DefColorNoFilter$EscFunction$Favorites$FileFilter$FillMask$FocusEdit$FocusLostOpacity$FullRowSelect$GotoDlgSizeX$MinimizeToTray$NegativeFilter$NoConfirmDelete$OpacityLevel$OpenWithDir$OpenWithDlgSizeX$OpenWithDlgSizeY$Quikview.exe$QuikviewParams$RenameOnCollision$SaveSettings$Settings$Settings2$ShowDriveBox$ShowStatusbar$ShowToolbar$SingleClick$SortOptions$SortReverse$StartupDirectory$Toolbar Images$ToolbarButtons$TrackSelect$TransparentMode$UseRecycleBin$Viewers\Quikview.exe$Window
API String ID: 3534769242-206820148
Opcode ID: c45982efb6fb56da558438e38bfff7c967d83064b110490a6178714f87af22de
Instruction ID: 9e3c1b3f78e7a8afe4df86cd7eb48a377968fab0aeaaeddafbd1ed4065b92e5a
Opcode Fuzzy Hash: c45982efb6fb56da558438e38bfff7c967d83064b110490a6178714f87af22de
Instruction Fuzzy Hash: 9D1290F1A403819FEB54FB66BC037163691EB84704F109439E60DBA3D1FBB198499B76

Function 00DFE360 Relevance: 93.1, APIs: 43, Strings: 10, Instructions: 336
windowcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00DFE38D
SetErrorMode.KERNELBASE(00008001), ref: 00DFE3B0

Part of subcall function 00DE7440: RtlGetNtVersionNumbers.NTDLL ref: 00DE7461
Part of subcall function 00DE7440: LoadLibraryExW.KERNEL32(comctl32.dll,00000000,00000800), ref: 00DE74E3
Part of subcall function 00DE7440: FreeLibrary.KERNEL32(00000000), ref: 00DE7531

GetSysColor.USER32(00000008), ref: 00DFE417
GetSysColor.USER32(00000005), ref: 00DFE420
GetSysColor.USER32(00000017), ref: 00DFE429
GetSysColor.USER32(00000018), ref: 00DFE432
GetSysColor.USER32(0000000E), ref: 00DFE43B
GetSysColor.USER32(0000000D), ref: 00DFE444
GetSysColor.USER32(00000002), ref: 00DFE44D
GetSysColor.USER32(00000001), ref: 00DFE456
GetSysColor.USER32(0000000F), ref: 00DFE45F
GetSysColor.USER32(0000000F), ref: 00DFE468
GetSysColor.USER32(0000000F), ref: 00DFE471
GetSysColor.USER32(0000000F), ref: 00DFE47A
GetSysColor.USER32(0000000F), ref: 00DFE483
GetSysColor.USER32(0000000F), ref: 00DFE48C

Part of subcall function 00E055E0: GetCommandLineW.KERNEL32(?,75BFCF90,?,?,?,00DFE4A6), ref: 00E055E5
Part of subcall function 00E055E0: StrChrW.SHLWAPI(00000000,00000009,?,?,?,00DFE4A6), ref: 00E05609
Part of subcall function 00E055E0: StrChrW.SHLWAPI(00000000,00000009,?,?,?,00DFE4A6), ref: 00E0561A
Part of subcall function 00E055E0: lstrlenW.KERNEL32(00000000,?,?,?,00DFE4A6), ref: 00E0562C
Part of subcall function 00E055E0: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,00DFE4A6), ref: 00E0563E
Part of subcall function 00E055E0: lstrlenW.KERNEL32(00000000,?,?,?,00DFE4A6), ref: 00E05643
Part of subcall function 00E055E0: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,00DFE4A6), ref: 00E0564F
Part of subcall function 00E055E0: lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E0565B
Part of subcall function 00E055E0: StrChrW.SHLWAPI(00000000,00000020,?,?,?,00DFE4A6), ref: 00E05693
Part of subcall function 00E055E0: lstrcpyW.KERNEL32(00000000,-00000002,?,?,?,00DFE4A6), ref: 00E056A7
Part of subcall function 00E055E0: lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E056D5
Part of subcall function 00E055E0: StrChrW.SHLWAPI(00000000,00000020,?,?,?,00DFE4A6), ref: 00E0570B

Part of subcall function 00DE9990: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,75BFCF90), ref: 00DE99B6
Part of subcall function 00DE9990: lstrcmpiW.KERNEL32(00E7D538,00E74724), ref: 00DE99D4

Part of subcall function 00DE9C80: lstrcmpiW.KERNEL32(00E7D538,00E74724,75BFCF90), ref: 00DE9C9F
Part of subcall function 00DE9C80: lstrcpyW.KERNEL32(C:\Users\user\Desktop\dZIZhRHDXv.ini,00E74520), ref: 00DE9CB9
Part of subcall function 00DE9C80: lstrcpyW.KERNEL32(00E7D538,00E74520), ref: 00DE9CC5

Part of subcall function 00DE95B0: StrRChrW.SHLWAPI(00E7D538,00000000,0000005C,?,?,?,00DEA9C3), ref: 00DE95CA
Part of subcall function 00DE95B0: SHCreateDirectoryExW.SHELL32(00000000,00E7D538,00000000,?,?,?,00DEA9C3), ref: 00DE95E2
Part of subcall function 00DE95B0: PathFileExistsW.SHLWAPI(00E7D538,?,?,?,00DEA9C3), ref: 00DE95F5
Part of subcall function 00DE95B0: PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE9604
Part of subcall function 00DE95B0: CreateFileW.KERNEL32(00E7D538,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,00DEA9C3), ref: 00DE9623
Part of subcall function 00DE95B0: GetFileSize.KERNEL32(00000000,?), ref: 00DE963E
Part of subcall function 00DE95B0: CloseHandle.KERNEL32(00000000), ref: 00DE9647

Part of subcall function 00E06140: EnumWindows.USER32(00E060C0,00000000), ref: 00E06181
Part of subcall function 00E06140: IsWindowEnabled.USER32(00000000), ref: 00E06194
Part of subcall function 00E06140: IsIconic.USER32(00000000), ref: 00E061A6
Part of subcall function 00E06140: ShowWindowAsync.USER32(00000009,00000009), ref: 00E061B6
Part of subcall function 00E06140: IsWindowVisible.USER32(00000000), ref: 00E061C0
Part of subcall function 00E06140: SendMessageW.USER32(00000400,00000400,00000000,00000203), ref: 00E061E0
Part of subcall function 00E06140: SendMessageW.USER32(00000400,00000400,00000000,00000202), ref: 00E061F2
Part of subcall function 00E06140: SetForegroundWindow.USER32(00000000), ref: 00E061F8
Part of subcall function 00E06140: GlobalSize.KERNEL32(00000000), ref: 00E0620C
Part of subcall function 00E06140: PathIsRelativeW.SHLWAPI ref: 00E06227
Part of subcall function 00E06140: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00E0623B
Part of subcall function 00E06140: PathAppendW.SHLWAPI(?), ref: 00E0624C
Part of subcall function 00E06140: lstrcpyW.KERNEL32(?), ref: 00E0625D
Part of subcall function 00E06140: GlobalSize.KERNEL32 ref: 00E06271
Part of subcall function 00E06140: SendMessageW.USER32(?,0000004A,00000000,?), ref: 00E06291
Part of subcall function 00E06140: GlobalFree.KERNEL32 ref: 00E06299

OleInitialize.OLE32(00000000), ref: 00DFE4C8
InitCommonControlsEx.COMCTL32(?), ref: 00DFE4EB
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00DFE4F6

Part of subcall function 00DE7440: VirtualProtect.KERNELBASE(00000000,00000004,00000004,?,?), ref: 00DE7579
Part of subcall function 00DE7440: VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 00DE759F
Part of subcall function 00DE7440: FreeLibrary.KERNEL32(00000000), ref: 00DE75A3

GetSysColor.USER32(00000005), ref: 00DFE52C
CreateSolidBrush.GDI32(00000000), ref: 00DFE535
GetSysColor.USER32(0000000F), ref: 00DFE557
CreateSolidBrush.GDI32(00000000), ref: 00DFE55A
StrStrIW.SHLWAPI(af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T,en-US), ref: 00DFE56B
GetSystemMetrics.USER32(0000000B), ref: 00DFE5AF
GetSystemMetrics.USER32(0000000C), ref: 00DFE5B5
GetSystemMetrics.USER32(00000031), ref: 00DFE5BD
GetSystemMetrics.USER32(00000032), ref: 00DFE5C5
#381.COMCTL32(?,00000064,00000000,?,00E7E444,?,?,00000400), ref: 00DFE5E9
#381.COMCTL32(?,00000064,?,00000000,00E7D9F0,?,?,00000400), ref: 00DFE605
LoadCursorW.USER32 ref: 00DFE63A
RegisterClassW.USER32 ref: 00DFE661
LoadAcceleratorsW.USER32(?,00000064), ref: 00DFE68B

Part of subcall function 00DE7010: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 00DE7041

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFE6A6
TranslateAcceleratorW.USER32(00000000,?,?), ref: 00DFE6BC
TranslateMessage.USER32(?), ref: 00DFE6C7
DispatchMessageW.USER32(?), ref: 00DFE6D2
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFE6E3
OleUninitialize.OLE32(?,?,00000400), ref: 00DFE6FC
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00DFE7B6
SetThreadUILanguage.KERNEL32(75297340), ref: 00DFE7DD
lstrcmpW.KERNEL32(en-US,en-US), ref: 00DFE7ED
InitMUILanguage.COMCTL32(75297340,lng/mplng.dll,00000008,75297340), ref: 00DFE817

Strings

lng/mplng.dll, xrefs: 00DFE802
333, xrefs: 00DFE54E
MiniPath, xrefs: 00DFE659
Settings2, xrefs: 00DFE58D
*.*, xrefs: 00DFE3F7
af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T, xrefs: 00DFE561, 00DFE732
en-US, xrefs: 00DFE583, 00DFE7E3
TaskbarCreated, xrefs: 00DFE4F1
PreferredLanguageLocaleName, xrefs: 00DFE588
en-US, xrefs: 00DFE55C, 00DFE7CF, 00DFE7E8

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Color$Message$lstrcpy$SystemWindow$CreateFileMetricsPath$DirectoryFreeGlobalLibraryLoadSendSize$#381AllocBrushInitLanguageLocalProtectRegisterSolidThreadTranslateVersionVirtuallstrcmpilstrlen$AcceleratorAcceleratorsAppendAsyncClassCloseCommandCommonControlsCurrentCursorDispatchEnabledEnumErrorExistsForegroundHandleIconicInfoInitializeLanguagesLineModeModuleNameNumbersParametersPreferredRelativeShowUninitializeVisibleWindowslstrcmp
String ID: *.*$333$MiniPath$PreferredLanguageLocaleName$Settings2$TaskbarCreated$af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T$en-US$en-US$lng/mplng.dll
API String ID: 1059946812-3937950211
Opcode ID: 84adb6bcd0054141f2955a9dea3c18b88d9adb3f35d655ecda17c88b62927377
Instruction ID: cef2a6803c84696637a09f7c1f455f376cee7b7f2b7acbf2d77eb3c9707bcd84
Opcode Fuzzy Hash: 84adb6bcd0054141f2955a9dea3c18b88d9adb3f35d655ecda17c88b62927377
Instruction Fuzzy Hash: 87C1A771A043449FD710EF72EC09B6B7BE5FF48744F04481AF648A72A1EBB59448CBA2

Function 00DFEFB0 Relevance: 74.1, APIs: 49, Instructions: 564
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindowVisible.USER32(?), ref: 00DFFFAA

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: VisibleWindow
String ID:
API String ID: 1208467747-0
Opcode ID: c515f196704aa852c0b05469e71a6d5e3fa166f6989e7a6b456450c6aa170efb
Instruction ID: 082dec3d87f95b3762d92b4daddf2bc2924f874ccef9bb37437fdea3d4da3568
Opcode Fuzzy Hash: c515f196704aa852c0b05469e71a6d5e3fa166f6989e7a6b456450c6aa170efb
Instruction Fuzzy Hash: EC022A323042089FD320AB25EC4AFBF77A9EF89711F04852AF646B61D1DFB4584597A2

Function 00E06140 Relevance: 30.1, APIs: 20, Instructions: 137
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00E060C0,00000000), ref: 00E06181
IsWindowEnabled.USER32(00000000), ref: 00E06194
IsIconic.USER32(00000000), ref: 00E061A6
ShowWindowAsync.USER32(00000009,00000009), ref: 00E061B6
IsWindowVisible.USER32(00000000), ref: 00E061C0
SendMessageW.USER32(00000400,00000400,00000000,00000203), ref: 00E061E0
SendMessageW.USER32(00000400,00000400,00000000,00000202), ref: 00E061F2
SetForegroundWindow.USER32(00000000), ref: 00E061F8
GlobalSize.KERNEL32(00000000), ref: 00E0620C
PathIsRelativeW.SHLWAPI ref: 00E06227
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00E0623B
PathAppendW.SHLWAPI(?), ref: 00E0624C
lstrcpyW.KERNEL32(?), ref: 00E0625D
GlobalSize.KERNEL32 ref: 00E06271
SendMessageW.USER32(?,0000004A,00000000,?), ref: 00E06291
GlobalFree.KERNEL32 ref: 00E06299
LoadStringW.USER32(0000C35F,?,00000100), ref: 00E062D5
LoadStringW.USER32(0000C35F,?,00000100), ref: 00E062F0
StrChrW.SHLWAPI(?,0000000A), ref: 00E062F9
MessageBoxW.USER32(00000000,00000000,?,00010024), ref: 00E06318

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: MessageWindow$GlobalSend$LoadPathSizeString$AppendAsyncCurrentDirectoryEnabledEnumForegroundFreeIconicRelativeShowVisibleWindowslstrcpy
String ID:
API String ID: 648661597-0
Opcode ID: 3ffd40735de35b8df09efedeb9c1ee96155a4865160fdf201b8c67703f018a05
Instruction ID: e0ddd1563e58b362cf2d76fa97b54b592b5ab7dcc755567e4eca5ff54710b1d0
Opcode Fuzzy Hash: 3ffd40735de35b8df09efedeb9c1ee96155a4865160fdf201b8c67703f018a05
Instruction Fuzzy Hash: 9D517A31344305AFE710DF61EC09B5B3BE9EB58B84F404429F559BA2F0EBB49899CB52

Function 02902F40 Relevance: 9.4, APIs: 4, Strings: 1, Instructions: 614memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00100000,01000000,?,00000000), ref: 02902F55

Part of subcall function 029010D0: RtlAllocateHeap.NTDLL(00000000), ref: 029010E5
Part of subcall function 029010D0: RtlFreeHeap.NTDLL(00000000,?,?,00000000), ref: 0290118C

RtlAllocateHeap.NTDLL(00000000), ref: 02903728
CloseHandle.KERNELBASE(?,?,000003E8), ref: 02903ABB
VirtualFree.KERNELBASE(?,00000000,?,?,?,000003E8), ref: 02903B11

Strings

8, xrefs: 029030B5

Memory Dump Source

Source File: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID: Heap$AllocateFree$CloseCreateHandleVirtual
String ID: 8
API String ID: 2208713888-4194326291
Opcode ID: dd4c42926a46e8288dd0f9414e768b2213c427a86a62db195dc2bc24e15ebdf9
Instruction ID: b4507c01557f3548832410f436b336c8860ca6d54bbba6f46b1b665c6b452902
Opcode Fuzzy Hash: dd4c42926a46e8288dd0f9414e768b2213c427a86a62db195dc2bc24e15ebdf9
Instruction Fuzzy Hash: D25238B06083849FD774CF65C988BAFBBE5BBC9308F50896DE59997240DB309448CF96

Function 029102CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?,?,0000000B), ref: 02910311

Part of subcall function 02910098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 029100C1
Part of subcall function 02910098: VirtualFree.KERNELBASE(00000000,00000000,?), ref: 0291026D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004,?,?,?,00000000,?,?,0000000B), ref: 02910363
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C,00000000,00000000,?,?,0000000B), ref: 029103BD
VirtualFree.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,?,0000000B), ref: 029103F0

Strings

,, xrefs: 02910341

Memory Dump Source

Source File: 00000000.00000003.1791398308.0000000002910000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Associated: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction ID: 1dc627fdcd98b1a5cc320a9488cf501e9c831883eeda3c23439fecd7c8311993
Opcode Fuzzy Hash: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction Fuzzy Hash: 7541E8B5900709EFCB10DFA9C881B9EBBF8FF08354F10851AE959A7640D371E990CBA4

Function 00DE9C80 Relevance: 91.2, APIs: 47, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNEL32(00E7D538,00E74724,75BFCF90), ref: 00DE9C9F
lstrcpyW.KERNEL32(C:\Users\user\Desktop\dZIZhRHDXv.ini,00E74520), ref: 00DE9CB9
lstrcpyW.KERNEL32(00E7D538,00E74520), ref: 00DE9CC5
PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE9CED
lstrlenW.KERNEL32(00E7D538), ref: 00DE9D0A
CharPrevW.USER32(00E7D538,00000000), ref: 00DE9D1D
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00DE9D39
PathFindFileNameW.SHLWAPI(?), ref: 00DE9D44
PathAppendW.SHLWAPI(00E7D538,00000000), ref: 00DE9D4C
PathRenameExtensionW.SHLWAPI(00E7D538,.ini), ref: 00DE9D5C
PathFileExistsW.SHLWAPI(00E7D538), ref: 00DE9D67
PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE9D72
PathFindFileNameW.SHLWAPI(00E7D538,minipath.ini), ref: 00DE9D82
lstrcpyW.KERNEL32(00000000), ref: 00DE9D85
PathFileExistsW.SHLWAPI(00E7D538), ref: 00DE9D8C
PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE9D97
PathFindFileNameW.SHLWAPI(?), ref: 00DE9DA2
PathFindFileNameW.SHLWAPI(00E7D538), ref: 00DE9DAB
lstrcpyW.KERNEL32(00000000,00000000), ref: 00DE9DAF
PathRenameExtensionW.SHLWAPI(00E7D538,.ini), ref: 00DE9DBB
PathIsDirectoryW.SHLWAPI(00E7D330), ref: 00DE9DCC
lstrlenW.KERNEL32(00E7D330), ref: 00DE9DD7
CharPrevW.USER32(00E7D330,00000000), ref: 00DE9DEA
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00DE9E06
PathRemoveFileSpecW.SHLWAPI(?), ref: 00DE9E11
lstrcatW.KERNEL32(?,\Notepad3.exe), ref: 00DE9E21
PathFindFileNameW.SHLWAPI(?), ref: 00DE9E2C
PathAppendW.SHLWAPI(00E7D330,00000000), ref: 00DE9E34
PathRenameExtensionW.SHLWAPI(00E7D330,.ini), ref: 00DE9E44

Strings

notepad3.ini, xrefs: 00DE9E60
C:\Users\user\Desktop\dZIZhRHDXv.ini, xrefs: 00DE9CB4, 00DE9EFE
\Notepad3.exe, xrefs: 00DE9E17
.ini, xrefs: 00DE9D52, 00DE9DB1, 00DE9E3A, 00DE9E99
minipath.ini, xrefs: 00DE9D78

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$File$Name$Find$Directorylstrcpy$ExtensionRename$AppendCharExistsModulePrevlstrlen$RemoveSpeclstrcatlstrcmpi
String ID: .ini$C:\Users\user\Desktop\dZIZhRHDXv.ini$\Notepad3.exe$minipath.ini$notepad3.ini
API String ID: 882991028-3868156248
Opcode ID: 3c3c1a45d43ade137ba026d8c13f00b7765942f3b8618873a6086c8cee6826ff
Instruction ID: 45510963693984f780a58c852c889f1624bc06a699e48298bf7a243b5549e45f
Opcode Fuzzy Hash: 3c3c1a45d43ade137ba026d8c13f00b7765942f3b8618873a6086c8cee6826ff
Instruction Fuzzy Hash: 4E5175A1785349FFD610BBB6AC46E2B7AB8EF44FC9B449015F548F61D0DBE0D8048A72

Function 00DFE910 Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 303
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromRect.USER32(?,00000002), ref: 00DFE989
GetMonitorInfoW.USER32(00000000,?), ref: 00DFE9A3
SetRect.USER32(00000028,?,00000000,?,?), ref: 00DFEA7F
IntersectRect.USER32(?,?,?), ref: 00DFEA9D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00DFEB01
CreateWindowExW.USER32(00000000,MiniPath,MinPath,82CC0000,?,?,00000110,00000280,00000000,00000000,?,00000000), ref: 00DFEB54
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 00DFEB78
GetWindowLongW.USER32(00000000,000000EC), ref: 00DFEB96
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00DFEBA5
MulDiv.KERNEL32(0000004B,000000FF,00000064), ref: 00DFEBB3
SetLayeredWindowAttributes.USER32(00000000,00000000,?,00000002), ref: 00DFEBC6
GetWindowLongW.USER32(00000000,000000EC), ref: 00DFEBCE
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00DFEBDD
ShowWindow.USER32(?), ref: 00DFEBF9
UpdateWindow.USER32 ref: 00DFEC05
ShowWindow.USER32(00000000), ref: 00DFEC18
LoadImageW.USER32(00000064,00000001,00000010,00000010,00000000), ref: 00DFEC3D
lstrcpyW.KERNEL32(?,?,?,MiniPath), ref: 00DFEC91
Shell_NotifyIconW.SHELL32(00000000,000003BC), ref: 00DFEC9E
GlobalFree.KERNEL32 ref: 00DFECBE
SendMessageW.USER32(00001004,00000000,00000000), ref: 00DFED4E
PostMessageW.USER32(00000111,00019D0D,00000000), ref: 00DFED69

Strings

MiniPath, xrefs: 00DFEB4D, 00DFEC7F
(, xrefs: 00DFE996
C:\Users\user\Documents, xrefs: 00DFED35
Settings, xrefs: 00DFECE0
MRUDirectory, xrefs: 00DFECEB
MinPath, xrefs: 00DFEB48

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Window$Long$Rect$InfoMessageMonitorShow$AttributesCreateFreeFromGlobalIconImageIntersectLayeredLoadNotifyParametersPostSendShell_SystemUpdatelstrcpy
String ID: ($C:\Users\user\Documents$MRUDirectory$MinPath$MiniPath$Settings
API String ID: 3277733087-429084358
Opcode ID: a530787f1490b07fc1fef5a5c36004d5430daa98870901c1bc2b441736ebd848
Instruction ID: 5dd1c14f7b28562d2814fe77d696497370e06cf1d092a7ad7b267db268aec447
Opcode Fuzzy Hash: a530787f1490b07fc1fef5a5c36004d5430daa98870901c1bc2b441736ebd848
Instruction Fuzzy Hash: 44C126716043499FD720CF15EC45BABB7E9FB84700F144A2DF649B72A0D7B0A948CB66

Function 00DE96A0 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,75B04E90,74E2F860,?,75B0A6F0), ref: 00DE96CA
PathIsRelativeW.SHLWAPI(?,?,75B0A6F0), ref: 00DE96D8
lstrcpyW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE96F2
PathFindFileNameW.SHLWAPI(?,?,?,75B0A6F0), ref: 00DE9701
lstrcpyW.KERNEL32(00000000,?,75B0A6F0), ref: 00DE9708
PathFileExistsW.KERNELBASE(?,?,75B0A6F0), ref: 00DE970F
PathIsDirectoryW.SHLWAPI(?), ref: 00DE9724
lstrcpyW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE9734
PathRemoveFileSpecW.SHLWAPI(?,?,75B0A6F0), ref: 00DE973B
lstrcatW.KERNEL32(?,\np3\,?,75B0A6F0), ref: 00DE9751
lstrcatW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE9760
PathFileExistsW.KERNELBASE(?,?,75B0A6F0), ref: 00DE9767
PathIsDirectoryW.SHLWAPI(?), ref: 00DE9776
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,75B0A6F0), ref: 00DE978F
PathAppendW.SHLWAPI(?,?,?,75B0A6F0), ref: 00DE97A2
PathFileExistsW.KERNELBASE(?,?,75B0A6F0), ref: 00DE97AD
PathIsDirectoryW.SHLWAPI(?), ref: 00DE97BC
SHGetFolderPathW.SHELL32(00000000,00000028,00000000,00000000,?,?,75B0A6F0), ref: 00DE97CF
PathAppendW.SHLWAPI(?,?,?,75B0A6F0), ref: 00DE97E2
lstrcpyW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE97FB
PathFileExistsW.SHLWAPI(?,?,75B0A6F0), ref: 00DE980C
PathIsDirectoryW.SHLWAPI(?), ref: 00DE981E
lstrcpyW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE9831

Strings

\np3\, xrefs: 00DE974B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$File$lstrcpy$DirectoryExists$AppendFolderlstrcat$EnvironmentExpandFindNameRelativeRemoveSpecStrings
String ID: \np3\
API String ID: 3472113900-578766168
Opcode ID: 1d5f0514f9099267cf160a294a9c58bf929addc29a4d1fd48c6d7369ff5b8aea
Instruction ID: 1c8fc91f91b5a609cf47cffe19b7eb5082cd93804b63030451f94ba20ee79460
Opcode Fuzzy Hash: 1d5f0514f9099267cf160a294a9c58bf929addc29a4d1fd48c6d7369ff5b8aea
Instruction Fuzzy Hash: AB410FB264434A9BD720EFA2EC88FABB7ECAF44780F040929F545D2150EBB4D50D8B71

Function 00E077E6 Relevance: 28.5, APIs: 12, Strings: 4, Instructions: 501
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T,75297340), ref: 00E07850
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,00000000), ref: 00E07885
GetUserDefaultUILanguage.KERNEL32(00000000,00000000), ref: 00E078DF
GetSystemDefaultUILanguage.KERNEL32(00000000,?,?,00000000,00000000,?,?,00000000,00000404,?,?,?), ref: 00E079BB
LocaleNameToLCID.KERNEL32(?,08000000,?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00E07B08
GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000000,?,?,00000000), ref: 00E07B69
LocaleNameToLCID.KERNEL32(?,08000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00E07BE7
LocaleNameToLCID.KERNEL32(?,08000000,?,?,?,00000000,00000000,?,?,00000000,?,?,00000000,00000000), ref: 00E07DFA
FreeLibrary.KERNEL32(00000000,00000000,00000000), ref: 00E07C9D

Part of subcall function 00E07391: LCIDToLocaleName.KERNEL32(00000000,00000000,00000055,08000000,?,?,00E07E73,?,?), ref: 00E073B1
Part of subcall function 00E07391: GetLocaleInfoEx.KERNEL32(00000000,0000006D,00000000,00000055,?,00E07E73,?,?), ref: 00E073C3

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,00000000), ref: 00E07EAA
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00E07ECA
FreeLibrary.KERNEL32(00000000), ref: 00E07ED7

Strings

MUI\0409, xrefs: 00E07C49
MUI\%04hx, xrefs: 00E07AAA, 00E07B17, 00E07B89, 00E07BF6, 00E07D9C, 00E07E09, 00E07E81
af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T, xrefs: 00E07803
%s\%s, xrefs: 00E07CBD

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: LibraryLocale$Name$DefaultFreeLanguage$LoadSystem$InfoPathSearchUser
String ID: %s\%s$MUI\%04hx$MUI\0409$af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T
API String ID: 383961474-2845549710
Opcode ID: 4feb53cedeeef08f4206d85c157da1ec9c906127330e6ce1c178836631662b4e
Instruction ID: 0e3f2c9f7621004456ec84a17fe9113e67f2b6c0a1c64d39ad28616a42b3e7fa
Opcode Fuzzy Hash: 4feb53cedeeef08f4206d85c157da1ec9c906127330e6ce1c178836631662b4e
Instruction Fuzzy Hash: 2E0296B2D0466DAADB319A60CC45FFB73BCAB44344F4460D9BAC5B61C1DB34AEC58B60

Function 00DE7440 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 115
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlGetNtVersionNumbers.NTDLL ref: 00DE7461
LoadLibraryExW.KERNEL32(comctl32.dll,00000000,00000800), ref: 00DE74E3
FreeLibrary.KERNEL32(00000000), ref: 00DE7531
VirtualProtect.KERNELBASE(00000000,00000004,00000004,?,?), ref: 00DE7579
VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 00DE759F
FreeLibrary.KERNEL32(00000000), ref: 00DE75A3

Strings

comctl32.dll, xrefs: 00DE74DA
uxtheme.dll, xrefs: 00DE7515
P#_t@~`t)^t, xrefs: 00DE74A9

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Library$FreeProtectVirtual$LoadNumbersVersion
String ID: P#_t@~`t)^t$comctl32.dll$uxtheme.dll
API String ID: 1860271146-4174337272
Opcode ID: 834763b89896e766d3ab7c8b6f12547c01007bdc3962846c482715498f35845c
Instruction ID: e7c71c21a9dfc16b8767c53e48025c0ef535ae8fae03950c0dc5ce3bcfb83f5e
Opcode Fuzzy Hash: 834763b89896e766d3ab7c8b6f12547c01007bdc3962846c482715498f35845c
Instruction Fuzzy Hash: 8F4123726083819FDB60EB6AEC84B6637A5AF40744F0C4468E949F7292E721D84DCB71

Function 00DFDE20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrChrW.SHLWAPI(00000001,00000002), ref: 00DFDEAC
IsValidLocaleName.KERNELBASE(00000001,?,?,?,75297340,?,?,?,00DFE794,?,00000400), ref: 00DFDEEE

Strings

,; :, xrefs: 00DFDE9D
af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T, xrefs: 00DFDE25

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: LocaleNameValid
String ID: ,; :$af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T
API String ID: 3707212039-2850223807
Opcode ID: f982424bd9002e755417c7b333b109d3fe210c688d4131eda7ff665fc7757bd6
Instruction ID: 86676653d077ecd23dfa000b203858405bfbd9e8a124ddee818f984c402bb3f7
Opcode Fuzzy Hash: f982424bd9002e755417c7b333b109d3fe210c688d4131eda7ff665fc7757bd6
Instruction Fuzzy Hash: A951042170539A4BD7309E7C9C40A7B77D7AF90750F5EC62DEA86CB295EA24CC0883B1

Function 00DE6E90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___HrLoadAllImportsForDll@4.DELAYIMP ref: 00DE6EE6

Part of subcall function 00E08B69: ___delayLoadHelper2@8.DELAYIMP ref: 00E08BB2

Strings

cE, xrefs: 00DE6EC8
UxTheme.dll, xrefs: 00DE6EE1

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Load$Dll@4Helper2@8Imports___delay
String ID: UxTheme.dll$cE
API String ID: 138266689-328260853
Opcode ID: e65997e9a48ba14e63f644f9e23f8520b65e914d19e129bca4eb07f4330eca44
Instruction ID: c7afa820d262496c27acf519bacb0a7690e1a56025525126c047ec65c1ce6455
Opcode Fuzzy Hash: e65997e9a48ba14e63f644f9e23f8520b65e914d19e129bca4eb07f4330eca44
Instruction Fuzzy Hash: 8A0149726047489FCF14CF59ED41B9ABBB8FB01720F20016AE918A3680E3355404C764

Function 00DE7C00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsW.KERNELBASE(C:\Windows\system32\Viewers\Quikview.exe,00000002,00DEA3D9), ref: 00DE7C04
PathIsDirectoryW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 00DE7C0F

Strings

C:\Windows\system32\Viewers\Quikview.exe, xrefs: 00DE7C03, 00DE7C0E

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$DirectoryExistsFile
String ID: C:\Windows\system32\Viewers\Quikview.exe
API String ID: 1302732169-377476166
Opcode ID: 64da0cadc302cefb2d208b839b8cd548b253f5b65843b7ec5d48183ea8b07da7
Instruction ID: 0bf58ba76fe619190ba7c888cfe75a1001889b281876feff32a5d82eff83c878
Opcode Fuzzy Hash: 64da0cadc302cefb2d208b839b8cd548b253f5b65843b7ec5d48183ea8b07da7
Instruction Fuzzy Hash: 27C01232319D600AE7603B267D087DB125C8F016D1B1D046AF404D5144E6D4DC8246E4

Function 029010D0 Relevance: 3.1, APIs: 2, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 029010E5
RtlFreeHeap.NTDLL(00000000,?,?,00000000), ref: 0290118C

Memory Dump Source

Source File: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID: Heap$AllocateFree
String ID:
API String ID: 2488874121-0
Opcode ID: 9846261888abe301b971d507e7da30d0043d3e4b9fa9ba8bff61949ba6e26eb8
Instruction ID: 850a0ffb77103765e0883d97f5a96f4002b94a7a0ba327c4b0744859b92e0c29
Opcode Fuzzy Hash: 9846261888abe301b971d507e7da30d0043d3e4b9fa9ba8bff61949ba6e26eb8
Instruction Fuzzy Hash: 9921C332E843086FF7B42A746CC9F7B3B6C9B58745F064515FD0DD11C0EB698858C665

Function 02910098 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 029100C1
VirtualFree.KERNELBASE(00000000,00000000,?), ref: 0291026D

Memory Dump Source

Source File: 00000000.00000003.1791398308.0000000002910000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Associated: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c4e05415e69c24d916c032145dcef53eb47034c17d4a44e0f4697a572808d492
Instruction ID: 61b94f78ed9eb6762eb9177acc17a98c797a031fd374b54da98011aec886e4af
Opcode Fuzzy Hash: c4e05415e69c24d916c032145dcef53eb47034c17d4a44e0f4697a572808d492
Instruction Fuzzy Hash: 3E718971A0424EDFDB45CF99C981BEEBBF0AB09314F144495E865FB241C339AA91CF64

Non-executed Functions

Function 00E009E0 Relevance: 158.5, APIs: 77, Strings: 13, Instructions: 1034windowlibrarystringCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(uxtheme.dll,98D825DA,75C05540,?), ref: 00E00A51
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 00E00A63
FreeLibrary.KERNEL32(00000000), ref: 00E00A76
CreateWindowExW.USER32(00000080,ToolbarWindow32,00000000,54001D68,00000000,00000000,00000000,00000000,?,000000A1,?,00000000), ref: 00E00AC8
SendMessageW.USER32(0000041E,00000014,00000000), ref: 00E00B1D
LoadImageW.USER32(?,00000064,00000000,00000000,00000000,00002000), ref: 00E00B5F
CopyImage.USER32(00000000,00000000,00000000,00000000,00002000), ref: 00E00B73
GetObjectW.GDI32(00000000,00000018,?), ref: 00E00B89
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 00E00BEE
VerSetConditionMask.KERNEL32(00000000), ref: 00E00BF2
VerSetConditionMask.KERNEL32(00000000), ref: 00E00BF6
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00E00C20
GetSysColor.USER32(0000000F), ref: 00E00C2C
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 00E00C63
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000), ref: 00E00C72
DeleteObject.GDI32(00000000), ref: 00E00C79
SendMessageW.USER32(00000430,00000000,00000000), ref: 00E00C8D
GetObjectW.GDI32(00000000,00000018,?), ref: 00E00CBD
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 00E00CEB
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000), ref: 00E00CFA
DeleteObject.GDI32(00000000), ref: 00E00D01
SendMessageW.USER32(00000434,00000000,00000000), ref: 00E00D15
GetObjectW.GDI32(00000000,00000018,?), ref: 00E00D45
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 00E00D73
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000), ref: 00E00D82
DeleteObject.GDI32(00000000), ref: 00E00D89
SendMessageW.USER32(00000436,00000000,00000000), ref: 00E00D9D
GetSysColor.USER32(0000000F), ref: 00E00DC2
GetObjectW.GDI32(?,00000018,?), ref: 00E00DDE
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 00E00F33
VerSetConditionMask.KERNEL32(00000000), ref: 00E00F37
VerSetConditionMask.KERNEL32(00000000), ref: 00E00F3B
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00E00F65
GetObjectW.GDI32(?,00000018,?), ref: 00E00F8F
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 00E010B2
VerSetConditionMask.KERNEL32(00000000), ref: 00E010B6
VerSetConditionMask.KERNEL32(00000000), ref: 00E010BA
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00E010E4
GetSysColor.USER32(0000000F), ref: 00E010F0
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 00E0112B
ImageList_AddMasked.COMCTL32(00000000,?,FF000000), ref: 00E0113A
SendMessageW.USER32(00000436,00000000,00000000), ref: 00E0114E
DeleteObject.GDI32(?), ref: 00E0115F
wsprintfW.USER32 ref: 00E011AF
lstrcmpiW.KERNEL32(?,(none)), ref: 00E011EC
lstrcmpiW.KERNEL32(?,(none)), ref: 00E0120C
SendMessageW.USER32(0000044D,00000000,?), ref: 00E01243
SendMessageW.USER32(00000455,00000000,00000000), ref: 00E01298
SendMessageW.USER32(00000454,00000000,00000000), ref: 00E012AB
SendMessageW.USER32(00000444,00000006,00E7B960), ref: 00E012BF
SendMessageW.USER32(00000444,00000006,00E7B960), ref: 00E012E7
SendMessageW.USER32(0000041D,00000000,?), ref: 00E012FD
CreateWindowExW.USER32(02000000,msctls_statusbar32,00000000,44000000,00000000,00000000,00000000,00000000,?,000000A0,?,00000000), ref: 00E01331
SystemParametersInfoW.USER32(00000042,0000000C,0000000C,00000000), ref: 00E01388
CreateWindowExW.USER32(00000080,ReBarWindow32,00000000,?,00000000,00000000,00000000,00000000,?,000000A2,?,00000000), ref: 00E0142A
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 00E01494
VerSetConditionMask.KERNEL32(00000000), ref: 00E01498
VerSetConditionMask.KERNEL32(00000000), ref: 00E0149C
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00E014C6

Strings

(none), xrefs: 00E011E0, 00E01200
ReBarWindow32, xrefs: 00E01420
3, xrefs: 00E015B7
333, xrefs: 00E017D7
Explorer, xrefs: 00E00AD5, 00E0133E, 00E014E8
msctls_statusbar32, xrefs: 00E01327
IsAppThemed, xrefs: 00E00A5D
%02i, xrefs: 00E011A3
uxtheme.dll, xrefs: 00E00A4C
d, xrefs: 00E015AD
ToolbarWindow32, xrefs: 00E00ABE
, xrefs: 00E00F9D
Toolbar Labels, xrefs: 00E011CF

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ConditionMask$MessageSend$Image$Object$List_$Create$Info$DeleteMaskedVerifyVersion$ColorWindow$LibraryLoadlstrcmpi$AddressCopyFreeParametersProcSystemwsprintf
String ID: $%02i$(none)$3$333$Explorer$IsAppThemed$ReBarWindow32$Toolbar Labels$ToolbarWindow32$d$msctls_statusbar32$uxtheme.dll
API String ID: 3633255068-3515688118
Opcode ID: bce7c3b77d5b52a5238f898c97b6d9d404e6339bf082235e7f839255823ee7b1
Instruction ID: 8897513ccb571d4cba4cc15e6b2ca5d831af24119873e0e56b5ef9662fa7b3b9
Opcode Fuzzy Hash: bce7c3b77d5b52a5238f898c97b6d9d404e6339bf082235e7f839255823ee7b1
Instruction Fuzzy Hash: B882B271A40718AEEB308B65DC45FAA7BB9EB44705F1450DAE608FA2D0DBB49EC4CF14

Function 00E02050 Relevance: 114.6, APIs: 60, Strings: 5, Instructions: 892windowCOMMON

Download Yara Rule

APIs

DialogBoxIndirectParamW.USER32(00D80000,00000000,?,Function_00073400,00000000), ref: 00E022FE
LocalFree.KERNEL32(00000000,?,Function_00073400,00000000), ref: 00E0230D
ShellExecuteExW.SHELL32(?), ref: 00E023D6
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 00E0249C
StrCatBuffW.SHLWAPI(?,00E80ACC,00000104,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E024C4
StrCatBuffW.SHLWAPI(?,00E74F0C,00000104,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E024D8
StrCatBuffW.SHLWAPI(?,?,00000104,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E024EF
SendMessageW.USER32(?,00000111,00019D0E,00000000), ref: 00E043E4

Strings

$X, xrefs: 00E04046
<, xrefs: 00E023A3
C:\Windows\system32\Viewers\Quikview.exe, xrefs: 00E024F8
, xrefs: 00E03899
S, xrefs: 00E04029

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Buff$DialogExecuteFreeIndirectLocalMessageNameParamPathSendShellShort
String ID: $$X$<$C:\Windows\system32\Viewers\Quikview.exe$S
API String ID: 1759457118-3802859302
Opcode ID: d771ab0aa91183aefb0ec807993e342682e084f6e1d30a4191765d878ead96e7
Instruction ID: b1888812706547e8de33431f9470f558bf222379d8bf4ec70f261a9c177abe17
Opcode Fuzzy Hash: d771ab0aa91183aefb0ec807993e342682e084f6e1d30a4191765d878ead96e7
Instruction Fuzzy Hash: 8F62F5B16043449FE730AB71ED46FAB73E8EB94304F105519E749B62D1EBB095C8CB62

Function 00E066D0 Relevance: 73.9, APIs: 40, Strings: 2, Instructions: 409stringwindowmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00E7E460,00E7DA00), ref: 00E0673D
EnumWindows.USER32(00E06420,00000000), ref: 00E0674D
IsWindowEnabled.USER32(00000000), ref: 00E06760
IsIconic.USER32(00000000), ref: 00E06772
ShowWindowAsync.USER32(00000009,00000009), ref: 00E06782
SetForegroundWindow.USER32(00000000), ref: 00E06795
lstrlenW.KERNEL32(?), ref: 00E067A4
GlobalAlloc.KERNEL32(00002042,00000000), ref: 00E067B7
GlobalLock.KERNEL32(00000000), ref: 00E067C4
lstrcpyW.KERNEL32(-00000014,?), ref: 00E067F5
GlobalUnlock.KERNEL32(00000000), ref: 00E067F8
PostMessageW.USER32(00000233,00000233,00000000,00000000), ref: 00E0680A
StrChrW.SHLWAPI(?,0000000A,?,?), ref: 00E0685A
MessageBoxW.USER32(00000000,?,00010024), ref: 00E06880
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 00E068C2
StrCpyNW.SHLWAPI(?,00E7E030,00000104), ref: 00E068E7
StrCatBuffW.SHLWAPI(?,00E74F0C,00000104), ref: 00E068FC
StrCatBuffW.SHLWAPI(?,?,00000104), ref: 00E06909
lstrcpyW.KERNEL32(?,00E7DE20), ref: 00E06918
ShellExecuteExW.SHELL32 ref: 00E06999

Part of subcall function 00DFA770: LoadStringW.USER32(0000A411,?,00000000,00000001), ref: 00DFA782
Part of subcall function 00DFA770: LoadStringW.USER32(0000A411,?,?), ref: 00DFA798

lstrcpynW.KERNEL32(?,00E7E240,00000100), ref: 00E06A39
wsprintfW.USER32 ref: 00E06A72
DdeInitializeW.USER32(?,00DFC0C0,00000010,00000000), ref: 00E06A89
DdeCreateStringHandleW.USER32(?,00E7D7F0,000004B0), ref: 00E06AAB
DdeCreateStringHandleW.USER32(?,00E7DC10,000004B0), ref: 00E06ABD
DdeConnect.USER32(?,00000000,00000000,00000000), ref: 00E06AD6
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00004050,000000FF,00000000,?,?,?,?,?,?,?,?,?), ref: 00E06AFA
DdeClientTransaction.USER32(?,00000000), ref: 00E06B10
DdeDisconnect.USER32(?), ref: 00E06B1A
DdeUninitialize.USER32(?), ref: 00E06B4F
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 00E06BA6
StrCpyNW.SHLWAPI(?,00E7E030,00000104,?,?,?,?), ref: 00E06BCE
StrCatBuffW.SHLWAPI(?,00E74F0C,00000104,?,?,?,?), ref: 00E06BE6
StrCatBuffW.SHLWAPI(?,?,00000104,?,?,?,?), ref: 00E06BF6
lstrcpyW.KERNEL32(?,00E7DE20,?,?,?,?), ref: 00E06C02
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,?,?,?,?), ref: 00E06C1A
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?), ref: 00E06C36
ShellExecuteExW.SHELL32(0000003C), ref: 00E06CD2
DialogBoxIndirectParamW.USER32(00D80000,00000000,?,Function_00077B90,00000000), ref: 00E06CFE
LocalFree.KERNEL32(00000000), ref: 00E06D09

Strings

<, xrefs: 00E06C7B
<, xrefs: 00E06971

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: BuffStringlstrcpy$GlobalWindow$CreateExecuteHandleLoadMessageNamePathShellShortlstrcpynlstrlen$AllocAsyncClientConnectDialogDisconnectEnabledEnumEnvironmentExpandForegroundFreeIconicIndirectInitializeLocalLockParamPostShowStringsTransactionUninitializeUnlockWindowswsprintf
String ID: <$<
API String ID: 2206026705-213342407
Opcode ID: 8b7a7550fa82cb4cbcbdf4387ea79f38e15892b0a5d78808f61024900aad8cff
Instruction ID: 014f99719cd69c370ecccf5f6219ef7075cea2892dbf9f56093e53f13a97bf51
Opcode Fuzzy Hash: 8b7a7550fa82cb4cbcbdf4387ea79f38e15892b0a5d78808f61024900aad8cff
Instruction Fuzzy Hash: 99F1B0B1604345AFD720DF51EC48B6BB7E8FB84748F005919F545B61E0EBF19898CBA2

Function 00E0DFC9 Relevance: 46.7, APIs: 25, Strings: 1, Instructions: 1201COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00E0E017
operator+.LIBVCRUNTIME ref: 00E0E031
DName::operator+.LIBCMT ref: 00E0E15F
DName::operator+.LIBCMT ref: 00E0E17C

Part of subcall function 00E0F395: DName::DName.LIBVCRUNTIME ref: 00E0F3D8

DName::operator+.LIBCMT ref: 00E0E230
DName::operator+.LIBCMT ref: 00E0E23F

Part of subcall function 00E13B15: DName::operator+.LIBCMT ref: 00E13B59
Part of subcall function 00E13B15: DName::operator+.LIBCMT ref: 00E13B65
Part of subcall function 00E13B15: DName::operator+.LIBCMT ref: 00E13BE0
Part of subcall function 00E13B15: DName::operator+=.LIBCMT ref: 00E13C23

DName::operator+.LIBCMT ref: 00E0E1CB

Part of subcall function 00E0DD87: DName::operator=.LIBVCRUNTIME ref: 00E0DDA8

Part of subcall function 00E0DD2F: shared_ptr.LIBCMT ref: 00E0DD4B

Part of subcall function 00E0FA91: shared_ptr.LIBCMT ref: 00E0FB37

DName::operator+.LIBCMT ref: 00E0E7A9
DName::operator+.LIBCMT ref: 00E0E7C5
DName::operator+.LIBCMT ref: 00E0EA64

Part of subcall function 00E0DC1E: DName::operator+.LIBCMT ref: 00E0DC3F

Strings

"7, xrefs: 00E0DFC9

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+$NameName::shared_ptr$Name::operator+=Name::operator=operator+
String ID: "7
API String ID: 848932493-1693229498
Opcode ID: 54b1b3c65d104a24c3a4b43f7f8a2ffed9cddb7758b5ed410153610956046431
Instruction ID: 7f64a03c468999bc601c011adeae51526ff18f95967af690a4c5f4338af221fa
Opcode Fuzzy Hash: 54b1b3c65d104a24c3a4b43f7f8a2ffed9cddb7758b5ed410153610956046431
Instruction Fuzzy Hash: 94927D72E546099BEB18DAE8CC81BEDB7B8AB54304F18553DE512F73C0DA78D888CB50

Function 00DF86E0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 70windowstringmemoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,?,00DE7DA3), ref: 00DF86E9

Part of subcall function 00DFDD80: ResolveLocaleName.KERNEL32(en-US,?,00000055), ref: 00DFDDB3
Part of subcall function 00DFDD80: GetLocaleInfoEx.KERNEL32(?,20000001,00000002), ref: 00DFDDD6

FormatMessageW.KERNEL32 ref: 00DF8718
lstrlenW.KERNEL32(00000000,00000000,00E7D538), ref: 00DF872F
lstrlenW.KERNEL32(00000000), ref: 00DF8737
LocalAlloc.KERNEL32(00000040,00000000), ref: 00DF8747
GetFocus.USER32 ref: 00DF8774
MessageBoxExW.USER32(?,00000000,MiniPath - ERROR,00000010,?), ref: 00DF878F
LocalFree.KERNEL32(00000000,?,?,00DE7DA3), ref: 00DF8796
LocalFree.KERNEL32(?), ref: 00DF879C

Strings

Error: '%s' failed with error id %d:%s., xrefs: 00DF8762
MiniPath - ERROR, xrefs: 00DF8785
en-US, xrefs: 00DF86EF

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Local$FreeLocaleMessagelstrlen$AllocErrorFocusFormatInfoLastNameResolve
String ID: Error: '%s' failed with error id %d:%s.$MiniPath - ERROR$en-US
API String ID: 2054022804-4186176330
Opcode ID: 68dc4b57f09907936cd06f4b09fed2f71a735e443e30f47e6a84451fd8a5b19d
Instruction ID: ae70b3741872c517f563733c34d923c73d8614850242a4a52346e1970e85f0e2
Opcode Fuzzy Hash: 68dc4b57f09907936cd06f4b09fed2f71a735e443e30f47e6a84451fd8a5b19d
Instruction Fuzzy Hash: DD11D6727007057FD3116B62AC05F2F7BE9EF84794F054829FA44B2250D6B5DC088AB6

Function 00DFD1D0 Relevance: 13.7, APIs: 9, Instructions: 178stringmemoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00D80000,?,00000005,?,00D80000), ref: 00DFD1E8
LoadResource.KERNEL32(00D80000,00000000), ref: 00DFD1FA
LockResource.KERNEL32(00000000), ref: 00DFD20B
SizeofResource.KERNEL32(00D80000,00000000), ref: 00DFD21D
LocalAlloc.KERNEL32(00000040,00000040), ref: 00DFD237
FreeResource.KERNEL32(00000000), ref: 00DFD253
lstrlenW.KERNEL32(?), ref: 00DFD2CA
lstrlenW.KERNEL32(?), ref: 00DFD339
FreeResource.KERNEL32(00000000), ref: 00DFD3C6

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Resource$Freelstrlen$AllocFindLoadLocalLockSizeof
String ID:
API String ID: 2547741363-0
Opcode ID: 68705589adfba2dd4eba98ab4479c4bc52d3f7327d338e76d60f0ffea3946527
Instruction ID: 75dda509dacf0620e966463881993b6c3e84d3c7b96e3b19307a0e5bdb15bf10
Opcode Fuzzy Hash: 68705589adfba2dd4eba98ab4479c4bc52d3f7327d338e76d60f0ffea3946527
Instruction Fuzzy Hash: 1351357660070A8FC720AF54DC85B7B77E6EF99344F09882CFA4697241E774D909CBA2

Function 00E1A080 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Strings

,|, xrefs: 00E1A09E, 00E1A236, 00E1A401, 00E1A456
,|, xrefs: 00E1A4E1, 00E1A2D0

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: ,|$,|
API String ID: 0-1834556769
Opcode ID: 125b6e84b09fc7b2cee96921ed18d23e2a4b473fc64f68efb4193e121a871f8e
Instruction ID: d0ba4bda1325572d6fd967cd13e71bf87dfa0a02f72a3416d3473e8f2b1e1e1f
Opcode Fuzzy Hash: 125b6e84b09fc7b2cee96921ed18d23e2a4b473fc64f68efb4193e121a871f8e
Instruction Fuzzy Hash: 34020A71E012199BDB14CFA9D8806EEFBF1FF48314F28926AE519F7241D731A941CB91

Function 00E5690C Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E56B23

Strings

1#INF, xrefs: 00E56A42
1#SNAN, xrefs: 00E56A18
1#QNAN, xrefs: 00E56A1F
1#IND, xrefs: 00E56A11

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a9bc457f7f7547a8bd23de6fa2d728ac8d2a48d55dbda2257dca40b858182be5
Instruction ID: 501f75c6b33edbe32c86a2640bd76c95cfd8ae1fd73a5a3282267a17f8b4a9fc
Opcode Fuzzy Hash: a9bc457f7f7547a8bd23de6fa2d728ac8d2a48d55dbda2257dca40b858182be5
Instruction Fuzzy Hash: FED25C71E082288FDB65CE28DC407EAB7B5EB44306F1455EAD84DF7240EB74AE998F41

Function 00DFBE60 Relevance: 9.1, APIs: 6, Instructions: 75stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(00000000,0000000F,00000008,00000008,00000000,?,?,?,?,?,00E05480), ref: 00DFBE8F
lstrlenW.KERNEL32(?,74DF3070,75C05540,?,?,?,?,00E05480), ref: 00DFBEAC
CharPrevW.USER32(?,00000000,?,?,?,?,00E05480), ref: 00DFBEB3
lstrlenW.KERNEL32(00000000,?,?,?,?,00E05480), ref: 00DFBEC9
CharPrevW.USER32(?,00000000,?,?,?,?,00E05480), ref: 00DFBEEA
lstrlenW.KERNEL32(?,?,?,?,?,00E05480), ref: 00DFBEF7

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: lstrlen$CharPrev$InfoLocale
String ID:
API String ID: 1002616787-0
Opcode ID: 1cec91f48336e48f4914068f676e9ac101c1ca6fddb14c720e6bcb55c66dfb73
Instruction ID: 977ab07f959f536a38a73eb519e8caa0b00b5d5da8f064ce18634ad4bb3c3f67
Opcode Fuzzy Hash: 1cec91f48336e48f4914068f676e9ac101c1ca6fddb14c720e6bcb55c66dfb73
Instruction Fuzzy Hash: 6A11D6B26002096BC720AF75EC85A7F77DCEFC9390F85482AFA5693111EB61884987A1

Function 00E5327D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00E53316
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00E5333F
GetACP.KERNEL32 ref: 00E53354

Strings

OCP, xrefs: 00E532D1
ACP, xrefs: 00E5329B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ab04864aa7d8edffe4ad0e910e56198bdf041e83e58cef1753dacbcb8af97444
Instruction ID: 68e7a1e47ddf362712e140b48be52ef6d95242e4b1c24ff7c8c4312899766eef
Opcode Fuzzy Hash: ab04864aa7d8edffe4ad0e910e56198bdf041e83e58cef1753dacbcb8af97444
Instruction Fuzzy Hash: 7F210326B00500AADB358B35C901A9B73A6EB50BDAF56AD24FD1AF7110EB32DF48C350

Function 00E53459 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00E46FEB: GetLastError.KERNEL32(00000000,?,00E4F927), ref: 00E46FEF
Part of subcall function 00E46FEB: SetLastError.KERNEL32(00000000,?,?,00000016,00E1D00B), ref: 00E47091

GetUserDefaultLCID.KERNEL32 ref: 00E53561
IsValidCodePage.KERNEL32(00000000), ref: 00E5359F
IsValidLocale.KERNEL32(?,00000001), ref: 00E535B2
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00E535FA
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00E53615

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: e626c7637aa022b6b18497efaba8627bbc290944f54a92d82977b3c7c81dc2e1
Instruction ID: 022243e9aca034c8b1f24560944ff3f21bcc6dbbd873228b6d41e41cf1816391
Opcode Fuzzy Hash: e626c7637aa022b6b18497efaba8627bbc290944f54a92d82977b3c7c81dc2e1
Instruction Fuzzy Hash: 0D51B171A00205AFDF11DFB5DC41ABEB7F8BF05746F142829E910F7291EBB09A088B60

Function 00DFE070 Relevance: 7.6, APIs: 5, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

GetUserPreferredUILanguages.KERNEL32(00000008,?,00000000,00000000), ref: 00DFE0C1
LocalAlloc.KERNEL32(00000040,?), ref: 00DFE0D9
GetUserPreferredUILanguages.KERNEL32(00000008,?,00000000,?), ref: 00DFE0F6
LocalFree.KERNEL32(00000000), ref: 00DFE148
GetLocaleInfoEx.KERNEL32(00000000,0000005C,?,00000055), ref: 00DFE160

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: LanguagesLocalPreferredUser$AllocFreeInfoLocale
String ID:
API String ID: 1113077726-0
Opcode ID: bc792c1a2558f256da0a65510d9a9bfd8af95dd24a45b3e2b1b971ec99e343bc
Instruction ID: 916d5b1c2cef0ed2dea6a6fc36f1d954174fd1ec5c32af8ccf71b1d6e9d57272
Opcode Fuzzy Hash: bc792c1a2558f256da0a65510d9a9bfd8af95dd24a45b3e2b1b971ec99e343bc
Instruction Fuzzy Hash: 39319A72208709AFE320DF15DC45B7BB7E8EB85350F45842EF699D6290EB74D908CB62

Function 00E4CEA5 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00E4CF40
FindNextFileW.KERNEL32(00000000,?), ref: 00E4CFBB
FindClose.KERNEL32(00000000), ref: 00E4CFDD
FindClose.KERNEL32(00000000), ref: 00E4D000

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: cb9ffacc01633a2f7b9f4baea3d82af7128424ece18ca2c701081880a49f46da
Instruction ID: 78ae213834a70080a23533a78cd8d43895d866a2ee282de942a9e0d8c8b2d776
Opcode Fuzzy Hash: cb9ffacc01633a2f7b9f4baea3d82af7128424ece18ca2c701081880a49f46da
Instruction Fuzzy Hash: F1410971B01519AFCB20EFA4EC899BBB7BAEB84308F245195E405F7140F7349E88CB54

Function 00DFB810 Relevance: 6.1, APIs: 4, Instructions: 99stringcomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00E6A89C,00000000,00000001,00E66D8C,?,0000C356,?), ref: 00DFB83F
lstrcpyW.KERNEL32(?,?), ref: 00DFB86B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 00DFB8F2
lstrcpynW.KERNEL32(?,?,?), ref: 00DFB90C

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CreateEnvironmentExpandInstanceStringslstrcpylstrcpyn
String ID:
API String ID: 4041286039-0
Opcode ID: 746307afd77373ccbaf8770529233da127ceb46ffbbf85e83557943a8eabebab
Instruction ID: f67f0d14666302ad4f842415dc275c1c41a99c7033eb4f838e0fb026bafdabea
Opcode Fuzzy Hash: 746307afd77373ccbaf8770529233da127ceb46ffbbf85e83557943a8eabebab
Instruction Fuzzy Hash: F33106B1204346AFD320DA68DC84E6BB7E9ABC8744F04892AFA49D7250DB71EC058B61

Function 00E09D68 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00E09D74
IsDebuggerPresent.KERNEL32 ref: 00E09E40
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E09E59
UnhandledExceptionFilter.KERNEL32(?), ref: 00E09E63

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a84915677f245bde69f6816b4a72f72faa4f42140eaaa418ce8c854a5294ae27
Instruction ID: 1df715df894c6c7d9c0eb3948ba89d8a2789fb732fd02731c290bf2b3d29fa92
Opcode Fuzzy Hash: a84915677f245bde69f6816b4a72f72faa4f42140eaaa418ce8c854a5294ae27
Instruction Fuzzy Hash: B3311675D01219DBDB20DFA5D9497CDBBF8BF08300F1041AAE40DAB291EBB09A848F85

Function 00E0874A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00E0868F,0000001C,00E08884,00000000,00000000,00000000,?,?,?,?,?,00E0868F,00000004,00E7BE44,00E08BDA), ref: 00E0875B
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,00E0868F,00000004,00E7BE44,00E08BDA,?), ref: 00E08776

Strings

D, xrefs: 00E0876A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: e09b00097f8855e69499e6cf8ee0ab42e75bf269512993645375ccf23bce654e
Instruction ID: e29ce347875bc7214c3bc3ba8f0777e21b99eaf44f6bf3896157662c27d61fc3
Opcode Fuzzy Hash: e09b00097f8855e69499e6cf8ee0ab42e75bf269512993645375ccf23bce654e
Instruction Fuzzy Hash: 34012B33700109ABDB14DE39DD05BDE7BAAAFC4368F1CC225ED59EB284EA34D84586C0

Function 00DFDD80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

ResolveLocaleName.KERNEL32(en-US,?,00000055), ref: 00DFDDB3
GetLocaleInfoEx.KERNEL32(?,20000001,00000002), ref: 00DFDDD6

Strings

en-US, xrefs: 00DFDDB2

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Locale$InfoNameResolve
String ID: en-US
API String ID: 2669342117-1228076028
Opcode ID: 49376812b425d54bfcf0d6c3fe7017098658f7686e4e29d8e6067866584e348e
Instruction ID: 52ecf1354f38c1ef1614b3182fd23fd191a925e5d919147e94945b78acee6962
Opcode Fuzzy Hash: 49376812b425d54bfcf0d6c3fe7017098658f7686e4e29d8e6067866584e348e
Instruction Fuzzy Hash: 3301AD38604345ABE724EB25DC06B7B37E6BB44304F84882CAA45D6282F7B8C844CB53

Function 00E52F01 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00E46FEB: GetLastError.KERNEL32(00000000,?,00E4F927), ref: 00E46FEF
Part of subcall function 00E46FEB: SetLastError.KERNEL32(00000000,?,?,00000016,00E1D00B), ref: 00E47091

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E52F55
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E52F9F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E53065

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 454e536b2ea0a8274136c8f61cd6e9a18b834c67bafb090b9ff7e1bb332e9ed4
Instruction ID: 0a0dc66e6910d960b83a2b922c7f4c15c8e1fd1946691d1bc90fa8708ac2dc15
Opcode Fuzzy Hash: 454e536b2ea0a8274136c8f61cd6e9a18b834c67bafb090b9ff7e1bb332e9ed4
Instruction Fuzzy Hash: 7C61E3316016579FDB289F34CD82BBAB7E9EF04386F1054B9EC05E6181EB74DA89CB50

Function 00E377CE Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00E378C6
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00E378D0
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,?), ref: 00E378DD

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8e6ea0b40548a9f7ed7370f19866f276e1c1f088d22a4e89b0d2a85c9d697708
Instruction ID: 98206b93ab19dd0c25c81a34bd212a4dffa284fc9ad967fbdc44aca1c2f995fc
Opcode Fuzzy Hash: 8e6ea0b40548a9f7ed7370f19866f276e1c1f088d22a4e89b0d2a85c9d697708
Instruction Fuzzy Hash: D831D27590122DABCB21DF64D988BCDBBB8BF08310F5051EAE41CA6291EB709F85CF45

Function 00E503BC Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00E503C3
OutputDebugStringW.KERNEL32(?), ref: 00E503DA

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: DebugDebuggerOutputPresentString
String ID:
API String ID: 4086329628-0
Opcode ID: 6643378fc59e417e12d1f86517eb39fd8ab4a2107a190107b1874056540e68bd
Instruction ID: 5e9fcefa037ce0d845ff1815be18ef2c4192f55994678b1a9b8c7689ec6d9e2b
Opcode Fuzzy Hash: 6643378fc59e417e12d1f86517eb39fd8ab4a2107a190107b1874056540e68bd
Instruction Fuzzy Hash: 6201D1321402166FDF202E51AC4ABEF3798DF003BAF187911FF64BA051C760C848D2A2

Function 00E07391 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

LCIDToLocaleName.KERNEL32(00000000,00000000,00000055,08000000,?,?,00E07E73,?,?), ref: 00E073B1
GetLocaleInfoEx.KERNEL32(00000000,0000006D,00000000,00000055,?,00E07E73,?,?), ref: 00E073C3

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Locale$InfoName
String ID:
API String ID: 3347482803-0
Opcode ID: 25045531840856bc6a3898c594dd5b973060cc2de6defc7c5676722537fbd199
Instruction ID: 6c050085d296f0d31c406c6326c848d55360a7964ab7455a3c693e1695e7983e
Opcode Fuzzy Hash: 25045531840856bc6a3898c594dd5b973060cc2de6defc7c5676722537fbd199
Instruction Fuzzy Hash: 49F0B431B09655BBEB205F259C49FAB379CEF05B86F041412BD51F60D0D7B4EC90E6A0

Function 00E30E3D Relevance: 2.9, Strings: 2, Instructions: 389COMMON

Download Yara Rule

Strings

X, xrefs: 00E31151, 00E3116D, 00E31079, 00E31085, 00E31155
0, xrefs: 00E30FDD

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0$X
API String ID: 0-1267750158
Opcode ID: 4cee062b66d79ec3217d05851b3ec36907ae62b258669f9b5c2a74d9760f5af4
Instruction ID: 314b401c0a86d8d9c7b83d8307c8f04c2e52011b95b6573e4dab15bd0515634b
Opcode Fuzzy Hash: 4cee062b66d79ec3217d05851b3ec36907ae62b258669f9b5c2a74d9760f5af4
Instruction Fuzzy Hash: 51D1A030A006068FCB28CF69C5986BABFF1FF49318F14669DD556BB690C731AD82CB51

Function 00E31240 Relevance: 2.9, Strings: 2, Instructions: 385COMMON

Download Yara Rule

Strings

O, xrefs: 00E31586
0, xrefs: 00E313D1

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0$O
API String ID: 0-3924424526
Opcode ID: d30ce8f55bb34c6cd456ef2155929bead6c8d763273368801c729f0ded96f4f8
Instruction ID: 40651892550eb8af0e0b74afd35de3e4252fe80894aaf34cbfd92b1cf841c12b
Opcode Fuzzy Hash: d30ce8f55bb34c6cd456ef2155929bead6c8d763273368801c729f0ded96f4f8
Instruction Fuzzy Hash: E1D1AD70A006069FCB24CF69C588ABABFF1FF48318F14669DD456BBA91D730AD41CB51

Function 00E554EF Relevance: 2.8, APIs: 1, Instructions: 1290COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E5556C

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 9d1c26b2772f91e86ee8da810d6fbf1e76dc981185104b3bdad62b061aa912f4
Instruction ID: af6cd1335f6ecc582e246a857337176104634b3e7ae443f56d4a429a82d472dc
Opcode Fuzzy Hash: 9d1c26b2772f91e86ee8da810d6fbf1e76dc981185104b3bdad62b061aa912f4
Instruction Fuzzy Hash: FCB23A72E046298FDB25CE28DD507EAB3B5EB48306F5455EAD80DF7240E774AE898F40

Function 00E5F21D Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E5F218,?,?,00000008,?,?,00E5ED06,00000000), ref: 00E5F44A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6ae7c4541ce994a630f16e16a8b9b72c852f9d18d00a79812e65ef18b02c1c5d
Instruction ID: 056684546ddec318cacd6732fbb38e1395eb6466fc1ff101435a2df263260508
Opcode Fuzzy Hash: 6ae7c4541ce994a630f16e16a8b9b72c852f9d18d00a79812e65ef18b02c1c5d
Instruction Fuzzy Hash: BDB16D31610609DFD715CF28C486BA57BE0FF0536AF259A68ECA9DF2A1C335D985CB40

Function 00E09B84 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00E09B9A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 26cf828cf9bd6bd52061c56e9c9fb42ba2247154064721da47aaf4af197bc9d2
Instruction ID: 590c09be191eab43a9f2afe8c3b6637296e439b999ed4a8a68b727ed4234a5cc
Opcode Fuzzy Hash: 26cf828cf9bd6bd52061c56e9c9fb42ba2247154064721da47aaf4af197bc9d2
Instruction Fuzzy Hash: 6C5188B1A112058FEB18CF56D9857AEBBF4FB48314F24902AD519FB2A2D374DA84CF50

Function 00E30A49 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

0, xrefs: 00E30BDA

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1406dba0e739c3343c1bc1a856d4e8f1fc679c91f338cd629c133fa821335512
Instruction ID: 570e692b35498e1ebb9004fd0d7d1a15641b5a6f40c1fa9643c3da3fe951e45c
Opcode Fuzzy Hash: 1406dba0e739c3343c1bc1a856d4e8f1fc679c91f338cd629c133fa821335512
Instruction Fuzzy Hash: 40D1AF70A006068FCB28DF68C5A8ABAFFF1FF44328F646659D456BB691D731AD41CB10

Function 00E2F953 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

0, xrefs: 00E2FAD2

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5fa2a45c25dc73c4ff4d9ed1cbe74adf589f7a27a67ff59fdf88cab1b54b9bff
Instruction ID: f94f17290f5547bb84716f4c485ac3583bb4bdb60a2f5832737ccd17c28f941e
Opcode Fuzzy Hash: 5fa2a45c25dc73c4ff4d9ed1cbe74adf589f7a27a67ff59fdf88cab1b54b9bff
Instruction Fuzzy Hash: A9C113B050062A8FCB24CF68E5956BAFBF1FF45308F246639D856B7291C731AD45CB50

Function 00E53154 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00E46FEB: GetLastError.KERNEL32(00000000,?,00E4F927), ref: 00E46FEF
Part of subcall function 00E46FEB: SetLastError.KERNEL32(00000000,?,?,00000016,00E1D00B), ref: 00E47091

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E531A8

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f1e574af45732aafe2c76828b9eede8d52008bbc141f53eb70c265f65c726b5a
Instruction ID: 03e3276d9b20d1405f92ed72ed4b04bc05824af7a1f7ee7e4ec0e05fd0de405b
Opcode Fuzzy Hash: f1e574af45732aafe2c76828b9eede8d52008bbc141f53eb70c265f65c726b5a
Instruction Fuzzy Hash: 8721F536611A06ABDB289E35DD42EBA37E8EF05345F10247AFD11E7151EB34DE48CB50

Function 00E2F5F4 Relevance: 1.6, Strings: 1, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00E2F764

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3bd43989d8f5b22b018a696a1944f34d9d5f84cc053b95d58d52eaa517c03109
Instruction ID: f7d28a5d2d7be2a78096b4a3e7149a8ba50ffab12056a9e3e1b491202f9a27e4
Opcode Fuzzy Hash: 3bd43989d8f5b22b018a696a1944f34d9d5f84cc053b95d58d52eaa517c03109
Instruction Fuzzy Hash: 44C1E4349006668FCB28CF68E5847BABBB1FF45318F14663AD492B76A1C730ED45CB91

Function 00E3037E Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

0, xrefs: 00E30521

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 540673a9e685daaebe13b3df50511fad71b3bde764995f9e54ec3ce1ded7c85c
Instruction ID: 119011963ee5b5f1fbad2ca6fe73f5495b403f225d75c76f24a8f1fc0ad55bee
Opcode Fuzzy Hash: 540673a9e685daaebe13b3df50511fad71b3bde764995f9e54ec3ce1ded7c85c
Instruction Fuzzy Hash: F4B1C270A0060A9BCB24CF68C969ABEBFF1AF84318F10651DD5A6B7A50D731EE45CB50

Function 00E30020 Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

0, xrefs: 00E301B4

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 15b34f5e85098a6201162726d7e10b477c1700476c079222caea5730f98e6a4d
Instruction ID: 9c9878b9f7734d37f24d98a978be772a60cbfcd28f40d9fc45d160d5d68a72f6
Opcode Fuzzy Hash: 15b34f5e85098a6201162726d7e10b477c1700476c079222caea5730f98e6a4d
Instruction Fuzzy Hash: 9AB1D270A0060A8BCB29CF68C9ACABFBFF5AF44304F14651DD456B7691C731AD45CB50

Function 00E306EB Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

0, xrefs: 00E3087F

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 238c5b1fbd78c3801aec3834910b75ad30f0b5c02f2d979a944838fe497d87dc
Instruction ID: bff6f07f748fae9f05972876f1eab374f970d3fa4c21da83c65180947fcd26f3
Opcode Fuzzy Hash: 238c5b1fbd78c3801aec3834910b75ad30f0b5c02f2d979a944838fe497d87dc
Instruction Fuzzy Hash: CDB1B130A0060A8BCB28DF68C96DABFBFF1AF84318F14651ED496B7690D731AD45CB51

Function 00E2EF61 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 00E2F0F4

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: bc9022557ffdde4da2c5c564d477ffd76f49cfdf06520c722d93622640c01a24
Instruction ID: c2a9a8309d2ac3b20c2a246f643af9afe3d8bdd482aaaa7b22bbd5c3acf846e4
Opcode Fuzzy Hash: bc9022557ffdde4da2c5c564d477ffd76f49cfdf06520c722d93622640c01a24
Instruction Fuzzy Hash: 6DB1F535A0062ACBCF28CF68E955ABEBBB1AF05308F14263DD452B7292C731AD01CB51

Function 00E2EC1F Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00E2EDA3

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 827375e929c0ef57e3052706124d51b3cf9ac97c9fefb2960550e9876c263e96
Instruction ID: 86468f7303ddeb4c2391b2abb9e782233eb0249f30fc30bbe9379f868023c05e
Opcode Fuzzy Hash: 827375e929c0ef57e3052706124d51b3cf9ac97c9fefb2960550e9876c263e96
Instruction Fuzzy Hash: D8B1D470A0067A8BCB24CF78E5556BFBBE1AF41308F28261DD456BB791C731AE41CB91

Function 00E2F2B2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00E2F436

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 172b41ffccb8f59ef3d3d13daa70b9bde314e7628006f8d996b4ef28200202bf
Instruction ID: 3076b3d636cc1d9b3b545795d1dcd5814c1e540e91992b7b3fff8ef937047733
Opcode Fuzzy Hash: 172b41ffccb8f59ef3d3d13daa70b9bde314e7628006f8d996b4ef28200202bf
Instruction Fuzzy Hash: 19B1907090062A8BCB24DF68E555ABFBBF1AF44308F14663DD462B7691C770EE41CB51

Function 00E52DDB Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00E46FEB: GetLastError.KERNEL32(00000000,?,00E4F927), ref: 00E46FEF
Part of subcall function 00E46FEB: SetLastError.KERNEL32(00000000,?,?,00000016,00E1D00B), ref: 00E47091

EnumSystemLocalesW.KERNEL32(00E52F01,00000001), ref: 00E52E4D

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d2288a4e9b138ed012dff8fdec2e7d88a6b4787b1ed1fc535274a231e74e2d9d
Instruction ID: f98ebbc528af25f581c383d40c849f791f52422ab63d25b143ad6a3f817ae10d
Opcode Fuzzy Hash: d2288a4e9b138ed012dff8fdec2e7d88a6b4787b1ed1fc535274a231e74e2d9d
Instruction Fuzzy Hash: 7811023A2007015FDB189F39D8925BABBA1FB85369B18482CEE8797A40E771A946C740

Function 00E53383 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00E46FEB: GetLastError.KERNEL32(00000000,?,00E4F927), ref: 00E46FEF
Part of subcall function 00E46FEB: SetLastError.KERNEL32(00000000,?,?,00000016,00E1D00B), ref: 00E47091

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00E5311D,00000000,00000000,?), ref: 00E533AF

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 882ac3483fe7936b60bb2e837e487f48bbd850a0123616c2efda16628a70310c
Instruction ID: 571b54773d23ce06f1e04fcfaeb0bb3eb034c6fb4c17ad02b3e9b5907bb72573
Opcode Fuzzy Hash: 882ac3483fe7936b60bb2e837e487f48bbd850a0123616c2efda16628a70310c
Instruction Fuzzy Hash: 91012636600112AFDB285A348846ABA7BA8EF40399F051829EC52B3180EE74EE49C690

Function 00E52E76 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00E46FEB: GetLastError.KERNEL32(00000000,?,00E4F927), ref: 00E46FEF
Part of subcall function 00E46FEB: SetLastError.KERNEL32(00000000,?,?,00000016,00E1D00B), ref: 00E47091

EnumSystemLocalesW.KERNEL32(00E53154,00000001), ref: 00E52EC0

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 6c82256d65f6505b3a915c1d6987ac53a14ab398079abadf3df1114d18332fa0
Instruction ID: 912fab63bd6d0c0b3f65c6cdb6905152fb60f23c7c9087d1e5615faf85987f88
Opcode Fuzzy Hash: 6c82256d65f6505b3a915c1d6987ac53a14ab398079abadf3df1114d18332fa0
Instruction Fuzzy Hash: 20F046323003045FCB259F35DC82A7B7B91EF823A8F05482DFE455B690CAB19C46C600

Function 00E0710F Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000404,00000008,?,00000020,?), ref: 00E07134

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 365f93eea588c90bd9af48f0d4e910b758e7836697dd5d6d2f76f3ccdd31bc1a
Instruction ID: a57d76871e348dac47ea7b1f6f170926958d83e05dcd53b74cf6b506beb40d61
Opcode Fuzzy Hash: 365f93eea588c90bd9af48f0d4e910b758e7836697dd5d6d2f76f3ccdd31bc1a
Instruction Fuzzy Hash: 68F0E2B2B80709AADB14EB749D06F9E77E89B01744F000220AA04F72C1EAA4AE098254

Function 00E49502 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00E4C509: EnterCriticalSection.KERNEL32(?,?,00E41EDA,00000000,00E77818,0000000C,00E41EA2,?,?,00E494C5,?,?,00E47189,00000001,00000364,?), ref: 00E4C518

EnumSystemLocalesW.KERNEL32(Function_000C94EF,00000001,00E77B48,0000000C), ref: 00E4953A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 561e178f0a8a57a600f26774f4df623090e5dc31bb4c2003840cbb057df66212
Instruction ID: 157a26ed1e88971348449dff18242d5338e0be82ec1f894b807904d26c83b8aa
Opcode Fuzzy Hash: 561e178f0a8a57a600f26774f4df623090e5dc31bb4c2003840cbb057df66212
Instruction Fuzzy Hash: 3FF01432A00204DFD700DF99E842B9A77E0FB49720F20916AE415FB2A2DBB95A848F50

Function 00E52D72 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00E46FEB: GetLastError.KERNEL32(00000000,?,00E4F927), ref: 00E46FEF
Part of subcall function 00E46FEB: SetLastError.KERNEL32(00000000,?,?,00000016,00E1D00B), ref: 00E47091

EnumSystemLocalesW.KERNEL32(00E52CCB,00000001), ref: 00E52DA9

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ac08b32fcc9c19ea6cc8d7b74005257aa9ff88964543ecf1cf2f2f0f1fbeb267
Instruction ID: 1655bdeb93c190bc4a78df84c0ba0ed48af0139464def2f453efdcb7c71c2a94
Opcode Fuzzy Hash: ac08b32fcc9c19ea6cc8d7b74005257aa9ff88964543ecf1cf2f2f0f1fbeb267
Instruction Fuzzy Hash: E5F0553A30020557CB049F36E895AAABFA0EFC2725F0A045DEF06AB251C271984BCB90

Function 00E49FE8 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00E45A04,?,20001004,00000000,00000002,?,?,00E44D67), ref: 00E4A01C

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: bf6c8719f7014db3ba2df45bf2416e02964d355fb5f90a002e1ff465212f47e1
Instruction ID: 2c0ea74204bcf38ad17728a5b06cf90afb33c41d90d0a80849a72a64384b7d9a
Opcode Fuzzy Hash: bf6c8719f7014db3ba2df45bf2416e02964d355fb5f90a002e1ff465212f47e1
Instruction Fuzzy Hash: 15E04F32541628BBCF162F61FC04A9E3F5AEF487A0F045124FD0575121CBB28D20AAD5

Function 00E496A1 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000C94EF,00000001), ref: 00E496BB

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 1d624c8cf2281a5d77252a08ea04bd23372de797b8e42f9b3fdf33a10f852477
Instruction ID: d7da78336c62698c6479075c4768763c6cb1e654db3f7a53a2c09543ebd9f699
Opcode Fuzzy Hash: 1d624c8cf2281a5d77252a08ea04bd23372de797b8e42f9b3fdf33a10f852477
Instruction Fuzzy Hash: 74D0C731644304AFDB149F53FC469163BAAF781750B208019F51C77271EBB568C5CF51

Function 00D83987 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

7h:, xrefs: 00D83BA2

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 7h:
API String ID: 0-3599125310
Opcode ID: 9259aebd46366da3d5a874b03e05f6b4cf46f97374197f7dff82fe5362a2eaa2
Instruction ID: 7f8840ff767cd49274a5c2471bf7b010d26bd17fb6ed1dd8c9355b40995caf36
Opcode Fuzzy Hash: 9259aebd46366da3d5a874b03e05f6b4cf46f97374197f7dff82fe5362a2eaa2
Instruction Fuzzy Hash: 3481A03590836ADFC7968F348D4A5D9BBB0FF0271871811AFCD808F267D721990ADB91

Function 00E4A027 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00E4A02D, 00E4A037

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: ae57c0584c5828c291265e6e956f543461494575456fe4048ab48dcb3ad1b7cd
Instruction ID: 4c27c88a2edf77cd5f4ace8f3741eed9d7f2ca53ba7e5d51e961f1f531f7f015
Opcode Fuzzy Hash: ae57c0584c5828c291265e6e956f543461494575456fe4048ab48dcb3ad1b7cd
Instruction Fuzzy Hash: 57E0C233B80728E7C23132A1BC06AAB7E84DB40BB1F047061FA08B5191A5A10951CAC9

Function 02902640 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9312f9e4bce9a142ace4b689672b0178d54afbb9146f6ae1d60a9b7b5f3a7bf
Instruction ID: 2067d6f0a7bab462a7682f9904b9a0e8d05e3fb47eecb87716722674c2e61e01
Opcode Fuzzy Hash: c9312f9e4bce9a142ace4b689672b0178d54afbb9146f6ae1d60a9b7b5f3a7bf
Instruction Fuzzy Hash: 692267B7C156B816F3957EB59C4435AB08297C8680F6B8635CEBCB7290ECF40D329AD0

Function 02901FA0 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1137f3e00d573dcb905e1adbf9c9653286b09371782d86a07b2b08473c00a92d
Instruction ID: 96699aa74de0b72628e227cf4bc2b3e0db67c6dc20059ac0878b1bb23522c0c4
Opcode Fuzzy Hash: 1137f3e00d573dcb905e1adbf9c9653286b09371782d86a07b2b08473c00a92d
Instruction Fuzzy Hash: B62272726047545FE358DB79C890A3BF7E7AFC8240F4AC92DF59AC7281D974E8058BA0

Function 00E173E0 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde7e712caaa58c2ccb03d3cc01d2f78cdfcba05dedc2e35b7754399b697a7b5
Instruction ID: 5fa6553b8533ff2e6db8cd2bd9e0b11fb31110a44006b53e981a1f9c2ec948bc
Opcode Fuzzy Hash: fde7e712caaa58c2ccb03d3cc01d2f78cdfcba05dedc2e35b7754399b697a7b5
Instruction Fuzzy Hash: 1D221A71A042258FDB2ACF18C880BEAB7B9BB45B05F1451EAE589FB244D7709FC18F41

Function 02901A40 Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3611924c097cb277cc3f63066ba03265fd3062a75d4d92040193f8b3e17b1ec3
Instruction ID: 47f50e0e3d8cadb9908a8f8451021d09ea92500d98b0b8176b4ce96b039618da
Opcode Fuzzy Hash: 3611924c097cb277cc3f63066ba03265fd3062a75d4d92040193f8b3e17b1ec3
Instruction Fuzzy Hash: 6C0231B16047445FE358DBB9C895A7BF7EAAFCC340F45892DB19AC7240DA74F8048BA1

Function 00E1AA70 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303e984645b886905797ab6da6454048eecbc84b3565a21ee2bcf27e6fdc6a9d
Instruction ID: 6ff7db34cc9f7727f365f95e16f71d92feb251a53fbd5483e981f0214de1d52d
Opcode Fuzzy Hash: 303e984645b886905797ab6da6454048eecbc84b3565a21ee2bcf27e6fdc6a9d
Instruction Fuzzy Hash: 50F14F71A012289FDB25DF18C880BEAB7B9FF86714F1851EAD949B7241D7705EC18F82

Function 00E2FCC1 Relevance: .3, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579e12af7e22889dc389584b28326fb01b4247708c63ead6756fd5d910714bfd
Instruction ID: 5f2968fa075364af249049be3dcd4b3cf52d00596f80592cc3f67fdd39eb96ce
Opcode Fuzzy Hash: 579e12af7e22889dc389584b28326fb01b4247708c63ead6756fd5d910714bfd
Instruction Fuzzy Hash: FEC1E33060062A8FDB25CF68E5947BABBB1BF05318F24663DD452B76A2C731ED45CB50

Function 00E1A620 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbc982b26241a00ab69ad152bf1aab28c24101ea20b8429fec881f55d967404
Instruction ID: cdf3a97eb2f5509fa57c56b1f498b94e68d65da2f0d30f21d6078c1433bb6340
Opcode Fuzzy Hash: 5dbc982b26241a00ab69ad152bf1aab28c24101ea20b8429fec881f55d967404
Instruction Fuzzy Hash: 0DA13B75A012298BDB24DF18D890BEDB7B5FF89314F1951EAD909B7241D730AEC28F81

Function 00E17F77 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95566b224d4007dce66983537732fde3e01ea63a137281dd6e23c407d0f8a82f
Instruction ID: cf3b03f493aea300b9d2048284ed28cc23fc2c1aabc80233933984d11e3245a0
Opcode Fuzzy Hash: 95566b224d4007dce66983537732fde3e01ea63a137281dd6e23c407d0f8a82f
Instruction Fuzzy Hash: F7515F72D00119AFDF14CF98C941AEEBBB2FF88344F198059E955AB201D775AA81CB90

Function 02901710 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4daa5f43f06c6c4e6f2464679809b00dc069ad0256fb44b93428dc6f067f7ee
Instruction ID: 0f22823596e13d9140a540f410c67d49f89f581d8971cc65a31f51c525bed80c
Opcode Fuzzy Hash: f4daa5f43f06c6c4e6f2464679809b00dc069ad0256fb44b93428dc6f067f7ee
Instruction Fuzzy Hash: 4121727ADA61638BD395CE25EC8073A3367EBC9320F2B4939CA1453155CB74E5269780

Function 02910277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1791398308.0000000002910000.00000040.00001000.00020000.00000000.sdmp, Offset: 02900000, based on PE: true

Associated: 00000000.00000003.1794274856.0000000002900000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2900000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 3a288e0f53ae63fd9e3ce195170818532134f91e12e866a1a6687d17ceaa9e67
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 71F06275A01208CF8728CF0AC648DA577FAEB857147654995D8049B221D3B2ED84CB50

Function 00E04FE0 Relevance: 105.4, APIs: 53, Strings: 7, Instructions: 387stringwindowCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(?,?,?), ref: 00E0500C
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?), ref: 00E05028
PathFileExistsW.SHLWAPI(?), ref: 00E05032
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00E05049
SetCurrentDirectoryW.KERNEL32(?), ref: 00E05057
LoadCursorW.USER32(00000000,00007F02), ref: 00E0507B
SetCursor.USER32(00000000), ref: 00E05082
DestroyCursor.USER32(00000000), ref: 00E05089
SendMessageW.USER32(00001027,00000000,00000000), ref: 00E050A4
GetCurrentDirectoryW.KERNEL32(0000012C,00E8066C), ref: 00E050B4
PathIsRootW.SHLWAPI(00E8066C), ref: 00E050E6
SHGetFileInfoW.SHELL32(00E8066C,00000000,?,000002B4,00000200), ref: 00E05120
PathFindFileNameW.SHLWAPI(00E8066C), ref: 00E05138
lstrcpyW.KERNEL32(?,00000000), ref: 00E05147
lstrcpyW.KERNEL32(?,00E8066C), ref: 00E0516D
PathRemoveFileSpecW.SHLWAPI(?), ref: 00E05177
lstrcatW.KERNEL32(?, - [), ref: 00E05190
lstrcatW.KERNEL32(?,?), ref: 00E051A2
lstrlenW.KERNEL32(00000000), ref: 00E051B7
lstrcatW.KERNEL32(?,00E7538C), ref: 00E051D5
SetWindowTextW.USER32(?,?), ref: 00E05202
lstrcmpW.KERNEL32(00E81AFC,*.*,?,?), ref: 00E05212
SendMessageW.USER32(00001024,00000000,00000000), ref: 00E05261
SendMessageW.USER32(00000440,0000A41E,00000020), ref: 00E052EF
GetPropW.USER32(00000000,DirListData), ref: 00E05338
ResetEvent.KERNEL32(?,?,?,?,?,?,?), ref: 00E0534F
ResetEvent.KERNEL32(?,?,?,?,?,?,?), ref: 00E05357
GetPropW.USER32(DirListData), ref: 00E05374
SHGetPathFromIDListW.SHELL32(?,?), ref: 00E05381
lstrcpyW.KERNEL32(00E8066C,?,?,?,?,?,?,?,?,?,?), ref: 00E05398
SetCurrentDirectoryW.KERNEL32(00E8066C,?,?,?,?,?,?,?,?,?), ref: 00E053A3
SendMessageW.USER32(0000102B,00000000,?), ref: 00E053D3

Strings

*.*, xrefs: 00E05208, 00E05480
DirListData, xrefs: 00E05332, 00E05369
, xrefs: 00E052C2
- [, xrefs: 00E0518A
(, xrefs: 00E05572
, xrefs: 00E05263
\, xrefs: 00E051BD

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Directory$CurrentPath$FileMessageSend$Cursorlstrcatlstrcpy$EventPropReset$DestroyExistsFindFromInfoListLoadNameRemoveRootSpecTextWindowWindowslstrcmplstrlen
String ID: $ $ - [$($*.*$DirListData$\
API String ID: 2993255122-80515274
Opcode ID: 0f67edbe63c10803c1cb29d0f83090d8176858cefa13db3077ab0d6406566d9c
Instruction ID: 8d989fccad4c15a979af0eb7bddc7466141c8169d644fc6e86a1b25a6d899896
Opcode Fuzzy Hash: 0f67edbe63c10803c1cb29d0f83090d8176858cefa13db3077ab0d6406566d9c
Instruction Fuzzy Hash: 7FE1C672640B04AFD720AF61EC49FAB7BA8FB48744F005819F649B61E1E7F0A588CF55

Function 00DF4C70 Relevance: 103.7, APIs: 54, Strings: 5, Instructions: 415stringwindowCOMMON

Download Yara Rule

APIs

GetDlgItemTextW.USER32(?,00000064,?,00000104), ref: 00DF4D00
GetSystemDirectoryW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,00000104), ref: 00DF4D10
PathAddBackslashW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 00DF4D1B
lstrcatW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,Viewers\Quikview.exe), ref: 00DF4D2B
PathQuoteSpacesW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 00DF4D36
lstrcpyW.KERNEL32(00E80ACC,00E74520), ref: 00DF4D4C
lstrcpyW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,?), ref: 00DF4D66
StrChrW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe,00000020), ref: 00DF4DA8
lstrcpyW.KERNEL32(00E80ACC,-00000002), ref: 00DF4DC0
lstrcpyW.KERNEL32(?,C:\Users\user\Documents), ref: 00DF4DE3
GetDlgItemTextW.USER32(?,00000066,C:\Users\user\Documents,00000104), ref: 00DF4DF2
SHGetSpecialFolderLocation.SHELL32(00000000,00000005,?), ref: 00DF4E01
SHGetPathFromIDListW.SHELL32(?,C:\Users\user\Documents), ref: 00DF4E14
CoTaskMemFree.OLE32(?), ref: 00DF4E1E
GetWindowsDirectoryW.KERNEL32(C:\Users\user\Documents,00000104), ref: 00DF4E30
lstrcmpiW.KERNEL32(?,C:\Users\user\Documents), ref: 00DF4E55
SetWindowLongW.USER32(?,00000000,00000000), ref: 00DF4E6E
GetDlgItem.USER32(?,00000065), ref: 00DF4E82
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 00DF4E91
ImageList_Destroy.COMCTL32(?), ref: 00DF4EA5
GetDlgItem.USER32(?,00000067), ref: 00DF4EAA
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 00DF4EB9
ImageList_Destroy.COMCTL32(?), ref: 00DF4EC7
SendMessageW.USER32(?,00000080,00000000,0005047B), ref: 00DF4EF4
lstrcpyW.KERNEL32(?,C:\Windows\system32\Viewers\Quikview.exe), ref: 00DF4F32
PathQuoteSpacesW.SHLWAPI(?), ref: 00DF4F40
StrCatBuffW.SHLWAPI(?,00E74F0C,00000104), ref: 00DF4F68
StrCatBuffW.SHLWAPI(?,00E80ACC,00000104), ref: 00DF4F7C
SendDlgItemMessageW.USER32(?,00000064,000000C5,00000102,00000000), ref: 00DF4F8D
SetDlgItemTextW.USER32(?,00000064,?), ref: 00DF4FA4
GetDlgItem.USER32(?,00000064), ref: 00DF4FB1
SHAutoComplete.SHLWAPI(00000000), ref: 00DF4FBA
SendDlgItemMessageW.USER32(?,00000066,000000C5,00000102,00000000), ref: 00DF4FCE
SetDlgItemTextW.USER32(?,00000066,C:\Users\user\Documents), ref: 00DF4FDF
GetDlgItem.USER32(?,00000066), ref: 00DF4FE9
SHAutoComplete.SHLWAPI(00000000), ref: 00DF4FEC
GetDlgItemTextW.USER32(?,00000066,?,00000104), ref: 00DF5020
StrTrimW.SHLWAPI(?,00E750B0), ref: 00DF5033
GetDlgItemTextW.USER32(?,00000064,?,00000104), ref: 00DF508A
lstrcpyW.KERNEL32(?,?), ref: 00DF50A6
StrChrW.SHLWAPI(?,00000020), ref: 00DF50F4
lstrcpyW.KERNEL32(?,-00000002), ref: 00DF510F
LoadStringW.USER32(00002AF9,?,00000020), ref: 00DF5144
LoadStringW.USER32(00002AF9,?,00000020), ref: 00DF515F
LoadStringW.USER32(00002AFD,?,00000100), ref: 00DF5179
LoadStringW.USER32(00002AFD,?,00000100), ref: 00DF5197
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000058), ref: 00DF51E7
StrCpyNW.SHLWAPI(?,?,00000104), ref: 00DF5206
PathQuoteSpacesW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000058), ref: 00DF5214
StrCatBuffW.SHLWAPI(?,00E74F0C,00000104), ref: 00DF523D
StrCatBuffW.SHLWAPI(?,?,00000104), ref: 00DF5254
SetDlgItemTextW.USER32(?,00000064,?), ref: 00DF5261
PostMessageW.USER32(?,00000028,00000001,00000000), ref: 00DF526E

Strings

C:\Users\user\Documents, xrefs: 00DF4DD6, 00DF4DEA, 00DF4E0B, 00DF4E2B, 00DF4E3D, 00DF4E48, 00DF4FD4
X, xrefs: 00DF51AC
", xrefs: 00DF50C2
C:\Windows\system32\Viewers\Quikview.exe, xrefs: 00DF4D0B, 00DF4D16, 00DF4D26, 00DF4D31, 00DF4D61, 00DF4D6A, 00DF4D8D, 00DF4D92, 00DF4DA3, 00DF4DC2, 00DF4F2C
Viewers\Quikview.exe, xrefs: 00DF4D21

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Item$Textlstrcpy$Message$PathSend$BuffLoadString$QuoteSpaces$AutoCompleteDestroyDirectoryImageList_$BackslashFileFolderFreeFromListLocationLongNameOpenPostSpecialSystemTaskTrimWindowWindowslstrcatlstrcmpi
String ID: "$C:\Users\user\Documents$C:\Windows\system32\Viewers\Quikview.exe$Viewers\Quikview.exe$X
API String ID: 583393450-834333410
Opcode ID: 0e418c57f1e308a001a480987bdc3b8cbab22af53cedfa3e4a2195b4f9dccfea
Instruction ID: f65a26c0011ce9a4ff22406dcfbd6941421dc75f377aee082829ace677412850
Opcode Fuzzy Hash: 0e418c57f1e308a001a480987bdc3b8cbab22af53cedfa3e4a2195b4f9dccfea
Instruction Fuzzy Hash: E1E1B372744709AFE760EB61EC4AFAB77A8BB44740F04851AF749F61D0DBB09448CB62

Function 00DF7700 Relevance: 75.3, APIs: 50, Instructions: 335windowthreadCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 00DF7771
SendMessageW.USER32(?,00000202,00000000,00000000), ref: 00DF7781
GetDlgItemTextW.USER32(?,00000066,?,00000104), ref: 00DF77D9
PathQuoteSpacesW.SHLWAPI(?), ref: 00DF77F8
GetParent.USER32(?), ref: 00DF7806
SetDlgItemTextW.USER32(00000000), ref: 00DF780D
GetDlgItemTextW.USER32(?,00000065,?,00000104), ref: 00DF7820
DestroyCursor.USER32 ref: 00DF786B
DestroyCursor.USER32 ref: 00DF7873
DestroyCursor.USER32 ref: 00DF787B
EndDialog.USER32(?,00000001), ref: 00DF7884
LoadIconW.USER32(0000006B), ref: 00DF78BA
LoadIconW.USER32(0000006C), ref: 00DF78C9
LoadCursorW.USER32(00000064), ref: 00DF78D8
SendMessageW.USER32(?,00000080,00000000,0005047B), ref: 00DF78F5
ReleaseCapture.USER32 ref: 00DF7928
GetCursorPos.USER32(?), ref: 00DF794F
WindowFromPoint.USER32(?,?), ref: 00DF795D
GetWindowLongW.USER32(00000000,000000F0), ref: 00DF796E
GetParent.USER32(00000000), ref: 00DF7978
GetWindowLongW.USER32(00000000,000000F0), ref: 00DF7983
GetWindowTextW.USER32(00000000,?,00000100), ref: 00DF799F
SetDlgItemTextW.USER32(?,00000064,?), ref: 00DF79B3
GetClassNameW.USER32(00000000,?,00000100), ref: 00DF79C0
SetDlgItemTextW.USER32(?,00000065,?), ref: 00DF79CE
GetWindowThreadProcessId.USER32(00000000,?), ref: 00DF79DE
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00DF79EF
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 00DF7A04
GetModuleFileNameExW.PSAPI(00000000,?,?,00000100), ref: 00DF7A19
CloseHandle.KERNEL32(00000000), ref: 00DF7A20
SetDlgItemTextW.USER32(?,00000066,?), ref: 00DF7A2E
SetDlgItemTextW.USER32(?,00000064,00E74520), ref: 00DF7A43
SetDlgItemTextW.USER32(?,00000065,00E74520), ref: 00DF7A4D
SetDlgItemTextW.USER32(?,00000066,00E74520), ref: 00DF7A57
LoadCursorW.USER32(?,00007F00), ref: 00DF7A78
SetCursor.USER32(00000000), ref: 00DF7A7F
SendDlgItemMessageW.USER32(?,00000067,00000170,00000000), ref: 00DF7A95
ReleaseCapture.USER32 ref: 00DF7A9B
GetDlgItemTextW.USER32(?,00000065,?,00000100), ref: 00DF7AB8
GetDlgItem.USER32(?,00000001), ref: 00DF7AC8
EnableWindow.USER32(00000000), ref: 00DF7ACB
GetDlgItem.USER32(?,00000001), ref: 00DF7AD4
IsWindowEnabled.USER32(00000000), ref: 00DF7AD7
GetDlgItem.USER32(?,00000001), ref: 00DF7AE6
PostMessageW.USER32(?,00000028,00000000), ref: 00DF7AEC
ChildWindowFromPoint.USER32(?,?,?), ref: 00DF7AFD
GetDlgCtrlID.USER32(00000000), ref: 00DF7B04
SetCapture.USER32(?), ref: 00DF7B10
SetCursor.USER32 ref: 00DF7B26
SendDlgItemMessageW.USER32(?,00000067,00000170,00000000), ref: 00DF7B3C

Part of subcall function 00DFB430: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00DFB475
Part of subcall function 00DFB430: PathRemoveFileSpecW.SHLWAPI(?), ref: 00DFB483
Part of subcall function 00DFB430: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00DFB496
Part of subcall function 00DFB430: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 00DFB4A9
Part of subcall function 00DFB430: PathIsRelativeW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 00DFB4BE
Part of subcall function 00DFB430: PathIsPrefixW.SHLWAPI(?,?), ref: 00DFB4DB
Part of subcall function 00DFB430: PathIsPrefixW.SHLWAPI(?,C:\Windows\system32\Viewers\Quikview.exe), ref: 00DFB4E7
Part of subcall function 00DFB430: PathRelativePathToW.SHLWAPI(?,?,00000010,C:\Windows\system32\Viewers\Quikview.exe,?), ref: 00DFB502
Part of subcall function 00DFB430: lstrcpyW.KERNEL32(?,%CSIDL:MYDOCUMENTS%), ref: 00DFB51C
Part of subcall function 00DFB430: PathAppendW.SHLWAPI(?,?), ref: 00DFB52B
Part of subcall function 00DFB430: lstrcpyW.KERNEL32(?,?), ref: 00DFB53E
Part of subcall function 00DFB430: PathUnExpandEnvStringsW.SHLWAPI(?,?,00000104), ref: 00DFB5AF
Part of subcall function 00DFB430: lstrcpynW.KERNEL32(?,?,00000104), ref: 00DFB5CE

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Item$Text$Path$CursorWindow$Message$CaptureLoadSend$DestroyFileNameProcessRelease$FromIconLongModuleParentPointPrefixRelativelstrcpy$AppendChildClassCloseCtrlDialogDirectoryEnableEnabledEnumExpandFolderHandleModulesOpenPostQuoteRemoveSpacesSpecStringsThreadWindowslstrcpyn
String ID:
API String ID: 4248756809-0
Opcode ID: 01a8efdde9ea0a30b82ecef3a5310e1804bb8bef75cd3ce5da410eeaa76663e3
Instruction ID: 3ea2f560d77162108bf9215ad089aaf620cceb26302df72139c24603b6548235
Opcode Fuzzy Hash: 01a8efdde9ea0a30b82ecef3a5310e1804bb8bef75cd3ce5da410eeaa76663e3
Instruction Fuzzy Hash: AAB1D072604305AFE7209F61EC4DFAB7BADFB08340F04451AF646BA1E1DBB59948CB61

Function 00E055E0 Relevance: 70.4, APIs: 39, Strings: 1, Instructions: 368stringmemoryCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,75BFCF90,?,?,?,00DFE4A6), ref: 00E055E5
StrChrW.SHLWAPI(00000000,00000009,?,?,?,00DFE4A6), ref: 00E05609
StrChrW.SHLWAPI(00000000,00000009,?,?,?,00DFE4A6), ref: 00E0561A
lstrlenW.KERNEL32(00000000,?,?,?,00DFE4A6), ref: 00E0562C
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,00DFE4A6), ref: 00E0563E
lstrlenW.KERNEL32(00000000,?,?,?,00DFE4A6), ref: 00E05643
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,00DFE4A6), ref: 00E0564F
lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E0565B
StrChrW.SHLWAPI(00000000,00000020,?,?,?,00DFE4A6), ref: 00E05693
lstrcpyW.KERNEL32(00000000,-00000002,?,?,?,00DFE4A6), ref: 00E056A7
lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E056D5
StrChrW.SHLWAPI(00000000,00000020,?,?,?,00DFE4A6), ref: 00E0570B
lstrcpyW.KERNEL32(00000000,-00000002,?,?,?,00DFE4A6), ref: 00E0571F
GlobalFree.KERNEL32(00000000), ref: 00E05753
GlobalAlloc.KERNEL32(00000040,0000020C,?,?,?,00DFE4A6), ref: 00E05760
lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E0576D
StrTrimW.SHLWAPI(00000000,00E75864,?,?,?,00DFE4A6), ref: 00E0577A
CharUpperW.USER32(00000000,?,?,?,00DFE4A6), ref: 00E05781
CharUpperW.USER32(00000002,?,?,?,00DFE4A6), ref: 00E057D9
lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E057EB
StrChrW.SHLWAPI(00000000,00000020,?,?,?,00DFE4A6), ref: 00E05821
lstrcpyW.KERNEL32(00000000,-00000002,?,?,?,00DFE4A6), ref: 00E05835
StrCpyNW.SHLWAPI(00E7D538,00000000,00000104,?,?,?,00DFE4A6), ref: 00E0585D
PathUnquoteSpacesW.SHLWAPI(00E7D538,?,?,?,00DFE4A6), ref: 00E05872
lstrcpyW.KERNEL32(00E7D538,00E74724,?,?,?,00DFE4A6), ref: 00E05887
CharUpperW.USER32(00000002,00000022,?,?,?,00DFE4A6), ref: 00E05892
CharUpperW.USER32(00000002,?,?,?,00DFE4A6), ref: 00E058A3
lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E058BB
StrChrW.SHLWAPI(00000000,00000020,?,?,?,00DFE4A6), ref: 00E058F1
lstrcpyW.KERNEL32(00000000,-00000002,?,?,?,00DFE4A6), ref: 00E05905

Part of subcall function 00DFBB00: CharNextW.USER32(?,?,74E2F860,?,00DF50BE), ref: 00DFBB21
Part of subcall function 00DFBB00: lstrlenW.KERNEL32(?,?,74E2F860,?,00DF50BE), ref: 00DFBB32
Part of subcall function 00DFBB00: lstrlenW.KERNEL32(?,?,?,00DF50BE), ref: 00DFBB47
Part of subcall function 00DFBB00: CharPrevW.USER32(?,00000000,?,?,00DF50BE), ref: 00DFBB54
Part of subcall function 00DFBB00: CharPrevW.USER32(?,00000000,?,?,00DF50BE), ref: 00DFBB67

lstrcpyW.KERNEL32(00000000,00000000,00000022,?,?,?,00DFE4A6), ref: 00E059C5
StrChrW.SHLWAPI(00000000,00000020,?,?,?,00DFE4A6), ref: 00E059FB
lstrcpyW.KERNEL32(00000000,-00000002,?,?,?,00DFE4A6), ref: 00E05A0F
GlobalFree.KERNEL32(00000000), ref: 00E05A36
lstrlenW.KERNEL32(00000000,?,?,?,00DFE4A6), ref: 00E05A3D
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,00DFE4A6), ref: 00E05A4D
lstrcpyW.KERNEL32(00000000,00000000,?,?,?,00DFE4A6), ref: 00E05A5A
LocalFree.KERNEL32(00000000,?,?,?,00DFE4A6), ref: 00E05A68
LocalFree.KERNEL32(00000000,?,?,?,00DFE4A6), ref: 00E05A6B

Strings

%i,%i,%i,%i, xrefs: 00E05936

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: lstrcpy$Char$lstrlen$AllocFreeGlobalLocalUpper$Prev$CommandLineNextPathSpacesTrimUnquote
String ID: %i,%i,%i,%i
API String ID: 792320778-2825437791
Opcode ID: ef8c1102baded001d6ea4c0f907d09f904b30c619f82e9757cdea8bb7f331703
Instruction ID: 5fffdb79e14ad8ac868193ce1eb93396065ed54ce7c4c5b20b455fb39fb2bfdb
Opcode Fuzzy Hash: ef8c1102baded001d6ea4c0f907d09f904b30c619f82e9757cdea8bb7f331703
Instruction Fuzzy Hash: 03B12A33700B09AFDB102B61AC95B3F26A8DF41354F58642AF605B72D5EBA4C884DF76

Function 00DF5610 Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 249windowstringCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 00DF5682
GetDlgItemTextW.USER32(?,00000064,00E7E6B8,00000200), ref: 00DF569A
CheckMenuRadioItem.USER32(00000000,0000FFFF,00000400), ref: 00DF56C9
GetDlgItem.USER32(?,00000065), ref: 00DF56E4
GetWindowRect.USER32(00000000), ref: 00DF56EB
TrackPopupMenuEx.USER32(00000102,?,?,?,00000000), ref: 00DF570B
GetMenuStringW.USER32(00000000,?,00000100,00000000), ref: 00DF572F
SetDlgItemTextW.USER32(?,00000064,00000000), ref: 00DF577A
CheckDlgButton.USER32(?,00000066,00000001), ref: 00DF5785
SetDlgItemTextW.USER32(?,00000064,0000002D), ref: 00DF5795
CheckDlgButton.USER32(?,00000066,00000000), ref: 00DF57A0
DestroyMenu.USER32 ref: 00DF57C7
GetDlgItem.USER32(?,00000064), ref: 00DF57DC
PostMessageW.USER32(?,00000028,00000000), ref: 00DF57E6
EndDialog.USER32(?,00000002), ref: 00DF5809
GetDlgItemTextW.USER32(?,00000064,00E81AFC,000000FF), ref: 00DF5836
IsDlgButtonChecked.USER32(?,00000066), ref: 00DF5843
EndDialog.USER32(?,00000001), ref: 00DF5857
lstrcpyW.KERNEL32(00E81AFC,*.*), ref: 00DF5881
EndDialog.USER32(?,00000001), ref: 00DF5894
SendMessageW.USER32(?,00000080,00000000,0005047B), ref: 00DF58C6
SendDlgItemMessageW.USER32(?,00000064,000000C5,000000FF,00000000), ref: 00DF58F1
SetDlgItemTextW.USER32(?,00000064,00E81AFC), ref: 00DF58FF
CheckDlgButton.USER32(?,00000066,00000000), ref: 00DF5914
GetDlgItem.USER32(?,00000065), ref: 00DF593E
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 00DF5951
ImageList_Destroy.COMCTL32(?), ref: 00DF595F

Strings

*.*, xrefs: 00DF5877
Filters, xrefs: 00DF573E
-, xrefs: 00DF5762

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Item$MenuText$ButtonCheckMessage$DialogSend$DestroyPopup$CheckedCreateImageList_PostRadioRectStringTrackWindowlstrcpy
String ID: *.*$-$Filters
API String ID: 2651413375-1911857017
Opcode ID: 8c1b9aa7a3bfa4933e21e0e782da934a6527bb29728cd0c08b059fd4136d7a86
Instruction ID: 454c6ff811f5819a27b0c8f9636cb4c873b39a8cb351ff4d5fc16b3f2415063f
Opcode Fuzzy Hash: 8c1b9aa7a3bfa4933e21e0e782da934a6527bb29728cd0c08b059fd4136d7a86
Instruction Fuzzy Hash: 6F81BE32340A04AFE220AB65FC0EF7B3B99EB08741F004115F74AB91E1DBF599598B66

Function 00DE9990 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,75BFCF90), ref: 00DE99B6
lstrcmpiW.KERNEL32(00E7D538,00E74724), ref: 00DE99D4
ExpandEnvironmentStringsW.KERNEL32(00E7D538,?,00000138), ref: 00DE9A1D
lstrcpynW.KERNEL32(00E7D538,?,00000104), ref: 00DE9A39
PathIsRelativeW.SHLWAPI(00E7D538), ref: 00DE9A44
lstrcpyW.KERNEL32(?,?), ref: 00DE9A61
PathRemoveFileSpecW.SHLWAPI(?), ref: 00DE9A68
PathAppendW.SHLWAPI(?,00E7D538), ref: 00DE9A78
lstrcpyW.KERNEL32(00E7D538,?), ref: 00DE9A88
PathFindFileNameW.SHLWAPI(?), ref: 00DE9AB5
lstrcpyW.KERNEL32(?,00000000), ref: 00DE9AC3
PathRenameExtensionW.SHLWAPI(?,.ini), ref: 00DE9AD5
lstrcpyW.KERNEL32(?,minipath.ini), ref: 00DE9AF5
lstrcpyW.KERNEL32(00E7D538,?), ref: 00DE9B18
PathRenameExtensionW.SHLWAPI(00E7D538,.ini), ref: 00DE9B24
PathRemoveFileSpecW.SHLWAPI(?), ref: 00DE9B7E
lstrcatW.KERNEL32(?,\Notepad3.exe), ref: 00DE9B91
PathFindFileNameW.SHLWAPI(?), ref: 00DE9B9F
lstrcpyW.KERNEL32(?,00000000), ref: 00DE9BA7
PathRenameExtensionW.SHLWAPI(?,.ini), ref: 00DE9BB3
lstrcpyW.KERNEL32(?,notepad3.ini), ref: 00DE9BD5
lstrcpyW.KERNEL32(00E7D330,?), ref: 00DE9BFA
PathRenameExtensionW.SHLWAPI(00E7D330,.ini), ref: 00DE9C06

Strings

notepad3.ini, xrefs: 00DE9BCB, 00DE9C11, 00DE9C34
minipath, xrefs: 00DE9B39, 00DE9B5C
\Notepad3.exe, xrefs: 00DE9B84
.ini, xrefs: 00DE9ACF, 00DE9B1A, 00DE9BA9, 00DE9BFC
notepad3, xrefs: 00DE9C1B, 00DE9C3E
minipath.ini, xrefs: 00DE9AEB, 00DE9B2F, 00DE9B52

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$lstrcpy$File$ExtensionRename$Name$FindRemoveSpec$AppendEnvironmentExpandModuleRelativeStringslstrcatlstrcmpilstrcpyn
String ID: .ini$\Notepad3.exe$minipath$minipath.ini$notepad3$notepad3.ini
API String ID: 3294106345-3709775904
Opcode ID: 486b98d50d580801dd7fbacea66cc71dceedb7c899ad8bf0b1d0bb26aed511fa
Instruction ID: 21b67493ab94d1a08c4c8db8c1e4ebec3e8d899789ed13cf47279ea49f68f0c9
Opcode Fuzzy Hash: 486b98d50d580801dd7fbacea66cc71dceedb7c899ad8bf0b1d0bb26aed511fa
Instruction Fuzzy Hash: 306183B2644349ABC614EF61EC85DDBB7ECEFD5744F40482AF549E2190EBB0D5088AB2

Function 00E05CF0 Relevance: 48.3, APIs: 32, Instructions: 269windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFB810: CoCreateInstance.OLE32(00E6A89C,00000000,00000001,00E66D8C,?,0000C356,?), ref: 00DFB83F
Part of subcall function 00DFB810: lstrcpyW.KERNEL32(?,?), ref: 00DFB86B
Part of subcall function 00DFB810: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 00DFB8F2
Part of subcall function 00DFB810: lstrcpynW.KERNEL32(?,?,?), ref: 00DFB90C

PathFileExistsW.SHLWAPI(?,74E2F860), ref: 00E05D25
PathIsDirectoryW.SHLWAPI(?), ref: 00E05D30
lstrcpyW.KERNEL32(?,?), ref: 00E05D68
PathRemoveFileSpecW.SHLWAPI(?), ref: 00E05D76
SetCurrentDirectoryW.KERNEL32(?), ref: 00E05D84
SendMessageW.USER32(00000111,00019D0D,00000000), ref: 00E05DA2
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 00E05DB6
SendMessageW.USER32(00001013,00000000,00000000), ref: 00E05DDA
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,74E2F860), ref: 00E05DF8
lstrcpynW.KERNEL32(?,?,00000104), ref: 00E05E14
lstrcpyW.KERNEL32(?,?), ref: 00E05E4B
GetFileAttributesW.KERNEL32(?), ref: 00E05E55
SetCurrentDirectoryW.KERNEL32(?), ref: 00E05E70
PostMessageW.USER32(00000111,00019D0D,00000000), ref: 00E05E90
SendMessageW.USER32(00001013,00000000,00000000), ref: 00E05EA5
lstrcpyW.KERNEL32(?,?), ref: 00E05EE4
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 00E05EFF
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00E05F11
PathIsRootW.SHLWAPI(?), ref: 00E05F2B
SetCurrentDirectoryW.KERNEL32(?), ref: 00E05F40
SendMessageW.USER32 ref: 00E05F6E
SendMessageW.USER32(00001053,000000FF,00000111), ref: 00E05F82
SendMessageW.USER32(0000102B,00000000,?), ref: 00E05FAC
SendMessageW.USER32(00001013,00000000,00000000), ref: 00E05FC2
PathFileExistsW.SHLWAPI(?), ref: 00E05FE1
PathIsDirectoryW.SHLWAPI(?), ref: 00E05FEC
lstrcpyW.KERNEL32(?,?), ref: 00E06024
PathRemoveFileSpecW.SHLWAPI(?), ref: 00E0602E
SetCurrentDirectoryW.KERNEL32(?), ref: 00E0603C
SendMessageW.USER32(00000111,00019D0D,00000000), ref: 00E0605A
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 00E0606E
SendMessageW.USER32(00001013,00000000,00000000), ref: 00E06092

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Message$Send$File$Path$Directory$lstrcpy$Current$Info$EnvironmentExistsExpandRemoveSpecStringslstrcpyn$AttributesCreateInstancePostRoot
String ID:
API String ID: 3952839607-0
Opcode ID: 3f3952f57972af0c9464078c22ee897f61dee6fc094df36b1245991ff8870e76
Instruction ID: 5303e4fdcfbceeeed7870fd207876f86757ec99700f2d28ac0d49c1a124fef6b
Opcode Fuzzy Hash: 3f3952f57972af0c9464078c22ee897f61dee6fc094df36b1245991ff8870e76
Instruction Fuzzy Hash: 91918F72644B44AFE730AB61EC49F9B77ACAF48B40F100829F645E61D1EBF4E6488F51

Function 00E01DD0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 208windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00001032,00000000,00000000,?), ref: 00E01DF9

Part of subcall function 00DF9480: SendMessageW.USER32(00000000,00001032,00000000,00000000), ref: 00DF94B8
Part of subcall function 00DF9480: SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 00DF94C8
Part of subcall function 00DF9480: SendMessageW.USER32(?,?,00000000,0000104B), ref: 00DF94ED

EnableMenuItem.USER32(?,00009C44,00000000), ref: 00E01E46
EnableMenuItem.USER32(?,00009C44,00000001), ref: 00E01E58
EnableMenuItem.USER32(?,00009C45,00000001), ref: 00E01E81
EnableMenuItem.USER32(?,00009C46,00000000), ref: 00E01E91
EnableMenuItem.USER32(?,00009C4A,00000000), ref: 00E01E9A
EnableMenuItem.USER32(?,00009C4B,00000001), ref: 00E01EBA
EnableMenuItem.USER32(?,00009C4C,00000000), ref: 00E01EC3
EnableMenuItem.USER32(?,00009C4D,00000000), ref: 00E01ECC
EnableMenuItem.USER32(?,00009C50,00000000), ref: 00E01ED5
SendMessageW.USER32(00000147,00000000,00000000), ref: 00E01EE6
EnableMenuItem.USER32(?,00009C53,00000000), ref: 00E01EFB
CheckMenuItem.USER32(?,00009D0A,000000E0), ref: 00E01F15
CheckMenuItem.USER32(?,00009D0B,000000E0), ref: 00E01F29
CheckMenuItem.USER32(?,00009D0C,000000E0), ref: 00E01F3D
lstrcmpW.KERNEL32(00E81AFC,*.*), ref: 00E01F49
EnableMenuItem.USER32(?,00009D11,00000000), ref: 00E01F6B
CheckMenuItem.USER32(?,00009D13,00000001), ref: 00E01F80
EnableMenuItem.USER32(?,00009D14,00000000), ref: 00E01F94
CheckMenuItem.USER32(?,00009D15,00000001), ref: 00E01FA9
CheckMenuItem.USER32(?,00009D12,00000001), ref: 00E01FBE
CheckMenuRadioItem.USER32(?,00009D6D,00009D70,-00009D6B,00000000), ref: 00E01FD8
CheckMenuItem.USER32(?,00009D71,00000000), ref: 00E01FF1
CheckMenuItem.USER32(?,0000EA61,00000000), ref: 00E02006
EnableMenuItem.USER32(?,00009D16,00000000), ref: 00E0202C

Strings

*.*, xrefs: 00E01F3F
C:\Users\user\Desktop\dZIZhRHDXv.ini, xrefs: 00E02012

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ItemMenu$Enable$Check$MessageSend$Radiolstrcmp
String ID: *.*$C:\Users\user\Desktop\dZIZhRHDXv.ini
API String ID: 4226156974-3401776512
Opcode ID: 3ba9245e53888ae8b598488a5d4010dac37af3a342da63de7202a9a7e74377aa
Instruction ID: 14501c44194332157ccd98d8ef61a323f6b86599a45ade394714a63f1e8d1784
Opcode Fuzzy Hash: 3ba9245e53888ae8b598488a5d4010dac37af3a342da63de7202a9a7e74377aa
Instruction Fuzzy Hash: FA5102723D0704BEF220AB35EC42FAB32DCEF95745F100111FA15FA0D1D7E899898A65

Function 00DF7B90 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 253windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,98D825DA), ref: 00DF821F
GetDlgItem.USER32(?,00000067), ref: 00DF824D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DF8277
DestroyWindow.USER32(00000000), ref: 00DF827E
SendMessageW.USER32(?,00000080,00000000,0005047B), ref: 00DF8296
SendDlgItemMessageW.USER32(?,00000066,000000C5,00000103,00000000), ref: 00DF82C4
GetDlgItem.USER32(?,00000066), ref: 00DF82CB
SHAutoComplete.SHLWAPI(00000000), ref: 00DF82D2
SendDlgItemMessageW.USER32(?,0000006C,000000C5,00000080,00000000), ref: 00DF82E7
SendDlgItemMessageW.USER32(?,0000006D,000000C5,00000080,00000000), ref: 00DF82F8
SendDlgItemMessageW.USER32(?,0000006E,000000C5,00000080,00000000), ref: 00DF8309
CheckRadioButton.USER32(?,00000064,00000065,00000064), ref: 00DF832A
GetDlgItem.USER32(?,00000067), ref: 00DF8460
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 00DF8472
ImageList_Destroy.COMCTL32(?), ref: 00DF847F

Strings

0, xrefs: 00DF8239
tooltips_class32, xrefs: 00DF8218

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ItemMessageSend$DestroyWindow$AutoButtonCheckCompleteCreateImageList_Radio
String ID: 0$tooltips_class32
API String ID: 2672803554-3619404913
Opcode ID: cf9e0d3a08709d6f8e209a3c051c88697f995c798e9c53ae11c2f43101d9797c
Instruction ID: 8fa3dee4bae225a942ff7d2dc9d77693c51a27c88d6315e9cb38fea07382d908
Opcode Fuzzy Hash: cf9e0d3a08709d6f8e209a3c051c88697f995c798e9c53ae11c2f43101d9797c
Instruction Fuzzy Hash: 2981E131B40309ABE7208B21DC4AF7B36BAFB44B40F04811AF605FA1E0DBF59844DB61

Function 00DF8AD0 Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 380windowstringmemoryCOMMON

Download Yara Rule

APIs

GetPropW.USER32(00000000,DirListData), ref: 00DF8B55
SHGetFileInfoW.SHELL32(Icon,00000010,?,000002B4,00004011), ref: 00DF8B7C
SHGetFileInfoW.SHELL32(Icon,00000080,?,000002B4,00004011), ref: 00DF8BA7

Part of subcall function 00DF8A30: GetPropW.USER32(?,DirListData), ref: 00DF8A3A
Part of subcall function 00DF8A30: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A48
Part of subcall function 00DF8A30: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A56
Part of subcall function 00DF8A30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DF8A82
Part of subcall function 00DF8A30: TranslateMessage.USER32(?), ref: 00DF8A8D
Part of subcall function 00DF8A30: DispatchMessageW.USER32(?), ref: 00DF8A94
Part of subcall function 00DF8A30: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A9E
Part of subcall function 00DF8A30: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8AB1
Part of subcall function 00DF8A30: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8ABD

lstrcpyW.KERNEL32(00000010,C:\Users\user\Desktop,?,?), ref: 00DF8BD8
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00DF8BE5
SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00DF8BF5
lstrcmpW.KERNEL32(?,*.*,?,?,?,?,?,?), ref: 00DF8C67
StrChrW.SHLWAPI ref: 00DF8C8D
StrChrW.SHLWAPI(?,0000003B), ref: 00DF8CB3
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?), ref: 00DF8D06
SHGetDesktopFolder.SHELL32(?,?,?,?,?,?,?,?,?), ref: 00DF8D11
SHGetDataFromIDListW.SHELL32(?,?,00000001,?,00000250), ref: 00DF8E16
PathMatchSpecW.SHLWAPI(?,?), ref: 00DF8E59
CoTaskMemAlloc.OLE32(00000008), ref: 00DF8E7C
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00DF8EDA
CoTaskMemFree.OLE32(?,?,?,?,?,?,?,?,?), ref: 00DF8F21
SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 00DF8F8F
SendMessageW.USER32(?,00001030,00000000,00DF93D0), ref: 00DF8FB4
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00DF8FBD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00DF8FC9

Strings

*.*, xrefs: 00DF8C61
C:\Users\user\Desktop, xrefs: 00DF8BD3, 00DF8CCD
DirListData, xrefs: 00DF8B4F
Icon, xrefs: 00DF8B77, 00DF8BA2

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Message$Send$Event$FileInfoObjectPropSingleTaskWaitlstrcpy$AllocDataDesktopDispatchFolderFreeFromListMatchPathPeekResetSpecTranslatelstrcmp
String ID: *.*$C:\Users\user\Desktop$DirListData$Icon
API String ID: 2929906256-2215564071
Opcode ID: ecd85ed1323eb3773cd459624fe315368a461a664da887a410b52521eee50520
Instruction ID: ab2f00b0cccff575355a37835ab40b3baf246cb7b9ad66637858fbbb9f700d76
Opcode Fuzzy Hash: ecd85ed1323eb3773cd459624fe315368a461a664da887a410b52521eee50520
Instruction Fuzzy Hash: A0E18B71208745AFD720CF64CC84B6BB7E9BF88744F05891DF6899B290DBB1E904CB62

Function 00DFB430 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 148stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00DFB475
PathRemoveFileSpecW.SHLWAPI(?), ref: 00DFB483
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00DFB496
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 00DFB4A9
PathIsRelativeW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 00DFB4BE
PathIsPrefixW.SHLWAPI(?,?), ref: 00DFB4DB
PathIsPrefixW.SHLWAPI(?,C:\Windows\system32\Viewers\Quikview.exe), ref: 00DFB4E7
PathRelativePathToW.SHLWAPI(?,?,00000010,C:\Windows\system32\Viewers\Quikview.exe,?), ref: 00DFB502
lstrcpyW.KERNEL32(?,%CSIDL:MYDOCUMENTS%), ref: 00DFB51C
PathAppendW.SHLWAPI(?,?), ref: 00DFB52B
lstrcpyW.KERNEL32(?,?), ref: 00DFB53E
PathIsRelativeW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 00DFB547
PathCommonPrefixW.SHLWAPI(?,?,00000000), ref: 00DFB562
PathRelativePathToW.SHLWAPI(?,?,00000010,C:\Windows\system32\Viewers\Quikview.exe,?), ref: 00DFB580
lstrcpynW.KERNEL32(?,C:\Windows\system32\Viewers\Quikview.exe,00000104), ref: 00DFB598
PathUnExpandEnvStringsW.SHLWAPI(?,?,00000104), ref: 00DFB5AF
lstrcpynW.KERNEL32(?,?,00000104), ref: 00DFB5CE
lstrcpynW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,?,00000104), ref: 00DFB5F6

Strings

C:\Windows\system32\Viewers\Quikview.exe, xrefs: 00DFB4BD, 00DFB4E1, 00DFB4F2, 00DFB546, 00DFB56D, 00DFB58F, 00DFB5F5
%CSIDL:MYDOCUMENTS%, xrefs: 00DFB516

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$Relative$Prefixlstrcpyn$Filelstrcpy$AppendCommonDirectoryExpandFolderModuleNameRemoveSpecStringsWindows
String ID: %CSIDL:MYDOCUMENTS%$C:\Windows\system32\Viewers\Quikview.exe
API String ID: 3942253345-3867429074
Opcode ID: 7091731f97786559c5fe50a79af4063332eb75f0632717db7bb49c88d7856e84
Instruction ID: 6eee32c6a9e061c14ac5f086f7f7887a0afa0942d96f0298166bc4ebae174ca1
Opcode Fuzzy Hash: 7091731f97786559c5fe50a79af4063332eb75f0632717db7bb49c88d7856e84
Instruction Fuzzy Hash: C3513272644349ABD720DBA1EC84FEB77ECBB88B50F44481AF645D3140E7B4E608CB61

Function 00DFB620 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

StrCmpNIW.SHLWAPI(C:\Users\user\Documents,%CSIDL:MYDOCUMENTS%,00000013,?,00000002), ref: 00DFB643
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000002), ref: 00DFB663
PathAppendW.SHLWAPI(?,?,?,00000002), ref: 00DFB675
lstrcpynW.KERNEL32(?,C:\Users\user\Documents,00000104,?,00000002), ref: 00DFB684
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,?,00000002), ref: 00DFB69B
lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 00DFB6BA
PathIsRelativeW.SHLWAPI(?,?,00000002), ref: 00DFB6C4
GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,?,00000002), ref: 00DFB6DA
PathRemoveFileSpecW.SHLWAPI(?,?,00000002), ref: 00DFB6E5
PathAppendW.SHLWAPI(?,?,?,00000002), ref: 00DFB6F8
lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 00DFB70D
PathCanonicalizeW.SHLWAPI(?,?,?,00000002), ref: 00DFB71C
lstrcpyW.KERNEL32(?,?,?,00000002), ref: 00DFB733
PathGetDriveNumberW.SHLWAPI(?,?,00000002), ref: 00DFB73E
CharUpperBuffW.USER32(00000001,00000001,?,00000002), ref: 00DFB750
lstrcpynW.KERNEL32(C:\Users\user\Documents,00000104,00000104,?,00000002), ref: 00DFB776

Strings

C:\Users\user\Documents, xrefs: 00DFB642, 00DFB682, 00DFB775
%CSIDL:MYDOCUMENTS%, xrefs: 00DFB63D

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$lstrcpyn$AppendFile$BuffCanonicalizeCharDriveEnvironmentExpandFolderModuleNameNumberRelativeRemoveSpecStringsUpperlstrcpy
String ID: %CSIDL:MYDOCUMENTS%$C:\Users\user\Documents
API String ID: 1371384388-3203994559
Opcode ID: 4d1d44a5c3d1f8c16ee0305fb03551e6287b2dc29581472fa3187acf0eeb7533
Instruction ID: b98eeea68e49378ef6426a570c3b39772cf9d07893427d5e91fe3c7466f91ec3
Opcode Fuzzy Hash: 4d1d44a5c3d1f8c16ee0305fb03551e6287b2dc29581472fa3187acf0eeb7533
Instruction Fuzzy Hash: 0C4152B2644349AFD720EFA1DC89FEB77ECAB84750F05492AF345D6090DBB0D5088B62

Function 00DFCE40 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00DFDD80: ResolveLocaleName.KERNEL32(en-US,?,00000055), ref: 00DFDDB3
Part of subcall function 00DFDD80: GetLocaleInfoEx.KERNEL32(?,20000001,00000002), ref: 00DFDDD6

GetDC.USER32 ref: 00DFCEF7
EnumFontsW.GDI32(00000000,Segoe UI,00DFCCB0,00000000), ref: 00DFCF0B
ReleaseDC.USER32(00000000,00000000), ref: 00DFCF14
GetDC.USER32(00000000), ref: 00DFCF5D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DFCF68
ReleaseDC.USER32(00000000,00000000), ref: 00DFCF75
MulDiv.KERNEL32(?,00000048,00000000), ref: 00DFCFC9
SystemParametersInfoW.USER32(00000029,000001F8,000001F4,00000000), ref: 00DFD075
MulDiv.KERNEL32(?,00000048,?), ref: 00DFD096

Strings

Segoe UI, xrefs: 00DFCEDC, 00DFCF09
Yu Gothic UI, xrefs: 00DFCECE
Malgun Gothic, xrefs: 00DFCED5
Microsoft YaHei UI, xrefs: 00DFCEAE, 00DFCEC4
Microsoft JhengHei UI, xrefs: 00DFCEA7, 00DFCEBD
WINDOWSTYLE;WINDOW, xrefs: 00DFCF87
en-US, xrefs: 00DFCE63

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: InfoLocaleRelease$CapsDeviceEnumFontsNameParametersResolveSystem
String ID: Malgun Gothic$Microsoft JhengHei UI$Microsoft YaHei UI$Segoe UI$WINDOWSTYLE;WINDOW$Yu Gothic UI$en-US
API String ID: 1673905233-1983616946
Opcode ID: d252c6596d9dcd5927aab0eece201e55228f66c915d9f8a14fee0c323278ffec
Instruction ID: b968cb3d3e841f0d9ac2fa09b9daad4f4bccaa039c36a7091059c2cef200ba7d
Opcode Fuzzy Hash: d252c6596d9dcd5927aab0eece201e55228f66c915d9f8a14fee0c323278ffec
Instruction Fuzzy Hash: 4671F1312043099FD7249F25D849B7AB3E6EF84341F15892EFA5ADB290EB71CC49C761

Function 00E064A0 Relevance: 25.6, APIs: 6, Strings: 11, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE7E40: PathFileExistsW.SHLWAPI(00E7D538,?,?,00DE9F72,98D825DA), ref: 00DE7E57
Part of subcall function 00DE7E40: PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE7E6A

lstrcpyW.KERNEL32(00E7DE20,Notepad3.exe,75C05540), ref: 00E0664A
lstrcpyW.KERNEL32(00E7E030,00E74520), ref: 00E06656
lstrcpyW.KERNEL32(00E7DA00,Notepad3), ref: 00E06662
lstrcpyW.KERNEL32(00E7E240,00E74520), ref: 00E0666E
lstrcpyW.KERNEL32(00E7D7F0,00E74520), ref: 00E0667A
lstrcpyW.KERNEL32(00E7DC10,00E74520), ref: 00E06686

Part of subcall function 00DE8010: lstrlenW.KERNEL32(?,?,?,?,?,00E74520,en-US,00000055,98D825DA), ref: 00DE80EC

Strings

TargetApplicationWndClass, xrefs: 00E06596
TargetApplicationParams, xrefs: 00E06575
TargetApplicationPath, xrefs: 00E06554
Notepad3, xrefs: 00E06658
Notepad3.exe, xrefs: 00E0663A
DDETopic, xrefs: 00E065F9
DDEMessage, xrefs: 00E065B7
UseTargetApplication, xrefs: 00E064EE, 00E06511
Target Application, xrefs: 00E064F3, 00E06516, 00E06533, 00E06559, 00E0657A, 00E0659B, 00E065BC, 00E065DD, 00E065FE
DDEApplication, xrefs: 00E065D8
TargetApplicationMode, xrefs: 00E0652E

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: lstrcpy$Path$DirectoryExistsFilelstrlen
String ID: DDEApplication$DDEMessage$DDETopic$Notepad3$Notepad3.exe$Target Application$TargetApplicationMode$TargetApplicationParams$TargetApplicationPath$TargetApplicationWndClass$UseTargetApplication
API String ID: 3318512330-1779093258
Opcode ID: a84414fb2b885d4aef86fd7d24a38cc6117b3de553b032b3e5a0e164718857b6
Instruction ID: 7ff705cabdb1686ade89cbac1191c3a81c5de37cbc5e0a0490012ab004aa84ae
Opcode Fuzzy Hash: a84414fb2b885d4aef86fd7d24a38cc6117b3de553b032b3e5a0e164718857b6
Instruction Fuzzy Hash: 964129B2B85B84ABD310A7A17C03B173B61EB84B15F50E435F50C3A3D1EAF1198956A2

Function 00DF9CB0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 201windowmemoryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00DF9CDB
SendMessageW.USER32(00000000,0000014B,00000000,00000000), ref: 00DF9CE7
SHGetSpecialFolderLocation.SHELL32(00000000,00000011,00000000), ref: 00DF9D1E
SHGetDesktopFolder.SHELL32(?), ref: 00DF9D31
SHGetDataFromIDListW.SHELL32(00000000,00000000,00000003,?,00000014), ref: 00DF9DE3
CoTaskMemAlloc.OLE32(00000008), ref: 00DF9DFF
SendMessageW.USER32(00000000,0000040D,00000000,?), ref: 00DF9E41
SendMessageW.USER32(00000000,0000040D,00000000,00000020), ref: 00DF9E72
SendMessageW.USER32(00000000,0000040B,00000000,?), ref: 00DF9E91
CoTaskMemFree.OLE32(00000000), ref: 00DF9ECE
SendMessageW.USER32(00000000,0000000B,00000001,00000000), ref: 00DF9EE7
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00DF9EF3

Strings

', xrefs: 00DF9D11
, xrefs: 00DF9E28

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: MessageSend$FolderTask$AllocDataDesktopFreeFromListLocationSpecial
String ID: $'
API String ID: 202417901-2481900351
Opcode ID: 3a6e83152030d57a63c9181a401338bea11a39fe7ca688d2315131b4cd6fa0fd
Instruction ID: 11cc9a6a3f1ceea504a1be8a63e93d97e2b9e8847e527a95c363f42a0bb059a5
Opcode Fuzzy Hash: 3a6e83152030d57a63c9181a401338bea11a39fe7ca688d2315131b4cd6fa0fd
Instruction Fuzzy Hash: F9712A71244706AFD310CF59DC91F6BB7E8AF88B44F10891CF654EB2A0D7B1E9458B62

Function 00DFB090 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120stringwindowCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,00E74520,75C05540,75C08510), ref: 00DFB0C3
SendMessageW.USER32(00000000,00000418,00000000,00000000), ref: 00DFB0D9
SendMessageW.USER32(00000000,00000418,00000000,00000000), ref: 00DFB0F3
SendMessageW.USER32(00000000,00000417,00000000,?), ref: 00DFB10C
wsprintfW.USER32 ref: 00DFB126
lstrcatW.KERNEL32(?,?), ref: 00DFB139
CharNextW.USER32(?), ref: 00DFB161
lstrlenW.KERNEL32(?), ref: 00DFB172
lstrlenW.KERNEL32(?), ref: 00DFB18F
CharPrevW.USER32(?,00000000), ref: 00DFB1A2
CharPrevW.USER32(?,00000000), ref: 00DFB1BB
lstrcpynW.KERNEL32(?,?,00000200), ref: 00DFB1D1

Strings

%i , xrefs: 00DFB120

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CharMessageSend$Prevlstrlen$Nextlstrcatlstrcpylstrcpynwsprintf
String ID: %i
API String ID: 2047470491-1318497599
Opcode ID: bf37ca096ef79104d792f2f747b33a1a655df8fe25b4f9fedd1e5b1050ed4625
Instruction ID: 7423dde91c8344ef86c84ed9b4e6d3d4cd390066ec5cc1f28b872690d1bcbaaa
Opcode Fuzzy Hash: bf37ca096ef79104d792f2f747b33a1a655df8fe25b4f9fedd1e5b1050ed4625
Instruction Fuzzy Hash: 984182B2600708AFC320DB64DC45F7BB7ECEB89740F05442AF651E7191EBB0E8098BA5

Function 00E05AA0 Relevance: 22.7, APIs: 15, Instructions: 159stringwindowCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,?,?,?), ref: 00E05AD9
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 00E05AED
lstrcpynW.KERNEL32(?,?,00000104), ref: 00E05B09
lstrcpyW.KERNEL32(?,?), ref: 00E05B3A
GetFileAttributesW.KERNEL32(?), ref: 00E05B77
SetCurrentDirectoryW.KERNEL32(?), ref: 00E05B92
PostMessageW.USER32(00000111,00019D0D,00000000), ref: 00E05BB2
SendMessageW.USER32(00001013,00000000,00000000), ref: 00E05BC7
lstrcpyW.KERNEL32(?,?), ref: 00E05BF1
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 00E05C20
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00E05C32
PathIsRootW.SHLWAPI(?), ref: 00E05C4C
SetCurrentDirectoryW.KERNEL32(?), ref: 00E05C61
SendMessageW.USER32(00000111,00019D0D,00000000), ref: 00E05C7F
SendMessageW.USER32(00001013,00000000,00000000), ref: 00E05CA6

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Message$Sendlstrcpy$CurrentDirectoryFile$AttributesEnvironmentExpandInfoPathPostRootStringslstrcpyn
String ID:
API String ID: 3189554786-0
Opcode ID: 435493b843af1f4486c8b96f335fbc5b8bd7b1067e9f0dc6cce66761aa6d8a7c
Instruction ID: dc51cc218c1aa9a698c9767d5a4cdc78129a2425ca7fd24bdb0172946459a594
Opcode Fuzzy Hash: 435493b843af1f4486c8b96f335fbc5b8bd7b1067e9f0dc6cce66761aa6d8a7c
Instruction Fuzzy Hash: BA51C672600744ABE7309B61EC8AFEF77ECAF84744F44442AF649E61D1EBB095488F51

Function 00E10DB1 Relevance: 19.8, APIs: 13, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00E10E7A
DName::operator+.LIBCMT ref: 00E10EB7
DName::DName.LIBVCRUNTIME ref: 00E10ECB
DName::operator+.LIBCMT ref: 00E10EDA
DName::operator+.LIBCMT ref: 00E10F68
DName::DName.LIBVCRUNTIME ref: 00E10F90
DName::operator+.LIBCMT ref: 00E10F9E
DName::operator+.LIBCMT ref: 00E10FD8
DName::operator+.LIBCMT ref: 00E11019
UnDecorator::getReturnType.LIBCMT ref: 00E11049
operator+.LIBVCRUNTIME ref: 00E1114B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: a3202cc0b96ad8ffe6b388927acd18238b449f52cb43840876bc4436f0e6526a
Instruction ID: c28c3077b46d7bc1358dbf33f9e7aa97f9dda143f7e3e24cb8c3d595cdc4e21d
Opcode Fuzzy Hash: a3202cc0b96ad8ffe6b388927acd18238b449f52cb43840876bc4436f0e6526a
Instruction Fuzzy Hash: 83C18175A04209AFDB18EFE4D892DEDBBF8AB08300F14215DF606B7291DB709AC5CB51

Function 00E123A9 Relevance: 19.8, APIs: 13, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00E12414
DName::operator+.LIBCMT ref: 00E12557

Part of subcall function 00E0DD2F: shared_ptr.LIBCMT ref: 00E0DD4B

DName::operator+.LIBCMT ref: 00E12502
DName::operator+.LIBCMT ref: 00E125A3
DName::operator+.LIBCMT ref: 00E125B2
DName::operator+.LIBCMT ref: 00E126DE
DName::operator=.LIBVCRUNTIME ref: 00E1271E
DName::DName.LIBVCRUNTIME ref: 00E12728
DName::operator+.LIBCMT ref: 00E12745
DName::operator+.LIBCMT ref: 00E12751

Part of subcall function 00E13C69: Replicator::operator[].LIBCMT ref: 00E13CA6

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID:
API String ID: 1043660730-0
Opcode ID: 0ba3db9fca29ddc496bc9ccb8ef8221ce771298e2b95c25c9f25a0646697afd0
Instruction ID: 6be8585ebf9e07ca9e2bf5b480eefa7f1f2be0bc3d9d86b50ae4b40e47998b78
Opcode Fuzzy Hash: 0ba3db9fca29ddc496bc9ccb8ef8221ce771298e2b95c25c9f25a0646697afd0
Instruction Fuzzy Hash: DBC1BDB19042089FDB14CFA4DC85BEEB7F8AB18304F14545DE25AB72D2EB709AC8CB50

Function 00E13C69 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 00E13CA6

Strings

generic-type-, xrefs: 00E13D2C
"7, xrefs: 00E13CB2
template-parameter-, xrefs: 00E13D05
@, xrefs: 00E13E12
}+, xrefs: 00E13E6B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Replicator::operator[]
String ID: "7$@$generic-type-$template-parameter-$}+
API String ID: 3676697650-3552409930
Opcode ID: 01a39affc23115c9e4dea062ccc3c48ddf7048fb0b1ea5a2eae88a8c08344b6c
Instruction ID: 17b880828eeec8a160ea7f50f71e740de4fe2426852ee3a7ed1ce313b6645427
Opcode Fuzzy Hash: 01a39affc23115c9e4dea062ccc3c48ddf7048fb0b1ea5a2eae88a8c08344b6c
Instruction Fuzzy Hash: 6A61D4B1D003099FDB14DFA5E841BEEBBF8AF08310F245019E515B72A2DB749A89CB90

Function 00DF8830 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 88windowmemorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000022C,?,?,?), ref: 00DF8863
SetPropW.USER32(00000000,DirListData,00000000), ref: 00DF888E
lstrcpyW.KERNEL32(00000010,00E74520,?,?,?), ref: 00DF88B4
SHGetFileInfoW.SHELL32(C:\,00000000,?,000002B4,00004001), ref: 00DF88D0
SendMessageW.USER32(00000000,00001003,00000001,00000000), ref: 00DF88E5
SHGetFileInfoW.SHELL32(C:\,00000000,?,000002B4,00004000), ref: 00DF88FD
SendMessageW.USER32(00000000,00001003,00000000,00000000), ref: 00DF890C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?), ref: 00DF8930
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?), ref: 00DF8940

Strings

DirListData, xrefs: 00DF8888
C:\, xrefs: 00DF88CB, 00DF88F8

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CreateEventFileInfoMessageSend$AllocGlobalProplstrcpy
String ID: C:\$DirListData
API String ID: 1243389431-2784504048
Opcode ID: 431ebd70de979795eb69d6c9e01c9addbecbedd6c7ce51cf9971432f1af0819f
Instruction ID: f156e0d61c3f79921c1e082169877043f09707340c842cdb28b4261b9273669b
Opcode Fuzzy Hash: 431ebd70de979795eb69d6c9e01c9addbecbedd6c7ce51cf9971432f1af0819f
Instruction Fuzzy Hash: 60313271780704BFE760AF51EC8AF5B7B98EB08B41F544055FA09BE2C1DBF564488B61

Function 00DF8A30 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 50windowsynchronizationCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,DirListData), ref: 00DF8A3A
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A48
WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A56
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DF8A82
TranslateMessage.USER32(?), ref: 00DF8A8D
DispatchMessageW.USER32(?), ref: 00DF8A94
WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A9E
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8AB1
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8ABD

Strings

C:\Users\user\Desktop, xrefs: 00DF8A60
DirListData, xrefs: 00DF8A34

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: EventMessage$ObjectSingleWait$DispatchPeekPropResetTranslate
String ID: C:\Users\user\Desktop$DirListData
API String ID: 3160958571-3121744273
Opcode ID: 51cc601519707557e91c6e8c38faebdddd094c00258a5e4ddbd750ab05b2c3da
Instruction ID: c5f841fa0d811dc4775be755a70386db1b4e20978808ea395852ef5396d45385
Opcode Fuzzy Hash: 51cc601519707557e91c6e8c38faebdddd094c00258a5e4ddbd750ab05b2c3da
Instruction Fuzzy Hash: E7016D33301B04BFD720ABB6FC4DFAB77A9EB09780F040815F645A5060DAB2E8088B21

Function 00DF9000 Relevance: 18.2, APIs: 12, Instructions: 231windowmemorysynchronizationCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00DF9030
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00DF904D
CoInitialize.OLE32(00000000), ref: 00DF9058
WaitForSingleObject.KERNEL32(?,00000000,?,00001004,00000000,00000000), ref: 00DF9088
SendMessageW.USER32 ref: 00DF90AF
CoTaskMemAlloc.OLE32(?), ref: 00DF9179
SHGetFileInfoW.SHELL32(00000000,00000000,?,000002B4,00004009), ref: 00DF91BA
CoTaskMemFree.OLE32(00000000), ref: 00DF91C1
SHGetDataFromIDListW.SHELL32(?,?,00000001,?,00000250), ref: 00DF926D
SendMessageW.USER32(?,0000104C,00000000,00000002), ref: 00DF92A9
CoUninitialize.OLE32(?,00001004,00000000,00000000), ref: 00DF92D2
SetEvent.KERNEL32(?), ref: 00DF92DE

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: MessageSend$EventTask$AllocDataFileFreeFromInfoInitializeListObjectResetSingleUninitializeWait
String ID:
API String ID: 2249403244-0
Opcode ID: 1348600bcedc93e26a6827f0bacadecb919c5663997c775a123ecf1d082059e2
Instruction ID: 17acdbf66b8e39e66ba1e1f5058b712ced452cdc63e07be55d3be8b675b8bf73
Opcode Fuzzy Hash: 1348600bcedc93e26a6827f0bacadecb919c5663997c775a123ecf1d082059e2
Instruction Fuzzy Hash: 52918B71A05706AFD720CF65D898B6BBBF4BF89744F04852DFA849B290D7B0D904CB62

Function 00DFB200 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155windowstringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,000001FE,44000000,?,75C05540), ref: 00DFB244

Part of subcall function 00DFBB00: CharNextW.USER32(?,?,74E2F860,?,00DF50BE), ref: 00DFBB21
Part of subcall function 00DFBB00: lstrlenW.KERNEL32(?,?,74E2F860,?,00DF50BE), ref: 00DFBB32
Part of subcall function 00DFBB00: lstrlenW.KERNEL32(?,?,?,00DF50BE), ref: 00DFBB47
Part of subcall function 00DFBB00: CharPrevW.USER32(?,00000000,?,?,00DF50BE), ref: 00DFBB54
Part of subcall function 00DFBB00: CharPrevW.USER32(?,00000000,?,?,00DF50BE), ref: 00DFBB67

lstrlenW.KERNEL32(00000000,?,?,?,?,75C05540), ref: 00DFB272
SendMessageW.USER32(00000000,00000418,00000000,00000000), ref: 00DFB2B1
SendMessageW.USER32(00000000,00000416,00000000,00000000), ref: 00DFB2CA
SendMessageW.USER32(00000000,00000444,00000001,00E7B964), ref: 00DFB358
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,75C05540), ref: 00DFB35B
SendMessageW.USER32(00000000,00000418,00000000,00000000), ref: 00DFB373
SendMessageW.USER32 ref: 00DFB3CF

Strings

, xrefs: 00DFB2D3
, xrefs: 00DFB3BF

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: MessageSend$lstrlen$Char$Prev$Nextlstrcpyn
String ID: $
API String ID: 2625338006-227171996
Opcode ID: c26b3c77e3c6c60c991fb6cdd682801e0dce979b3ce06e357501f0b3d6000cdf
Instruction ID: 6d30502fa425b7daa3e2e8565b9ed729a0fd7058f86439a4b16b2fe6a3f12070
Opcode Fuzzy Hash: c26b3c77e3c6c60c991fb6cdd682801e0dce979b3ce06e357501f0b3d6000cdf
Instruction Fuzzy Hash: C14127729403086BD720DB20DC42B6B73D8EB94310F15882AFB45F7192E7B4E98986E6

Function 00DFD430 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,00000000,Shell_TrayWnd,00000000), ref: 00DFD453
FindWindowExW.USER32(00000000,00000000,TrayNotifyWnd,00000000), ref: 00DFD463
GetWindowRect.USER32(00000000,?), ref: 00DFD46B
SHAppBarMessage.SHELL32(00000005,?), ref: 00DFD491

Strings

$, xrefs: 00DFD486
TrayNotifyWnd, xrefs: 00DFD45B
Shell_TrayWnd, xrefs: 00DFD44A, 00DFD50D

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Window$Find$MessageRect
String ID: $$Shell_TrayWnd$TrayNotifyWnd
API String ID: 634609282-1160186678
Opcode ID: f2da9b693fc3885990acb2e21e1408e7e3be0e34a0e936259168a3a63f7eb4da
Instruction ID: 732cd86c33e543be28f805b4116df6f56905ce0234de945cae43ed24df2f3885
Opcode Fuzzy Hash: f2da9b693fc3885990acb2e21e1408e7e3be0e34a0e936259168a3a63f7eb4da
Instruction Fuzzy Hash: 45416B716007019FD320DF2ADD85B5ABBE5EF88754F50891EE58AE7380EBB0E944CB51

Function 00DE95B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

StrRChrW.SHLWAPI(00E7D538,00000000,0000005C,?,?,?,00DEA9C3), ref: 00DE95CA
SHCreateDirectoryExW.SHELL32(00000000,00E7D538,00000000,?,?,?,00DEA9C3), ref: 00DE95E2
PathFileExistsW.SHLWAPI(00E7D538,?,?,?,00DEA9C3), ref: 00DE95F5
PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE9604
CreateFileW.KERNEL32(00E7D538,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,00DEA9C3), ref: 00DE9623
GetFileSize.KERNEL32(00000000,?), ref: 00DE963E
CloseHandle.KERNEL32(00000000), ref: 00DE9647
CreateFileW.KERNEL32(00E7D538,40000000,00000003,00000000,00000002,00000080,00000000,?,?,?,00DEA9C3), ref: 00DE9671
CloseHandle.KERNEL32(00000000,?,?,?,00DEA9C3), ref: 00DE967D

Strings

minipath, xrefs: 00DE9687

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$Create$CloseDirectoryHandlePath$ExistsSize
String ID: minipath
API String ID: 3237904083-3157150768
Opcode ID: 82ac5ecd65904cf851920ace2a88496e969b3d6c4a5c01d274191185507c571c
Instruction ID: 3377b16c96e1243859bfa99166ef3aed90b124574beb3fc02d77dfe6f50f67f5
Opcode Fuzzy Hash: 82ac5ecd65904cf851920ace2a88496e969b3d6c4a5c01d274191185507c571c
Instruction Fuzzy Hash: 1B218772781700BFE334277ABC0AF5B6A68EB80FA6F34451AFA45F51D0D7E088444674

Function 00E0F444 Relevance: 16.9, APIs: 11, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00E0F4B7
shared_ptr.LIBCMT ref: 00E0F4FF
shared_ptr.LIBCMT ref: 00E0F51E
operator+.LIBVCRUNTIME ref: 00E0F64C
DName::operator=.LIBVCRUNTIME ref: 00E0F65E
shared_ptr.LIBCMT ref: 00E0F8A3
DName::operator+.LIBCMT ref: 00E0F8E5
operator+.LIBVCRUNTIME ref: 00E0F92B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID:
API String ID: 1464150960-0
Opcode ID: af1d24155521a67547fa171ba4b62fea55b97c7a4df391c0dd5658ebde7df23b
Instruction ID: 929db87bad2d5ccd14ca220d26a7762cdf68455231d2d47fad26f382ec270fdb
Opcode Fuzzy Hash: af1d24155521a67547fa171ba4b62fea55b97c7a4df391c0dd5658ebde7df23b
Instruction Fuzzy Hash: 9FE1A1B1D0820A9FCB28DFD4D889AFEBBB4EF44304F54A12AD411B7691D7B44695CF90

Function 00DF8540 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 122stringwindowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200), ref: 00DF859B
LoadStringW.USER32(?,?,00000200), ref: 00DF85B9
StrChrW.SHLWAPI(?,0000000A,?,?,?,?,?,?,?,?,74E2F860), ref: 00DF8628
lstrcpyW.KERNEL32(?,00000002,?,?,?,?,?,?,?,?,74E2F860), ref: 00DF8640
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?,?,74E2F860), ref: 00DF8660
lstrcpyW.KERNEL32(?,00E74520,?,?,?,?,?,?,?,?,74E2F860), ref: 00DF866C
GetFocus.USER32 ref: 00DF866E
MessageBoxExW.USER32(?,?,?,00000040,?), ref: 00DF86B6

Strings

en-US, xrefs: 00DF867C

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: lstrcpy$LoadString$FocusMessage
String ID: en-US
API String ID: 3506571364-1228076028
Opcode ID: d530c73dcd2d035a182cc7085e5acd0c4e26c32f5977b97e07479b8c46188f52
Instruction ID: 5b4f99144ea30842a1be694254899d46bd03ecbb6ed34c17eb5feebccd005d58
Opcode Fuzzy Hash: d530c73dcd2d035a182cc7085e5acd0c4e26c32f5977b97e07479b8c46188f52
Instruction Fuzzy Hash: 22417872604249AFD761DB20DC45BEB77DCFF44340F00882AF68AE3191EE74D5498BA6

Function 00DF3180 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,00E74520,?,?,?,?), ref: 00DF31DD
LoadStringW.USER32(00002AFF,?,00000100), ref: 00DF31F4
LoadStringW.USER32(00002AFF,?,00000100), ref: 00DF320F
lstrcpyW.KERNEL32(?,?,?,?,?,?), ref: 00DF3228
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?), ref: 00DF323D
SHBrowseForFolderW.SHELL32 ref: 00DF3287
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00DF3295
CoTaskMemFree.OLE32(00000000), ref: 00DF329C

Strings

A, xrefs: 00DF326F

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: LoadStringlstrcpy$BrowseCurrentDirectoryFolderFreeFromListPathTask
String ID: A
API String ID: 2100424654-3554254475
Opcode ID: 6cde53cdb8433f3f6d8694c0202e9c795531ff22b6d5795be212887220fa1e7c
Instruction ID: 1e7829009e29c94092a3ca35ca67f39d3c17b95102fe4053c359c17f750ee50a
Opcode Fuzzy Hash: 6cde53cdb8433f3f6d8694c0202e9c795531ff22b6d5795be212887220fa1e7c
Instruction Fuzzy Hash: BD31A3B2604344AFD320DF51DC49BAFB7E8FB88744F41481AF689A2250D7B49648CBA6

Function 00DFBDC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 59stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,00E753E8,0000C356,74E2F860,00E05B23,?), ref: 00DFBDD0
lstrcmpW.KERNEL32(?,00E753F0), ref: 00DFBDDC
lstrcmpW.KERNEL32(?,00E753E8), ref: 00DFBDE8
PathIsRootW.SHLWAPI(00E8066C), ref: 00DFBDF3
lstrcpynW.KERNEL32(?,*.*,00000104), ref: 00DFBE0B
SearchPathW.KERNEL32(00E8066C,?,00000000,00000104,?,00000000), ref: 00DFBE34
SearchPathW.KERNEL32(C:\Users\user\Documents,?,00000000,00000104,?,00000000), ref: 00DFBE4E

Strings

*.*, xrefs: 00DFBE02
C:\Users\user\Documents, xrefs: 00DFBE49

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Pathlstrcmp$Search$Rootlstrcpyn
String ID: *.*$C:\Users\user\Documents
API String ID: 2623810893-3265498248
Opcode ID: 00ad620a130f71b3d38f32dca50523cfab5cd9f2f09f6ff4a2a48f16e6700b5f
Instruction ID: d456fbc18f13902dae1a548d44222954c56f63b7e383fb158c4bd106652663c5
Opcode Fuzzy Hash: 00ad620a130f71b3d38f32dca50523cfab5cd9f2f09f6ff4a2a48f16e6700b5f
Instruction Fuzzy Hash: 830124B2381B023BE6102626AC0AFBF19898F81BB0F069029FA05F50C4EBE0DC414574

Function 00E12EB0 Relevance: 15.3, APIs: 10, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00E12F86
UnDecorator::getSignedDimension.LIBCMT ref: 00E12F91
UnDecorator::getSignedDimension.LIBCMT ref: 00E1307D
UnDecorator::getSignedDimension.LIBCMT ref: 00E1309A
UnDecorator::getSignedDimension.LIBCMT ref: 00E130B7
DName::operator+.LIBCMT ref: 00E130CC
UnDecorator::getSignedDimension.LIBCMT ref: 00E130E6
swprintf.LIBCMT ref: 00E13160
DName::operator+.LIBCMT ref: 00E131BB

Part of subcall function 00E0EE69: DName::DName.LIBVCRUNTIME ref: 00E0EEC7

DName::DName.LIBVCRUNTIME ref: 00E13232

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$swprintf
String ID:
API String ID: 3689813335-0
Opcode ID: 29baa670d51ba05d356947745dc151255a36fa7bd17f600a5c10bbd62bd75689
Instruction ID: a114288a5fd78b2283a762911d2225daff002d0828411c4440e22bc3255f7544
Opcode Fuzzy Hash: 29baa670d51ba05d356947745dc151255a36fa7bd17f600a5c10bbd62bd75689
Instruction Fuzzy Hash: 2591B8B2E042099ADB19EBF4DD49AFE77B8EF09304F10211DF206B6191DA749BC5CB51

Function 00E1C4F7 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00E1C8CF

Strings

:, xrefs: 00E1C5C2
p, xrefs: 00E1C5F4
p, xrefs: 00E1C656
f, xrefs: 00E1C64F
f, xrefs: 00E1C5ED
f, xrefs: 00E1C609
p, xrefs: 00E1C610

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: 87d0085c63d79a98e0a5ccf09c4d6664a9c855f06cac4ceb6df5acbc09026a33
Instruction ID: db1a5815932205a4d3ee9d22b7ad1f21d712dae37a2e0b2f1d38f3c3afe876fa
Opcode Fuzzy Hash: 87d0085c63d79a98e0a5ccf09c4d6664a9c855f06cac4ceb6df5acbc09026a33
Instruction Fuzzy Hash: BB0269759801189ADF24CFA9C4856EDB7B3FF40B18FB4A11AD416FB280D3309EC98B55

Function 00E47897 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E4791D

Strings

j0Yj, xrefs: 00E47B31

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: _strrchr
String ID: j0Yj
API String ID: 3213747228-2544518064
Opcode ID: 9410032871a2a5834b41c06169913cc7385f83f7bd62ab43803e2690dd3bf7b7
Instruction ID: 81f55b509ed04edb301564e22f32a129453bd9221c8738048ed633ff5ef9f121
Opcode Fuzzy Hash: 9410032871a2a5834b41c06169913cc7385f83f7bd62ab43803e2690dd3bf7b7
Instruction Fuzzy Hash: 80B16572A083659FEB11CF24EC81BEE7BA6EF95314F156195E984BB282D3709D00C7E0

Function 00E0C4E2 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E0C601
___TypeMatch.LIBVCRUNTIME ref: 00E0C70F
CatchIt.LIBVCRUNTIME ref: 00E0C760
_UnwindNestedFrames.LIBCMT ref: 00E0C861
CallUnexpected.LIBVCRUNTIME ref: 00E0C87C

Strings

csm, xrefs: 00E0C51F
csm, xrefs: 00E0C638
csm, xrefs: 00E0C58C

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: f79c6ba831087639812f76253435e36aafd42bb9cd5958597a2cf085aa454071
Instruction ID: f77617a26575f17bf8b24d1866f77046ff075229c6a72aac48dfaa50d03b282d
Opcode Fuzzy Hash: f79c6ba831087639812f76253435e36aafd42bb9cd5958597a2cf085aa454071
Instruction Fuzzy Hash: C4B17F71800209DFCF28DFA4C8419AEBBB5FF14714F24625AE8157B292D731EA91CFA5

Function 00E103E6 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E103ED
UnDecorator::getSymbolName.LIBCMT ref: 00E1047F
DName::operator+.LIBCMT ref: 00E10583
DName::DName.LIBVCRUNTIME ref: 00E10626

Part of subcall function 00E0DD2F: shared_ptr.LIBCMT ref: 00E0DD4B

Part of subcall function 00E0DFC9: DName::DName.LIBVCRUNTIME ref: 00E0E017

Strings

"7, xrefs: 00E10623, 00E1062B, 00E104AF, 00E10611, 00E10427
(@, xrefs: 00E105FD, 00E104D3, 00E104DC, 00E1057C, 00E104F4, 00E1045D, 00E1042A, 00E10414, 00E10419, 00E10460, 00E104D6, 00E104FE, 00E1057F, 00E10600
@, xrefs: 00E1055B, 00E1042F
(@, xrefs: 00E10540

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID: "7$(@$(@$@
API String ID: 1134295639-1931073713
Opcode ID: 8339789518d4feba0f38fe4e8fdfc24030a894701bd738790b6f6b0a8f475c0e
Instruction ID: ff7d3e2687696393cb8ca813897698f2507472a6690f725ee6d6ec99e71b120f
Opcode Fuzzy Hash: 8339789518d4feba0f38fe4e8fdfc24030a894701bd738790b6f6b0a8f475c0e
Instruction Fuzzy Hash: D0719D71D04219CFDB11DF94D881BEDBBB9BB08314F24602AE515BB2A2D7B499C4CFA0

Function 00DE8AE0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 118fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00E7D538,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 00DE8B41
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?), ref: 00DE8B60

Strings

AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 00DE8B6A
AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 00DE8C1C
minipath, xrefs: 00DE8BB1

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$CreateLock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!$minipath
API String ID: 3593386577-1287712860
Opcode ID: b208244ec3851ad4085b6d2347ce1b45ae030e88d1cd5277c128c22e42fa6b6b
Instruction ID: e7f788053f594e1199e52a015c42938f4afc7af5a9f1504766227230995c67b0
Opcode Fuzzy Hash: b208244ec3851ad4085b6d2347ce1b45ae030e88d1cd5277c128c22e42fa6b6b
Instruction Fuzzy Hash: 76318F72A043906BD230772ADC45F7FB2A4DB81774F280315FA6DB21D0DFA09C4992B2

Function 00DE8FE0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00E7D538,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 00DE903D
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?), ref: 00DE905C

Strings

SaveSettings, xrefs: 00DE90AA
AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 00DE9066
AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 00DE910A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$CreateLock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!$SaveSettings
API String ID: 3593386577-4113319956
Opcode ID: a3e01ff157536610c5f8e8a7d12577550aa5f05d26fe193fd2cde811b7da7dd4
Instruction ID: 41b3471105b704bd6899606292fada97960c4addc64c7a3b8401c5c6994e807e
Opcode Fuzzy Hash: a3e01ff157536610c5f8e8a7d12577550aa5f05d26fe193fd2cde811b7da7dd4
Instruction Fuzzy Hash: A0316F72A043516BD230B72BDC5AB6FB3A49BC1B74F544329FD55B22D0E7609D4882F2

Function 00DE9860 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE89E0: lstrlenW.KERNEL32(?,00000000,Settings2,?,?,?), ref: 00DE8A9D

Part of subcall function 00DE96A0: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,75B04E90,74E2F860,?,75B0A6F0), ref: 00DE96CA
Part of subcall function 00DE96A0: PathIsRelativeW.SHLWAPI(?,?,75B0A6F0), ref: 00DE96D8
Part of subcall function 00DE96A0: lstrcpyW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE96F2
Part of subcall function 00DE96A0: PathFindFileNameW.SHLWAPI(?,?,?,75B0A6F0), ref: 00DE9701
Part of subcall function 00DE96A0: lstrcpyW.KERNEL32(00000000,?,75B0A6F0), ref: 00DE9708
Part of subcall function 00DE96A0: PathFileExistsW.KERNELBASE(?,?,75B0A6F0), ref: 00DE970F
Part of subcall function 00DE96A0: PathIsDirectoryW.SHLWAPI(?), ref: 00DE9724
Part of subcall function 00DE96A0: lstrcpyW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE9734
Part of subcall function 00DE96A0: PathRemoveFileSpecW.SHLWAPI(?,?,75B0A6F0), ref: 00DE973B
Part of subcall function 00DE96A0: lstrcatW.KERNEL32(?,\np3\,?,75B0A6F0), ref: 00DE9751
Part of subcall function 00DE96A0: lstrcatW.KERNEL32(?,?,?,75B0A6F0), ref: 00DE9760
Part of subcall function 00DE96A0: PathFileExistsW.KERNELBASE(?,?,75B0A6F0), ref: 00DE9767
Part of subcall function 00DE96A0: PathIsDirectoryW.SHLWAPI(?), ref: 00DE9776
Part of subcall function 00DE96A0: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,75B0A6F0), ref: 00DE978F
Part of subcall function 00DE96A0: PathAppendW.SHLWAPI(?,?,?,75B0A6F0), ref: 00DE97A2
Part of subcall function 00DE96A0: PathFileExistsW.KERNELBASE(?,?,75B0A6F0), ref: 00DE97AD
Part of subcall function 00DE96A0: PathIsDirectoryW.SHLWAPI(?), ref: 00DE97BC

lstrcpyW.KERNEL32(?,?,?,?,75B04E90,74E2F860), ref: 00DE98BD
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,75B04E90,74E2F860), ref: 00DE98F1
PathIsRelativeW.SHLWAPI(?,?,?,75B04E90,74E2F860), ref: 00DE98FF
lstrcpyW.KERNEL32(?,?,?,?,75B04E90,74E2F860), ref: 00DE9911
PathFindFileNameW.SHLWAPI(?,?,?,?,75B04E90,74E2F860), ref: 00DE991C
lstrcpyW.KERNEL32(00000000,?,?,75B04E90,74E2F860), ref: 00DE9923

Strings

minipath.ini, xrefs: 00DE9893

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$Filelstrcpy$DirectoryExists$EnvironmentExpandFindNameRelativeStringslstrcat$AppendFolderRemoveSpeclstrlen
String ID: minipath.ini
API String ID: 785113118-2848199397
Opcode ID: f21932638907beff9812015743efc90e699a6048b9722beb6adeb51d5a25a89f
Instruction ID: 17c752bf8009a26be5fdfccde9f1a5f8d56bb4e6afc26a3bffd0870575525b67
Opcode Fuzzy Hash: f21932638907beff9812015743efc90e699a6048b9722beb6adeb51d5a25a89f
Instruction Fuzzy Hash: 6321B6B27042045BD720EB15EC85BFF73ECABD8340F44442EF649D3191EAB498898BA3

Function 00DE7F10 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 80fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00E7D538,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 00DE7F57
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,00000000), ref: 00DE7F76
FlushFileBuffers.KERNEL32(75BF73E0,75BF73E0), ref: 00DE7FCC
UnlockFileEx.KERNEL32(75BF73E0,00000000,000000FF,00000000,00000000), ref: 00DE7FDE
CloseHandle.KERNEL32(75BF73E0), ref: 00DE7FE5

Part of subcall function 00DF86E0: GetLastError.KERNEL32(?,00000000,?,?,00DE7DA3), ref: 00DF86E9
Part of subcall function 00DF86E0: FormatMessageW.KERNEL32 ref: 00DF8718
Part of subcall function 00DF86E0: lstrlenW.KERNEL32(00000000,00000000,00E7D538), ref: 00DF872F
Part of subcall function 00DF86E0: lstrlenW.KERNEL32(00000000), ref: 00DF8737
Part of subcall function 00DF86E0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00DF8747
Part of subcall function 00DF86E0: GetFocus.USER32 ref: 00DF8774
Part of subcall function 00DF86E0: MessageBoxExW.USER32(?,00000000,MiniPath - ERROR,00000010,?), ref: 00DF878F
Part of subcall function 00DF86E0: LocalFree.KERNEL32(00000000,?,?,00DE7DA3), ref: 00DF8796
Part of subcall function 00DF86E0: LocalFree.KERNEL32(?), ref: 00DF879C

Strings

AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 00DE7F80
AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 00DE7FF3
p, xrefs: 00DE7FA1

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$Local$FreeMessagelstrlen$AllocBuffersCloseCreateErrorFlushFocusFormatHandleLastLockUnlock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!$p
API String ID: 3792989122-2122673611
Opcode ID: be50b270c0e260e61cb5c1a23220b26689667009f8a63f6a6b0a2a0f9c23964d
Instruction ID: 2965c103dd9e739abf67de7dd3ef673e106af4ccf884d2f3600683f0982f727a
Opcode Fuzzy Hash: be50b270c0e260e61cb5c1a23220b26689667009f8a63f6a6b0a2a0f9c23964d
Instruction Fuzzy Hash: 1621E7313086116BE264772AAC4AF6B3554AFC1774F758325FA69F11E0EBA0C48942BA

Function 00DFC7A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187stringCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00E771B8,98D825DA,00000000,75C05420), ref: 00DFC7F9
lstrlenW.KERNEL32(?,?,?,?,98D825DA,00000000,75C05420), ref: 00DFC870
StrDupW.SHLWAPI(?,?,?,?,98D825DA,00000000,75C05420), ref: 00DFC8CB

Strings

%.2i, xrefs: 00DFC837, 00DFC9C1
", xrefs: 00DFC889
", xrefs: 00DFC87C
"%s", xrefs: 00DFC9D7

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: FreeLocallstrlen
String ID: "$"$"%s"$%.2i
API String ID: 3681330831-2637321524
Opcode ID: a619447a80454e8b69c378d56810c9142d7226fe8407acf8e2dcb4da3251800c
Instruction ID: 7787e8ebf76d466f8236dc333ea4e7710869db10353384d52188c755ea199eac
Opcode Fuzzy Hash: a619447a80454e8b69c378d56810c9142d7226fe8407acf8e2dcb4da3251800c
Instruction Fuzzy Hash: 4A61E07290071CABCB10EF55CC45BAEB7F8FB44700F05816AE959A7181EB7469448FA0

Function 00DFAE00 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00DFAE29
GetParent.USER32(?), ref: 00DFAE2C
GetWindowRect.USER32(00000000,?), ref: 00DFAE38
MonitorFromRect.USER32(?,00000002), ref: 00DFAE41
GetMonitorInfoW.USER32(00000000,?), ref: 00DFAE55
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005), ref: 00DFAEE7

Strings

(, xrefs: 00DFAE4B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: RectWindow$Monitor$FromInfoParent
String ID: (
API String ID: 2534694491-3887548279
Opcode ID: 50d135dc198b8c67970976a819f7e9847ef8277021a9053dfa0face832a894e3
Instruction ID: 039849dd9ce758d64a8abcb9716114c9eceeff9bf331c90f2e0ee090dbc43747
Opcode Fuzzy Hash: 50d135dc198b8c67970976a819f7e9847ef8277021a9053dfa0face832a894e3
Instruction Fuzzy Hash: 0A313A723043059FC600CF68DD89A2FBBE9EB88744F55492DF58AE3251D7B0E9098B62

Function 00DF9FB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00DF9FE2
SendMessageW.USER32(00000000,0000040D,00000000,00000020), ref: 00DFA011
StrRetToBufW.SHLWAPI(?,75C05540,?,00000040), ref: 00DFA043
PathIsSameRootW.SHLWAPI(00000020,?), ref: 00DFA055
SendMessageW.USER32(00000000,0000014E,00000001,00000000), ref: 00DFA074
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00DFA09A

Strings

, xrefs: 00DF9FF0

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: MessageSend$PathRootSame
String ID:
API String ID: 2384681124-3916222277
Opcode ID: 23f72dea07d184e3ec3e55000f384ea435f3a6c94c4f850c6e38399b356df43d
Instruction ID: 606fc61428ba69733472d85d38974edf1ec867f98df2016c6748e0ed33a1d18a
Opcode Fuzzy Hash: 23f72dea07d184e3ec3e55000f384ea435f3a6c94c4f850c6e38399b356df43d
Instruction Fuzzy Hash: BD215671344305AFD3209F59ED45FA7B7ECEB85B40F114419F649A7291DBB0E8448B62

Function 00DF8970 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetPropW.USER32(00000000,DirListData), ref: 00DF897A

Part of subcall function 00DF8A30: GetPropW.USER32(?,DirListData), ref: 00DF8A3A
Part of subcall function 00DF8A30: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A48
Part of subcall function 00DF8A30: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A56
Part of subcall function 00DF8A30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DF8A82
Part of subcall function 00DF8A30: TranslateMessage.USER32(?), ref: 00DF8A8D
Part of subcall function 00DF8A30: DispatchMessageW.USER32(?), ref: 00DF8A94
Part of subcall function 00DF8A30: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A9E
Part of subcall function 00DF8A30: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8AB1
Part of subcall function 00DF8A30: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8ABD

CloseHandle.KERNEL32(?), ref: 00DF898F
CloseHandle.KERNEL32(?), ref: 00DF899B
CoTaskMemFree.OLE32(?), ref: 00DF89A9
RemovePropW.USER32(00000000,DirListData), ref: 00DF89C4
GlobalFree.KERNEL32(00000000), ref: 00DF89CB

Strings

DirListData, xrefs: 00DF8974, 00DF89BE

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: EventMessageProp$CloseFreeHandleObjectSingleWait$DispatchGlobalPeekRemoveResetTaskTranslate
String ID: DirListData
API String ID: 222544525-869039069
Opcode ID: 1d735245f62357bd1cb995747772e8c02c49f091a066627ce19c57c1399e0713
Instruction ID: 209529ee5c02db2e89309968ae9a0f27330dd0f1bcfc5c9df0fde29eb7660e22
Opcode Fuzzy Hash: 1d735245f62357bd1cb995747772e8c02c49f091a066627ce19c57c1399e0713
Instruction Fuzzy Hash: B7F0B272300B01BFD7045BB6FC4C92EB7A9FF58751B148519F51AD2131DBB1D8149A61

Function 00DF98D0 Relevance: 12.1, APIs: 8, Instructions: 122windowstringCOMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(?,?,00000104), ref: 00DF9931
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 00DF9985
SendMessageW.USER32 ref: 00DF99B9
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 00DF99E4
lstrcmpiW.KERNEL32(?,?), ref: 00DF99F6
SendMessageW.USER32(00000000,00001053,00000000,?), ref: 00DF9A0C
SendMessageW.USER32(00000000,0000102B,00000000,?), ref: 00DF9A4C
SendMessageW.USER32(00000000,00001013,00000000,00000000), ref: 00DF9A57

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: MessageSend$NamePathShort$FileInfolstrcmpi
String ID:
API String ID: 2457365294-0
Opcode ID: 0f1d1a8c4e6e13ba5ce61c33f09636e64273e77582653e1aa78f3829566395b3
Instruction ID: 53d0e4f9404a00a0824466618e83cb04a78eb2cce0b832b7a4ad3eb5bb89f8e3
Opcode Fuzzy Hash: 0f1d1a8c4e6e13ba5ce61c33f09636e64273e77582653e1aa78f3829566395b3
Instruction Fuzzy Hash: 6041C171A04304ABE330DB25DC85BBBB3ECEB85714F05451DFA98A72D1E7B4D944CA62

Function 00DF3400 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000080,00000000,0005047B), ref: 00DF397A
SetDlgItemTextW.USER32(?,00000064,00000000), ref: 00DF39ED
SendDlgItemMessageW.USER32(?,00000064,000000C5,00000103,00000000), ref: 00DF3A02
GetDlgItem.USER32(?,00000064), ref: 00DF3A0D
SHAutoComplete.SHLWAPI(00000000), ref: 00DF3A14
GetDlgItem.USER32(?,00000065), ref: 00DF3A40
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 00DF3A53
ImageList_Destroy.COMCTL32(?), ref: 00DF3A61

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Item$MessageSend$AutoCompleteDestroyImageList_Text
String ID:
API String ID: 2206562733-0
Opcode ID: b794390f5d801fa82ec50018c91be42517ca36397fe284d12672930da3bc5faf
Instruction ID: 29953f952e2333dc3009f35cd92c620a8ed91883937e5c2c7fbbc79e617a5db7
Opcode Fuzzy Hash: b794390f5d801fa82ec50018c91be42517ca36397fe284d12672930da3bc5faf
Instruction Fuzzy Hash: AC3157323002086FD220AB29EC4EF7F7799EB84750F054529F29AEA2D1DFF19951C761

Function 00DFAF00 Relevance: 12.1, APIs: 8, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000065), ref: 00DFAF20
LoadImageW.USER32(?,?,00000000,00000000,00000000,00002000), ref: 00DFAF35
GetObjectW.GDI32(00000000,00000018,?), ref: 00DFAF45
ImageList_Create.COMCTL32(?,?,00000021,00000001,00000000,?,?,?,?,?,?,?,?,?,?,00DF3994), ref: 00DFAF59
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000,?,?,?,?,?,?,?,?,?,?,00DF3994,00000065), ref: 00DFAF6A
DeleteObject.GDI32(00000000), ref: 00DFAF71
SetRect.USER32(?,00000000,00000000,00000000,00000000), ref: 00DFAF84
SendMessageW.USER32(00000000,00001602,00000000,?), ref: 00DFAF9F

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Image$List_Object$CreateDeleteItemLoadMaskedMessageRectSend
String ID:
API String ID: 26161057-0
Opcode ID: f0485f2918e3c30c4fc5ff81b9c3cc46d53d5095e72149de54715f42e1e82db3
Instruction ID: cad8dd6d7ef373c5b962adc6115e4638606d0f1db6b0da85a3fae95a6036592d
Opcode Fuzzy Hash: f0485f2918e3c30c4fc5ff81b9c3cc46d53d5095e72149de54715f42e1e82db3
Instruction Fuzzy Hash: F8118E72244704BFE7209BA1AC4AF9B7BECFB48B51F500519F645AA1E0D6F0A9048B95

Function 00E11D79 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00E11DE4
operator+.LIBVCRUNTIME ref: 00E11E34
shared_ptr.LIBCMT ref: 00E11F00
DName::DName.LIBVCRUNTIME ref: 00E11F30
operator+.LIBVCRUNTIME ref: 00E11F91

Strings

x3, xrefs: 00E11F9E, 00E11F7C, 00E11ED7, 00E11E89, 00E11E08, 00E11DBB, 00E11DC1, 00E11E0B, 00E11E8C, 00E11EDD, 00E11F86, 00E11FA1

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: x3
API String ID: 2894330373-2569920903
Opcode ID: 1e752847080018c6330b31a68b8a5cbbe79519f36a07eafa13d8dba7e4690b04
Instruction ID: 68fa963f5a37b7664eee1c70592fb5a150bf5e751aad57abb31becd66da789bb
Opcode Fuzzy Hash: 1e752847080018c6330b31a68b8a5cbbe79519f36a07eafa13d8dba7e4690b04
Instruction Fuzzy Hash: 0861AF75904109EFCB04DFA8D8449ED7BB9FF04344F24969AE919B7261D37196C5CF40

Function 00DE9280 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 174fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE7CF0: CreateFileW.KERNEL32(00E7D538,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00DE7D33
Part of subcall function 00DE7CF0: LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 00DE7D4A

FlushFileBuffers.KERNEL32(00000000,00000000), ref: 00DE92EC
UnlockFileEx.KERNEL32(00000000,00000000,000000FF,00000000,?), ref: 00DE92FE
CloseHandle.KERNEL32(00000000), ref: 00DE9305

Strings

P, xrefs: 00DE937F
Filters, xrefs: 00DE933D, 00DE93B3
E, xrefs: 00DE942B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$BuffersCloseCreateFlushHandleLockUnlock
String ID: E$Filters$P
API String ID: 3886186091-1413264023
Opcode ID: e1c02dd99b019d8e14f89a1a138ef02caa0b8eb60e26288203c51f1023b3de6f
Instruction ID: 462a09ac747142e863554c60d7fcfe34c06393d454a99c966780593db2f7ba0f
Opcode Fuzzy Hash: e1c02dd99b019d8e14f89a1a138ef02caa0b8eb60e26288203c51f1023b3de6f
Instruction Fuzzy Hash: 7351DC726093819FC710FF16D890B6BF7E4EF85314F584929F980A3291D771E9498BB2

Function 00E0F1F8 Relevance: 10.7, APIs: 7, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00E0F286
DName::operator+.LIBCMT ref: 00E0F2D9

Part of subcall function 00E0DD2F: shared_ptr.LIBCMT ref: 00E0DD4B

Part of subcall function 00E0DC1E: DName::operator+.LIBCMT ref: 00E0DC3F

DName::operator+.LIBCMT ref: 00E0F2CA
DName::operator+.LIBCMT ref: 00E0F32A
DName::operator+.LIBCMT ref: 00E0F337
DName::operator+.LIBCMT ref: 00E0F37E
DName::operator+.LIBCMT ref: 00E0F38B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: 44567b760ebff1a9949d59d704d91962db149c8dd15e4f5436763042aff0e1e8
Instruction ID: 857c095a2ecd2ff39c011e2b56abfcad84dbee3571576062d25afc1c8a9deef9
Opcode Fuzzy Hash: 44567b760ebff1a9949d59d704d91962db149c8dd15e4f5436763042aff0e1e8
Instruction Fuzzy Hash: 1A515F71904218AADF15DBE4CC95EEEBBF8AF08710F045169F505B71D1EB749A84CBA0

Function 00E0A840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E0A877
___except_validate_context_record.LIBVCRUNTIME ref: 00E0A87F
_ValidateLocalCookies.LIBCMT ref: 00E0A908
__IsNonwritableInCurrentImage.LIBCMT ref: 00E0A933
_ValidateLocalCookies.LIBCMT ref: 00E0A988

Strings

csm, xrefs: 00E0A91D

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e9bc44280abef8279ceb9ded72f5508a6272f75a880d45479ffd2424a471c532
Instruction ID: c5a5f26275e80476efaf43e289a05e91d0a8157dec3a7340730f37411bc08459
Opcode Fuzzy Hash: e9bc44280abef8279ceb9ded72f5508a6272f75a880d45479ffd2424a471c532
Instruction Fuzzy Hash: 3A519234A0030D9FCB10DF68D885A9EBBF5BF45318F18D165E818AB392D731E986CB91

Function 00DE89E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83stringfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?), ref: 00DE8ACB

Part of subcall function 00DE7CF0: CreateFileW.KERNEL32(00E7D538,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00DE7D33
Part of subcall function 00DE7CF0: LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 00DE7D4A

FlushFileBuffers.KERNEL32(00000000,00000000), ref: 00DE8A3D
UnlockFileEx.KERNEL32(00000000,00000000,000000FF,00000000,?), ref: 00DE8A4F
CloseHandle.KERNEL32(00000000), ref: 00DE8A56
lstrlenW.KERNEL32(?,00000000,Settings2,?,?,?), ref: 00DE8A9D

Strings

Settings2, xrefs: 00DE8A86

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$lstrlen$BuffersCloseCreateFlushHandleLockUnlock
String ID: Settings2
API String ID: 2223255397-1942966065
Opcode ID: 1ce731c2879bec7f19c79cb6b58396647893829e1d64c62a4a83f09d6aa568e4
Instruction ID: 2d7060aa0782e1169a7b1dac144cf60bd8571a76753b290942eebff7dee98d42
Opcode Fuzzy Hash: 1ce731c2879bec7f19c79cb6b58396647893829e1d64c62a4a83f09d6aa568e4
Instruction Fuzzy Hash: 7321D5326083519BC710BB29DC44AAFB7A9EFC5764F14061AF845A3390DB70AD4897F2

Function 00E49A61 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,98D825DA,?,00E49B70,?,?,00000000,?), ref: 00E49B22

Strings

ext-ms-, xrefs: 00E49ACC
api-ms-, xrefs: 00E49AB8

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 013a4d8a59bebaa76b085690566e4d58da736f1f01cdc01794984bf06b1e641c
Instruction ID: ae38d248ace2647592da2383eccd9cee2e1e2e4c984b729a93b040165711ffd9
Opcode Fuzzy Hash: 013a4d8a59bebaa76b085690566e4d58da736f1f01cdc01794984bf06b1e641c
Instruction Fuzzy Hash: BF210633B41611ABCB31DB26FC85BAB37A9EB427A4F251210F916B7292D770ED04D6D0

Function 00E0716C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383},00000000,00000001,?,?), ref: 00E071A4
RegQueryValueExW.ADVAPI32(?,Locale,00000000,00000000,|,00000006,?), ref: 00E071C1
RegCloseKey.ADVAPI32(?), ref: 00E071CC

Strings

Locale, xrefs: 00E071B9
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}, xrefs: 00E0719A
|, xrefs: 00E071B3, 00E071E0, 00E071B6, 00E071E3

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Locale$Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}$|
API String ID: 3677997916-279692074
Opcode ID: 1c86b4ba294e9e65c9e744901336ed32cfb4f77aebeac044b7e210585df67857
Instruction ID: 9d1e6ebd1965e3f557308a60350acb48992b7b7c196d4eccf5cf325dfcf35e2d
Opcode Fuzzy Hash: 1c86b4ba294e9e65c9e744901336ed32cfb4f77aebeac044b7e210585df67857
Instruction Fuzzy Hash: 56117376E00209AACB21EFA6EC09EFF77B9FB84744F401015F955B31A1E7709989C760

Function 00E0A758 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E0A764

Part of subcall function 00E0A2F5: std::exception::exception.LIBCONCRT ref: 00E0A302

Part of subcall function 00E0BBAE: RaiseException.KERNEL32(E06D7363,00000001,00000003,00E09B83,?,?,?,?,00E09B83,?,00E77FD4), ref: 00E0BC0E

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E0A784

Part of subcall function 00E0A369: std::exception::exception.LIBCONCRT ref: 00E0A376

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E0A7A4

Part of subcall function 00E0A3A3: std::exception::exception.LIBCONCRT ref: 00E0A3B0

std::regex_error::regex_error.LIBCPMT ref: 00E0A7C4

Part of subcall function 00E0A3E6: std::exception::exception.LIBCONCRT ref: 00E0A3FE

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00E0A7E4

Part of subcall function 00E0A42F: std::exception::exception.LIBCONCRT ref: 00E0A43C

Strings

bad function call, xrefs: 00E0A7F8

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: std::exception::exception$std::invalid_argument::invalid_argument$ExceptionRaisestd::regex_error::regex_error
String ID: bad function call
API String ID: 2470674941-3612616537
Opcode ID: 5d12753f4ab06653f0a2ebb66b912e6cb59a8d02b5bf8b9b49d8ca62f78be435
Instruction ID: f335dd80ffd536b3f305a564d952bcaed88fe87163ff579b8427eef32bf1b9b9
Opcode Fuzzy Hash: 5d12753f4ab06653f0a2ebb66b912e6cb59a8d02b5bf8b9b49d8ca62f78be435
Instruction Fuzzy Hash: F111FE79C0430C7BCB04FAE4D84BCDDB7BDAA04700F90A460BA64B24D5EB75A6599AD1

Function 00E00930 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

PathIsRelativeW.SHLWAPI(00E818F4,00000000), ref: 00E00948
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00E0095E
PathRemoveFileSpecW.SHLWAPI(?), ref: 00E00969
PathAppendW.SHLWAPI(?,00E818F4), ref: 00E00975
PathFileExistsW.SHLWAPI(00E818F4), ref: 00E00980
PathIsDirectoryW.SHLWAPI(00E818F4), ref: 00E0098B
LoadImageW.USER32(00000000,00E818F4,00000000,00000000,00000000,00002010), ref: 00E0099F

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Path$File$AppendDirectoryExistsImageLoadModuleNameRelativeRemoveSpec
String ID:
API String ID: 1924643234-0
Opcode ID: 60a790950e75fa2b9c3213dff2c6f93a855c8e3d0cdcf49e06d007c18757e7aa
Instruction ID: f8a4bc502b06863b570c96ecf76bb7b923a2544e4a6e17764a702911fdb0b64f
Opcode Fuzzy Hash: 60a790950e75fa2b9c3213dff2c6f93a855c8e3d0cdcf49e06d007c18757e7aa
Instruction Fuzzy Hash: 4E018872600701AFE6109B61EC0DBAF37ECEF89B80F404519F859E6191DBF498448B52

Function 00E08695 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00000000,00E08710,00E08673,00E08BDA,?,?,00000000,?,?), ref: 00E086AC
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00E086C2
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00E086D7

Strings

ReleaseSRWLockExclusive, xrefs: 00E086CC
AcquireSRWLockExclusive, xrefs: 00E086BC
KERNEL32.DLL, xrefs: 00E086A7

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 29673fd4127fc1ed2cdcd434449885dde8a7620e197203f14ca8b801ce6903d5
Instruction ID: da07d80cbf9548b9951a1835ceeb0d2c1ae504890a7e4bb471c6cfb2b034bcb0
Opcode Fuzzy Hash: 29673fd4127fc1ed2cdcd434449885dde8a7620e197203f14ca8b801ce6903d5
Instruction Fuzzy Hash: 61F0A4327527219FCB215EA17E856AB22C89B12399329203AD981F3280DA61CCC44B90

Function 00E5CADA Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98a0c1159b3e38cd66312c67d6919436bd5938e0bc1421d3068c70e45245a769
Instruction ID: 3c1e79755a6667aa0b5839e4f79842bdb221b4917838df34508899aaa4205430
Opcode Fuzzy Hash: 98a0c1159b3e38cd66312c67d6919436bd5938e0bc1421d3068c70e45245a769
Instruction Fuzzy Hash: E3B13570A043499FDB01CF98D8A1BBDBBF5BF86319F341959E805BB282C7709949CB91

Function 00E5D002 Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00E5D0A8
__freea.LIBCMT ref: 00E5D23D
__freea.LIBCMT ref: 00E5D243
__freea.LIBCMT ref: 00E5D279
__freea.LIBCMT ref: 00E5D27F
__freea.LIBCMT ref: 00E5D28F

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: ed39079d7e2e17b0788a5c85fe6b120cf860ec9d28614d8b9d51db0a36341c91
Instruction ID: 8c2b2acb231041cf29e712e0f697a87c8a33cc3a714d7b854574cd4eb8011742
Opcode Fuzzy Hash: ed39079d7e2e17b0788a5c85fe6b120cf860ec9d28614d8b9d51db0a36341c91
Instruction Fuzzy Hash: 8E7105369082099BDF319F94DC81BEF77FAAF4931AF246845EC04B7291E635CC498790

Function 00DF9480 Relevance: 9.1, APIs: 6, Instructions: 119windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001032,00000000,00000000), ref: 00DF94B8
SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 00DF94C8
SendMessageW.USER32(?,?,00000000,0000104B), ref: 00DF94ED
StrRetToBufW.SHLWAPI(?,?,?,00000104,?,?,?,?,?,00000000,0000104B,00000000,?), ref: 00DF9549
StrRetToBufW.SHLWAPI(?,?,?,00000104,?,00000001,?,?,?,00000000,0000104B,00000000,?), ref: 00DF9588
SHGetDataFromIDListW.SHELL32(?,?,00000001,?,00000250), ref: 00DF95A0

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: MessageSend$DataFromList
String ID:
API String ID: 101582348-0
Opcode ID: 26756c1af1b279830c0adc33599424d7ecc25f37f936ab3c2c84429c0d1292f5
Instruction ID: 53c7d60cb6f646ba0986fb70bcb14167c847bd0dcd7f6269337e94db04949db7
Opcode Fuzzy Hash: 26756c1af1b279830c0adc33599424d7ecc25f37f936ab3c2c84429c0d1292f5
Instruction Fuzzy Hash: 12419070204309AFD720DF65CC41F6BF7E8AF85744F148A19F69497290E7B0E9488B25

Function 00E13B15 Relevance: 9.1, APIs: 6, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00E13B59
DName::operator+.LIBCMT ref: 00E13B65

Part of subcall function 00E0DD2F: shared_ptr.LIBCMT ref: 00E0DD4B

DName::operator+=.LIBCMT ref: 00E13C23

Part of subcall function 00E123A9: DName::operator+.LIBCMT ref: 00E12414
Part of subcall function 00E123A9: DName::operator+.LIBCMT ref: 00E126DE

Part of subcall function 00E0DC1E: DName::operator+.LIBCMT ref: 00E0DC3F

DName::operator+.LIBCMT ref: 00E13BE0

Part of subcall function 00E0DD87: DName::operator=.LIBVCRUNTIME ref: 00E0DDA8

DName::DName.LIBVCRUNTIME ref: 00E13C47
DName::operator+.LIBCMT ref: 00E13C53

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID:
API String ID: 2795783184-0
Opcode ID: 6645de5ddf26b84b0e939c5c0f4e58e8f02a8fbbd2d0e94d04fb9acd76a5cb40
Instruction ID: 660409463957ad76e1e6a0c7962b06a5860eb3c4fe25a5ab96900330cbf310b9
Opcode Fuzzy Hash: 6645de5ddf26b84b0e939c5c0f4e58e8f02a8fbbd2d0e94d04fb9acd76a5cb40
Instruction Fuzzy Hash: B541B6B0A08644AFDB14DFB8C895BEDBBE9AB05304F10145CE19AB7291D7745EC4C7A0

Function 00E12767 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E13C69: Replicator::operator[].LIBCMT ref: 00E13CA6

DName::operator=.LIBVCRUNTIME ref: 00E12813

Part of subcall function 00E123A9: DName::operator+.LIBCMT ref: 00E12414
Part of subcall function 00E123A9: DName::operator+.LIBCMT ref: 00E126DE

DName::operator+.LIBCMT ref: 00E127CD
DName::operator+.LIBCMT ref: 00E127D9
DName::DName.LIBVCRUNTIME ref: 00E1281D
DName::operator+.LIBCMT ref: 00E1283A
DName::operator+.LIBCMT ref: 00E12846

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: bd4fee3349d7f0cfbed2866d80d6e472b7c601f5de574164cec1afe10980e3ff
Instruction ID: 9aa6a50ae70c762cac134d27a0bf751a14fe7516862ee803f771228982c4ddec
Opcode Fuzzy Hash: bd4fee3349d7f0cfbed2866d80d6e472b7c601f5de574164cec1afe10980e3ff
Instruction Fuzzy Hash: 1731F5B1A046049FDB18DFA8DC55AEEBBF8AF58300F10945DE19AF7391D7709984CB20

Function 00DE87C0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 65COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,true,true,?,00000040), ref: 00DE8826

Strings

false, xrefs: 00DE87E8
ShowDriveBox, xrefs: 00DE883C
p, xrefs: 00DE8836
Settings, xrefs: 00DE883D
true, xrefs: 00DE87ED, 00DE8816, 00DE881F

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Settings$ShowDriveBox$false$p$true
API String ID: 626452242-1378405446
Opcode ID: 12ab4b09ef55519fd7101110cd648335ce9ffbf5f29b2fc07fc774f33b1a221e
Instruction ID: 80d625dcf8db5803cb101c09889af42efbcfe9565b1fe69f26a178036d53454b
Opcode Fuzzy Hash: 12ab4b09ef55519fd7101110cd648335ce9ffbf5f29b2fc07fc774f33b1a221e
Instruction Fuzzy Hash: 531127757002405BEB34AB299C56BA776E5EBC9300F84842DF99DEB2C0DE70CC0893A2

Function 00E074CF Relevance: 9.1, APIs: 6, Instructions: 63filelibraryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000001,80000000,00000005,00000000,00000003,00000000,00000000,?,?,00000000,?,00E07CE0), ref: 00E074F3
CreateFileMappingW.KERNEL32(00000000,00000000,00000008,00000000,00000000,00000000,?,00E07CE0), ref: 00E07507
CloseHandle.KERNEL32(00000000,?,00E07CE0), ref: 00E07510
MapViewOfFile.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,00E07CE0), ref: 00E07520
CloseHandle.KERNEL32(00000000,?,00E07CE0), ref: 00E07529
LoadLibraryExW.KERNEL32(00000001,00000000,00000000,?,?,00000000,?,00E07CE0), ref: 00E07546

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$CloseCreateHandle$LibraryLoadMappingView
String ID:
API String ID: 1262414356-0
Opcode ID: fefafdccb989816a2341b64050e8634dbd040134f42fd4715d22e23314d83222
Instruction ID: cb6001919b21fabe3456f86bb97cc31ccbadac5569094cb0bec2757c1133b3bb
Opcode Fuzzy Hash: fefafdccb989816a2341b64050e8634dbd040134f42fd4715d22e23314d83222
Instruction Fuzzy Hash: 9C01F572A05618BFE2200B756C8DFBB761CEB41BDDF205225F945B20D0D6B0AD8086B0

Function 00E0C174 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E0C16B,00E0B153,00E09F4B), ref: 00E0C182
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E0C190
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E0C1A9
SetLastError.KERNEL32(00000000,00E0C16B,00E0B153,00E09F4B), ref: 00E0C1FB

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8ff0370f87e904cdb5d6ab925e2498693872eb8123e17ac85d2394f8e5e9143d
Instruction ID: c0de6f7ea4b1a6ca2597b007026ba2037d99b3c0230105314058fca8c65aaf01
Opcode Fuzzy Hash: 8ff0370f87e904cdb5d6ab925e2498693872eb8123e17ac85d2394f8e5e9143d
Instruction Fuzzy Hash: AB01243220B2169EE728A7797C86A6726E4FB06379730133AF624B11F2EF118CC99140

Function 00DF5570 Relevance: 9.0, APIs: 6, Instructions: 42stringwindowCOMMON

Download Yara Rule

APIs

AppendMenuW.USER32(00000000,-000004D2,?,00000000), ref: 00DF5588
lstrcmpiW.KERNEL32(?,00E7E6B8,?,?), ref: 00DF5598
IsDlgButtonChecked.USER32(00000066), ref: 00DF55AA
CharNextW.USER32(?,00E7E6B8,?,?), ref: 00DF55BB
lstrcmpiW.KERNEL32(00000000,?,?), ref: 00DF55C2
IsDlgButtonChecked.USER32(00000066), ref: 00DF55D4

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ButtonCheckedlstrcmpi$AppendCharMenuNext
String ID:
API String ID: 2957333968-0
Opcode ID: 3a783dbebbed89c50b6aabe5fd895958199a81beec22cd4da5aeacdcc808f222
Instruction ID: faa6786912c9ff6f906c391829bd62dab348d716af3ef8f74627b65d6312365b
Opcode Fuzzy Hash: 3a783dbebbed89c50b6aabe5fd895958199a81beec22cd4da5aeacdcc808f222
Instruction Fuzzy Hash: 9F018B32641A00AFE720AF12FC09A663BB6FB29351F148455F609F6AB4D3B198988B10

Function 00DFD650 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000048,00000008,00000000), ref: 00DFD674
GetWindowRect.USER32(?,?), ref: 00DFD690
DrawAnimatedRects.USER32(?,00000003,?,?), ref: 00DFD6A3
ShowWindow.USER32(?,00000005), ref: 00DFD6AC
SetActiveWindow.USER32(?), ref: 00DFD6B3
SetForegroundWindow.USER32(?), ref: 00DFD6BA

Part of subcall function 00DFD430: FindWindowExW.USER32(00000000,00000000,Shell_TrayWnd,00000000), ref: 00DFD453
Part of subcall function 00DFD430: FindWindowExW.USER32(00000000,00000000,TrayNotifyWnd,00000000), ref: 00DFD463
Part of subcall function 00DFD430: GetWindowRect.USER32(00000000,?), ref: 00DFD46B

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Window$FindRect$ActiveAnimatedDrawForegroundInfoParametersRectsShowSystem
String ID:
API String ID: 2112798254-0
Opcode ID: 28081db23e768ed4800652ee760726219d91b1ee5b0df321b8a67567fc619754
Instruction ID: 9f2a090681f4d99b3b80f243ecc434fa1c374a7192daaf755684c01a0763da05
Opcode Fuzzy Hash: 28081db23e768ed4800652ee760726219d91b1ee5b0df321b8a67567fc619754
Instruction Fuzzy Hash: 0C017132101614AFD200AB11EC49B9F3BA8FF49741F404409F146A6090DBB499898B62

Function 00DFB010 Relevance: 9.0, APIs: 6, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(0000A02A,000000EC), ref: 00DFB01B
SetWindowLongW.USER32(0000A02A,000000EC,00000000), ref: 00DFB02A
MulDiv.KERNEL32(?,000000FF,00000064), ref: 00DFB03B
SetLayeredWindowAttributes.USER32(0000A02A,00000000,?,00000002), ref: 00DFB04E
GetWindowLongW.USER32(0000A02A,000000EC), ref: 00DFB057
SetWindowLongW.USER32(0000A02A,000000EC,00000000), ref: 00DFB066

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 4ac5320d88bc793df48c8526b538705937e0096ed3de18bd26b9010469d9cd21
Instruction ID: 7323d367b03a0f570931a413818f2d0719a49987a4ae0ae4817428891dcda197
Opcode Fuzzy Hash: 4ac5320d88bc793df48c8526b538705937e0096ed3de18bd26b9010469d9cd21
Instruction Fuzzy Hash: D4F03033205911BFD6112755BC0EFAB3E19AB42361F244216F163E40F1DFA004149765

Function 00DFB930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,.lnk,00000000,-00000001), ref: 00DFB962
lstrcmpiW.KERNEL32(00000000), ref: 00DFB969

Part of subcall function 00DFB810: CoCreateInstance.OLE32(00E6A89C,00000000,00000001,00E66D8C,?,0000C356,?), ref: 00DFB83F
Part of subcall function 00DFB810: lstrcpyW.KERNEL32(?,?), ref: 00DFB86B
Part of subcall function 00DFB810: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 00DFB8F2
Part of subcall function 00DFB810: lstrcpynW.KERNEL32(?,?,?), ref: 00DFB90C

PathIsDirectoryW.SHLWAPI(?), ref: 00DFB9A9
lstrcpynW.KERNEL32(?,?,?), ref: 00DFB9C0

Strings

.lnk, xrefs: 00DFB95C

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Pathlstrcpyn$CreateDirectoryEnvironmentExpandExtensionFindInstanceStringslstrcmpilstrcpy
String ID: .lnk
API String ID: 403286655-24824748
Opcode ID: e0fee78b98e771c4043989935ef3efe53e6b08a2c4f883b8be225f234febc900
Instruction ID: 5def9320973475d6dbbbf15dd886303228765c0a7d78f5a344310f1c0abde42f
Opcode Fuzzy Hash: e0fee78b98e771c4043989935ef3efe53e6b08a2c4f883b8be225f234febc900
Instruction Fuzzy Hash: 2911E7717007085BD720AB24EC467FB73D8AB84750F45C83AE745D2290EBF4CD458AB2

Function 00DE70F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

RtlGetNtVersionNumbers.NTDLL ref: 00DE7149
SetPropW.USER32(?,UseImmersiveDarkModeColors,75C08510), ref: 00DE716F
SetWindowCompositionAttribute.USER32 ref: 00DE7198

Part of subcall function 00DE6FC0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 00DE6FDF

Strings

UseImmersiveDarkModeColors, xrefs: 00DE7169
P#_t@~`t)^t, xrefs: 00DE7116

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: AttributeCompositionInfoNumbersParametersPropSystemVersionWindow
String ID: P#_t@~`t)^t$UseImmersiveDarkModeColors
API String ID: 153591563-3585946688
Opcode ID: bcc347f23c10190a51e7b5177d8000d0f6fe79abf00b54e2f130969bfd49705d
Instruction ID: 2917aab7aa34aeb52abfe060c6535112052c03d160d18edc235fd13d978ad4f1
Opcode Fuzzy Hash: bcc347f23c10190a51e7b5177d8000d0f6fe79abf00b54e2f130969bfd49705d
Instruction Fuzzy Hash: EB010071208700AFD710FF1AEC08B8A3BE4FF40345F448849F49CB22A1D3B0848C8BA2

Function 00E41B40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,98D825DA,?,?,00000000,00E64658,000000FF,?,00E41AD1,00000002,?,00E41AA5,00E45FF2), ref: 00E41B75
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E41B87
FreeLibrary.KERNEL32(00000000,?,?,00000000,00E64658,000000FF,?,00E41AD1,00000002,?,00E41AA5,00E45FF2), ref: 00E41BA9

Strings

CorExitProcess, xrefs: 00E41B7F
mscoree.dll, xrefs: 00E41B6E

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 25fdc5fe0290f5802d5f3e8b9a32b90ea90423ec37c2317c4497c7aa27ca1b0a
Instruction ID: e71627830f611bd19ea8296798f610e4524cc9f14f58a4d93a1eea43b4269e7d
Opcode Fuzzy Hash: 25fdc5fe0290f5802d5f3e8b9a32b90ea90423ec37c2317c4497c7aa27ca1b0a
Instruction Fuzzy Hash: 2901DB32A40A19EFDB118F51EC09FAFB7B8FB05794F040525F811F26E0E7B49804CA80

Function 00E49C27 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00E49BE0), ref: 00E49C36
GetLastError.KERNEL32(?,00E49BE0), ref: 00E49C40
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00E49C7E

Strings

ext-ms-, xrefs: 00E49C63
api-ms-, xrefs: 00E49C4D

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 9f9e0b99e678387637ee312d0d682d34a5e59ade823ae0fdfbda25961f3b93dc
Instruction ID: b4e04952d2c4906b0d94f1a8d341d7953d9062de08fa1b226054840d02b19eed
Opcode Fuzzy Hash: 9f9e0b99e678387637ee312d0d682d34a5e59ade823ae0fdfbda25961f3b93dc
Instruction Fuzzy Hash: 11F0A731F80304BBEF201F52FD46B5A7E959B80BC5F115520FA0CB80E2E7E6D9548580

Function 00DFE010 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNEL32(en-US,af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T,00DFE59F,?,?,00000400), ref: 00DFE05B
InitMUILanguage.COMCTL32(en-US,?,?,00000400), ref: 00DFE062

Strings

en-US, xrefs: 00DFE016, 00DFE04D, 00DFE05A, 00DFE061
af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T, xrefs: 00DFE010
en-US, xrefs: 00DFE011

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Language$InitThread
String ID: af-ZA be-BY de-DE el-GR en-GB en-US es-ES fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-T$en-US$en-US
API String ID: 4275532074-769303635
Opcode ID: 5bda137b2ea04d16caf215b394845a8ea5a82237d04cb69e144f7a5fb747244a
Instruction ID: 4cf7ac6d472127a937f99ff817e59c6de6f65c68f3971a4ef665df5a696429e1
Opcode Fuzzy Hash: 5bda137b2ea04d16caf215b394845a8ea5a82237d04cb69e144f7a5fb747244a
Instruction Fuzzy Hash: 83F027323029208FC715AF34E8153BB33E2EF8531130AC569E806E7660EB648D0597E5

Function 00DFA7F0 Relevance: 7.6, APIs: 5, Instructions: 53memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,00000000,74DF3070,75C05540,?,00E054C1,?,00000100,00002712,?), ref: 00DFA7FE
LoadStringW.USER32(?,00000000,?), ref: 00DFA817
LoadStringW.USER32(?,00000000,?), ref: 00DFA82E
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DFA852
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DFA859

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: LoadLocalString$AllocFreelstrlen
String ID:
API String ID: 389633860-0
Opcode ID: 2df73440966a6c7a4a643574dcf64940416c8359111a480c7eb11ab79104961c
Instruction ID: cd0b7c5d76cb25bf6b77d2cc85ad0c5ef4de1be7205e7b785a9297faca241786
Opcode Fuzzy Hash: 2df73440966a6c7a4a643574dcf64940416c8359111a480c7eb11ab79104961c
Instruction Fuzzy Hash: 6301D472301615AFC6209B2BFC48C6B7B6CFFC6396B050429F509D2120EB62DC1986B2

Function 00DFBB00 Relevance: 7.6, APIs: 5, Instructions: 53stringCOMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,74E2F860,?,00DF50BE), ref: 00DFBB21
lstrlenW.KERNEL32(?,?,74E2F860,?,00DF50BE), ref: 00DFBB32
lstrlenW.KERNEL32(?,?,?,00DF50BE), ref: 00DFBB47
CharPrevW.USER32(?,00000000,?,?,00DF50BE), ref: 00DFBB54
CharPrevW.USER32(?,00000000,?,?,00DF50BE), ref: 00DFBB67

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Char$Prevlstrlen$Next
String ID:
API String ID: 2482157412-0
Opcode ID: 3716c995e6e2dc98ee5de9bbac2d09b63cdef4df12af500ca8e1e93124e23c41
Instruction ID: dc2c5cd7ea29f2c2742e282464cc06173c7a5ec85794ef3e2c8430cf69d49108
Opcode Fuzzy Hash: 3716c995e6e2dc98ee5de9bbac2d09b63cdef4df12af500ca8e1e93124e23c41
Instruction Fuzzy Hash: E801DB6390022D9ECB206B65FCC493B77ADEB89360B5A5097E505D7162DBB09C41C7B0

Function 00E0C887 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00E0C8AC
CatchIt.LIBVCRUNTIME ref: 00E0C992

Strings

RCC, xrefs: 00E0C8C6
MOC, xrefs: 00E0C8BE

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 94ea3fa2bf4c03391dfeb0ec185ef3510cd3a76a35fb058ca22ea48b90bbed59
Instruction ID: 00077b2dfa5e42a0c0d501e1ed4a6c04c4b2339ad27ede907dd73e4c6b39dbbb
Opcode Fuzzy Hash: 94ea3fa2bf4c03391dfeb0ec185ef3510cd3a76a35fb058ca22ea48b90bbed59
Instruction Fuzzy Hash: 11414A72900209EFCF15DF98CD81AAEBBB5FF48308F289259F90477291D335A991DB51

Function 00E1063A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00E10667
DName::operator+.LIBCMT ref: 00E106B4
DName::DName.LIBVCRUNTIME ref: 00E1072A

Strings

b=, xrefs: 00E1063A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID: b=
API String ID: 826178784-1403132311
Opcode ID: f62fbe74695f3c6cb5bb355c489d3cfcc20e48057b6c482316cc28ada97b1d06
Instruction ID: 82da745bc34bb9f139fbc2e10c1b52dd22334d9830b61d027fe73fe07b6544e1
Opcode Fuzzy Hash: f62fbe74695f3c6cb5bb355c489d3cfcc20e48057b6c482316cc28ada97b1d06
Instruction Fuzzy Hash: 5A31A771948248AFDB08EFE4C8919EDBBB4BB45300F64909DE046772D6DBB16EC9CB50

Function 00E13278 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 00E132C9

Strings

u,, xrefs: 00E132E8, 00E132F4, 00E13303, 00E132F7, 00E13306

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Decorator::getDimensionSigned
String ID: u,
API String ID: 2996861206-1774674687
Opcode ID: 8e5d30c3c63b776d309538bdf076d86ef0c6d65caca5c11a950ca1c0e65d6f8f
Instruction ID: e87da14844823129a417300ea20a982d0602a152001dc9fad9632eecf3e8a81e
Opcode Fuzzy Hash: 8e5d30c3c63b776d309538bdf076d86ef0c6d65caca5c11a950ca1c0e65d6f8f
Instruction Fuzzy Hash: 0F3184729042099FDF04EBF4EC85BEEB7F8AB08314F20542DE511B3191DB746A89CB65

Function 00DE7CF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00E7D538,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00DE7D33
LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 00DE7D4A

Strings

AcquireReadFileLock(%s): NO READER LOCK ACQUIRED!, xrefs: 00DE7D6A
AcquireReadFileLock(%s): INVALID FILE HANDLE!, xrefs: 00DE7D83

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$CreateLock
String ID: AcquireReadFileLock(%s): INVALID FILE HANDLE!$AcquireReadFileLock(%s): NO READER LOCK ACQUIRED!
API String ID: 3593386577-1051419391
Opcode ID: 98d4c1ac954eac66dd649c2a1e7fb8d295b9f73e17ecdbf7ddcde4ed1db2913f
Instruction ID: 00ff82f4a9b74f01590b940647101ecc2dc9d7d372aa61580e90740d6fe869ee
Opcode Fuzzy Hash: 98d4c1ac954eac66dd649c2a1e7fb8d295b9f73e17ecdbf7ddcde4ed1db2913f
Instruction Fuzzy Hash: 8B215931785304B7E230BB35EC13FAB37DCAF81B60F540715B564B60C0EFA0AA0581A1

Function 00E0B0AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

__is_exception_typeof.LIBVCRUNTIME ref: 00E0B140

Strings

RCC, xrefs: 00E0B0B6
MOC, xrefs: 00E0B0BE
csm, xrefs: 00E0B0C6

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: __is_exception_typeof
String ID: MOC$RCC$csm
API String ID: 3140442014-2671469338
Opcode ID: 545806b4b4481b0b0073283f60030dd9d4c6ad90bf3481b4a6dc1936605d5429
Instruction ID: 8e2f79f0a5423dee5a0f0bb7ca83f920cafee8e6ccac8cd385abd2197fe18803
Opcode Fuzzy Hash: 545806b4b4481b0b0073283f60030dd9d4c6ad90bf3481b4a6dc1936605d5429
Instruction Fuzzy Hash: BC119032115209DFD7189F65D401B9BB7F8FF00715F25509AE850AB2A2E774EE80CB91

Function 00E06360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53stringwindowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000064,00000001,00000010,00000010,00000000,?), ref: 00E06394
lstrcpyW.KERNEL32(?,?,?,MiniPath), ref: 00E063E8
Shell_NotifyIconW.SHELL32(00000002,000003BC), ref: 00E06400

Strings

MiniPath, xrefs: 00E063D6

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: IconImageLoadNotifyShell_lstrcpy
String ID: MiniPath
API String ID: 2060738540-3848962392
Opcode ID: 20bda9a2493b09754a25dd42d0e0f36df4b4cf6a9f6f8d7166dc915a9ddcb6b8
Instruction ID: 320e5ea12097cb0a47895630617784409f80a5a0dd3c78e1056d91f2862eae9e
Opcode Fuzzy Hash: 20bda9a2493b09754a25dd42d0e0f36df4b4cf6a9f6f8d7166dc915a9ddcb6b8
Instruction Fuzzy Hash: CF117371644304AFE320DF15EC46B5B7BE8BB88B58F00581DF648B62D0D7F49A588B96

Function 00DE7E40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00E7D538,?,?,00DE9F72,98D825DA), ref: 00DE7E57
PathIsDirectoryW.SHLWAPI(00E7D538), ref: 00DE7E6A

Part of subcall function 00DE7CF0: CreateFileW.KERNEL32(00E7D538,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00DE7D33
Part of subcall function 00DE7CF0: LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 00DE7D4A

Part of subcall function 00DEB710: GetFileSize.KERNEL32(?,?), ref: 00DEB729

Strings

p, xrefs: 00DE7EB7
p, xrefs: 00DE7E74

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: File$Path$CreateDirectoryExistsLockSize
String ID: p$p
API String ID: 286802595-4017495783
Opcode ID: 1a609cbe3fe657f7294a1d2fa3e6e66d870a9e811313298e3354d0109248d437
Instruction ID: a61efc6810686048a39b80c15e80d910420e4a6ea106ad1c5150b6618077b148
Opcode Fuzzy Hash: 1a609cbe3fe657f7294a1d2fa3e6e66d870a9e811313298e3354d0109248d437
Instruction Fuzzy Hash: A801DB306083528BD354FB6B9C4635B29A5DF84758F94C699F48DA62A0E7F08C8887F2

Function 00E14776 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00E14673,00000000,?,00E7C1E8,?,?,?,00E148CA,00000004,InitializeCriticalSectionEx,00E6DD5C,InitializeCriticalSectionEx), ref: 00E14783
GetLastError.KERNEL32(?,00E14673,00000000,?,00E7C1E8,?,?,?,00E148CA,00000004,InitializeCriticalSectionEx,00E6DD5C,InitializeCriticalSectionEx,00000000,?,00E0D212), ref: 00E1478D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00E147B5

Strings

api-ms-, xrefs: 00E1479A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 4850659c0646b86de2a56c1621a7575ecbf804d2383453dfa47ce4f15008672d
Instruction ID: 9023aedfb6c2edf8adc8a2d3f528e1d79e320cf7319359c1d30dde489f125d70
Opcode Fuzzy Hash: 4850659c0646b86de2a56c1621a7575ecbf804d2383453dfa47ce4f15008672d
Instruction Fuzzy Hash: 0BE04F71780708BBEF601F62FC46F993A9AAB01B88F105421FA4CF81E0D7A2E9958585

Function 00DF89E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetPropW.USER32(00000000,DirListData), ref: 00DF89EA

Part of subcall function 00DF8A30: GetPropW.USER32(?,DirListData), ref: 00DF8A3A
Part of subcall function 00DF8A30: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A48
Part of subcall function 00DF8A30: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A56
Part of subcall function 00DF8A30: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DF8A82
Part of subcall function 00DF8A30: TranslateMessage.USER32(?), ref: 00DF8A8D
Part of subcall function 00DF8A30: DispatchMessageW.USER32(?), ref: 00DF8A94
Part of subcall function 00DF8A30: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8A9E
Part of subcall function 00DF8A30: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8AB1
Part of subcall function 00DF8A30: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00DF8BC1,?,?), ref: 00DF8ABD

ResetEvent.KERNEL32(?,?,?,?), ref: 00DF8A05
ResetEvent.KERNEL32(?,?,?,?), ref: 00DF8A0D

Strings

DirListData, xrefs: 00DF89E4

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Event$MessageReset$ObjectPropSingleWait$DispatchPeekTranslate
String ID: DirListData
API String ID: 628585283-869039069
Opcode ID: f17d7bc0f6a88b68a05d9feac81361b79d89ab677486e0126410a2e5b8f5087a
Instruction ID: 9a2001ff716d8722e27ba6747132622f4d99224cfaa4441f56d2d5d9349b2fea
Opcode Fuzzy Hash: f17d7bc0f6a88b68a05d9feac81361b79d89ab677486e0126410a2e5b8f5087a
Instruction Fuzzy Hash: E0E08632B106203BC6202366BC0DB5ABEA5DF957A0F050022F40873270CEE16C55C9E4

Function 00E5A02C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(98D825DA,00000000,00000000,?), ref: 00E5A08F

Part of subcall function 00E4E840: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000001,?,00000000,?,?,?,00E4841D,?,00000000,?), ref: 00E4E8A1

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E5A2E1
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E5A327
GetLastError.KERNEL32 ref: 00E5A3CA

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 85b56d592ecaa0c4c0471479ee53068823a4af0ae848d78c9438efad0678c3c4
Instruction ID: 54d6835c03e8d57211105b8dba95d3597f58e38554ba221575902f205d7d15c1
Opcode Fuzzy Hash: 85b56d592ecaa0c4c0471479ee53068823a4af0ae848d78c9438efad0678c3c4
Instruction Fuzzy Hash: 58D17A75D042489FCB15CFE8D880AEDBBF5FF09314F284A2AE856FB251D630A949CB51

Function 00E10A85 Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00E10BBA

Part of subcall function 00E0D97E: __aulldvrm.LIBCMT ref: 00E0D9AF

DName::operator+.LIBCMT ref: 00E10B1B
DName::operator=.LIBVCRUNTIME ref: 00E10BFF
DName::DName.LIBVCRUNTIME ref: 00E10C31

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: e6d12b7c01d842080f373bac8aad25f1fea80b61afb8280ef3ab253e74591242
Instruction ID: 678cf88b24dc43c6d724db801e84e5db04c596c160fc2c91c63ac311b22cb9fd
Opcode Fuzzy Hash: e6d12b7c01d842080f373bac8aad25f1fea80b61afb8280ef3ab253e74591242
Instruction Fuzzy Hash: 5B617CB0904259DFCB15CF98C880AEDBBB4FB45304F24925AE4197B3A2D7B09AC4CF90

Function 00E0C28B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E0C352
___AdjustPointer.LIBCMT ref: 00E0C375
___AdjustPointer.LIBCMT ref: 00E0C411

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 89cc0e8cfec9ec53cef243738e6d654b0b7f4f592dc4dc2333777c0445bde76d
Instruction ID: 780029542a7af0ebe3c7ec1e1e20feead7817b7386bbbefc16d32076ba1f07e2
Opcode Fuzzy Hash: 89cc0e8cfec9ec53cef243738e6d654b0b7f4f592dc4dc2333777c0445bde76d
Instruction Fuzzy Hash: 2551D0B26046029FDB288F54D881BAE73A4FF04704F34A26DE956B76E1D735ACC0CB90

Function 00E107B6 Relevance: 6.1, APIs: 4, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00E107E9

Part of subcall function 00E0DCF3: DName::operator+=.LIBCMT ref: 00E0DD09

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID:
API String ID: 382699925-0
Opcode ID: 911f82d84db95886cd1a6359fb16d5dd71481f78fa469ca02890b7df67e8d8bd
Instruction ID: 5633326ad4706d7929d5fd199197d930fe9d88a9574de6bfe4c4886f607b24e4
Opcode Fuzzy Hash: 911f82d84db95886cd1a6359fb16d5dd71481f78fa469ca02890b7df67e8d8bd
Instruction Fuzzy Hash: 3A413CB1D082099FDB04DFE8D895AEEBBB4FB84354F106119E505B7251D7B09AC8CBD0

Function 00E4C686 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00E4E840: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000001,?,00000000,?,?,?,00E4841D,?,00000000,?), ref: 00E4E8A1

GetLastError.KERNEL32 ref: 00E4C6EA
__dosmaperr.LIBCMT ref: 00E4C6F1
GetLastError.KERNEL32(?,?,?,?), ref: 00E4C72B
__dosmaperr.LIBCMT ref: 00E4C732

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1bedfbca604c0d4e57fcde63cc82c34921f0f4c6646a0d95a4a783f5c1e53067
Instruction ID: 71c2bd14ddbb7e6562257b8c017fb0b7a2b4761ddea3774cbe3a41edfb37444d
Opcode Fuzzy Hash: 1bedfbca604c0d4e57fcde63cc82c34921f0f4c6646a0d95a4a783f5c1e53067
Instruction Fuzzy Hash: 5B21F231605605AFCB60AF76FC8496BB7E8FF05368720A51AF815B7211EB30EC008B91

Function 00E4D6CB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1553de9774cfd83e78c28c36af69cdb151fdcf7b47dadd54e03c5cd894e8b9d
Instruction ID: bd6ab112d2991e5e2e2707f65323550ef3b55680acb891798145337be8ba3b54
Opcode Fuzzy Hash: f1553de9774cfd83e78c28c36af69cdb151fdcf7b47dadd54e03c5cd894e8b9d
Instruction Fuzzy Hash: C621C031608609AFCB21AF61BC88D6B77E8EF453A8710561AF815B7242EB30EC50C7A1

Function 00E4E947 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E4E94F

Part of subcall function 00E4E840: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000001,?,00000000,?,?,?,00E4841D,?,00000000,?), ref: 00E4E8A1

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E4E987
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E4E9A7

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 801be04e1d1b5a23cef36c7eb312c9d14b1d0d95329df9a6fe1e621846512805
Instruction ID: b0d0b2ae4724608cb34b251fac968f5cf75af10613cd03c887680f90a9c0558f
Opcode Fuzzy Hash: 801be04e1d1b5a23cef36c7eb312c9d14b1d0d95329df9a6fe1e621846512805
Instruction Fuzzy Hash: 4B1104B2606A157FAB15277A7CCECBF2AACEE943D871120A5F601F1281FB60CD0081F1

Function 00DE8350 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,00000040,?,00000000,75BF73E0), ref: 00DE83CA

Strings

p, xrefs: 00DE83DA
%ld, xrefs: 00DE8385
Window, xrefs: 00DE83E1

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: %ld$Window$p
API String ID: 626452242-4136197911
Opcode ID: 3486d3b8bdfaeb3f72979a3db2c4efc6e5505303fb1ca8f7becca3768879c2a0
Instruction ID: af282927e39e6372ff7d012e6f111be89ee4d4a69d41b44dabf2c8b852be48d1
Opcode Fuzzy Hash: 3486d3b8bdfaeb3f72979a3db2c4efc6e5505303fb1ca8f7becca3768879c2a0
Instruction Fuzzy Hash: EE1106716002416BE720EB25DC56FAB77D9EB85700F444529F64DEB2C0EE74D80887A2

Function 00DEC560 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,true,true,?,00000040,?,00000000), ref: 00DEC5C3

Strings

false, xrefs: 00DEC592
Settings, xrefs: 00DEC5D7
true, xrefs: 00DEC58D, 00DEC5B6, 00DEC5BC

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Settings$false$true
API String ID: 626452242-540067373
Opcode ID: bc4c5040b1db470f8738d3ed6166bf77e36f67c8d482f0b8a634d107a73d3ca0
Instruction ID: 55354e9f54e4598b22c951e8c2ae23635951054d7ca61a7fc5bda8f293121e1c
Opcode Fuzzy Hash: bc4c5040b1db470f8738d3ed6166bf77e36f67c8d482f0b8a634d107a73d3ca0
Instruction Fuzzy Hash: C80126727242806FE724DA288C55FA7B7D9EBC5710F04942AB6AEE72C1DB709C098771

Function 00E37D5D Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00DF9000,00E37AB2,00000000,00000004,00000000), ref: 00E37DAC
GetLastError.KERNEL32(?,?,?,00DF8A1C,00DF9000), ref: 00E37DB8
__dosmaperr.LIBCMT ref: 00E37DBF

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: cd479c4ff3b46908753073e1c3ba31c62f8158949959f77622943b649c57371f
Instruction ID: 5be459542f7e826e91d938280cd19e973d2d5c2afb5890897a7e24bd617009f2
Opcode Fuzzy Hash: cd479c4ff3b46908753073e1c3ba31c62f8158949959f77622943b649c57371f
Instruction Fuzzy Hash: E20122B2504604BBCB209B65DC0DBAE7FB9EF823B9F205209F464B61E0DB70C941D660

Function 00E5C279 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00E5C28F
GetLastError.KERNEL32(?,?,?,?), ref: 00E5C29C
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00E5C2C2
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 00E5C2E8

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: ff34cae698aa580623f295133d2337952d7fe1a60a1bf0094f54e1477044a82a
Instruction ID: b6e606370e1d0ba461fef7766fd16da1096d840bbfd5e56922871c9dc12407c9
Opcode Fuzzy Hash: ff34cae698aa580623f295133d2337952d7fe1a60a1bf0094f54e1477044a82a
Instruction Fuzzy Hash: A7118576900619AFDF209FA1EC089DF3FB9EB05769F200904F828A61B0C7718A44CBA0

Function 00E5E971 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00E5E98B
GetLastError.KERNEL32 ref: 00E5E997

Part of subcall function 00E5EA40: CloseHandle.KERNEL32(FFFFFFFE,00E5EA8A,?,00E5D413,00000000,00000001,00000000,?,?,00E5A41E,?,00000000,00000000,?,?), ref: 00E5EA50

___initconout.LIBCMT ref: 00E5E9A7

Part of subcall function 00E5EA02: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E5EA31,00E5D400,?,?,00E5A41E,?,00000000,00000000,?), ref: 00E5EA15

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00E5E9BB

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6f3fce971a4ee9322efcdf364a4af610f69e65af3b9a239edf58a58576416abc
Instruction ID: 8e341a81d82090c8af3d425dc1c2f1d6ea79f5b50a8d25e3e30a4fe5e294cd4f
Opcode Fuzzy Hash: 6f3fce971a4ee9322efcdf364a4af610f69e65af3b9a239edf58a58576416abc
Instruction Fuzzy Hash: A9F08237100901AFCB266F96EC05E467FB6FFC9751B101814FB99A2230DB7198589B50

Function 00E5EA57 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00E5D413,00000000,00000001,00000000,?,?,00E5A41E,?,00000000,00000000), ref: 00E5EA6E
GetLastError.KERNEL32(?,00E5D413,00000000,00000001,00000000,?,?,00E5A41E,?,00000000,00000000,?,?,?,00E5AA09,00000000), ref: 00E5EA7A

Part of subcall function 00E5EA40: CloseHandle.KERNEL32(FFFFFFFE,00E5EA8A,?,00E5D413,00000000,00000001,00000000,?,?,00E5A41E,?,00000000,00000000,?,?), ref: 00E5EA50

___initconout.LIBCMT ref: 00E5EA8A

Part of subcall function 00E5EA02: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E5EA31,00E5D400,?,?,00E5A41E,?,00000000,00000000,?), ref: 00E5EA15

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00E5D413,00000000,00000001,00000000,?,?,00E5A41E,?,00000000,00000000,?), ref: 00E5EA9F

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6ef1642f5c83880b26345b873e24f1157c1b0355f1a94cfc76ca8461ff9fd135
Instruction ID: cf0c2663bd83c8813490e5deb9c3c1af9024314a58a215a05da7d30a73455e81
Opcode Fuzzy Hash: 6ef1642f5c83880b26345b873e24f1157c1b0355f1a94cfc76ca8461ff9fd135
Instruction Fuzzy Hash: E6F0A033100219BFCF261FA6EC08E8A3F62FF093A1F005410FE18B6231C77289289B90

Function 00E4F761 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 311COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00E4F9DB

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-3684773922
Opcode ID: c65bee88f0801378516d015a151dcb466967c3c7b7523b8a44bc0e0dd6694b85
Instruction ID: aec7180130bdcd3f240400dd9c7d0085be1aa42e3961a4470d1317d9f7bea5cf
Opcode Fuzzy Hash: c65bee88f0801378516d015a151dcb466967c3c7b7523b8a44bc0e0dd6694b85
Instruction Fuzzy Hash: 59A11572E002019FDF28EF68F8957ADB7E1EF99B18F15603AE449BB291D7308C44CA51

Function 00E1C22F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00E1C3A6

Strings

+, xrefs: 00E1C304
-, xrefs: 00E1C2F7

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 0a663fd5321ce7f9e0e8f2d5083654dc97f8cff783d22b6898c21793cb5a5387
Instruction ID: 3224c6f9aa1f9eb1c19103a40472895dd5fad01d93001ccb8a2d1e2cad1bdfd1
Opcode Fuzzy Hash: 0a663fd5321ce7f9e0e8f2d5083654dc97f8cff783d22b6898c21793cb5a5387
Instruction Fuzzy Hash: 13A1F4709842589FCF24CE78C8506FE7BA1EF56324F24A199E8B5FB291D234D982CB50

Function 00E12B85 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 00E12BE0
DName::DName.LIBVCRUNTIME ref: 00E12D2B

Strings

%., xrefs: 00E12D19, 00E12CD1, 00E12CEA, 00E12CC5

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: %.
API String ID: 3707554701-4225590719
Opcode ID: 0fd694d23df804a029d64099dd56981ac2981806841210daee087f40059b8c53
Instruction ID: af0b70799211c8f8a6332e3cb00058e5be2c914f7f2bc5a75f3398c3bd5e3c14
Opcode Fuzzy Hash: 0fd694d23df804a029d64099dd56981ac2981806841210daee087f40059b8c53
Instruction Fuzzy Hash: 5B51A1709042849FCB15CFA8E8856EDFBF8BB09304F24945ED759B7362C7719A88CB90

Function 00E07219 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,?), ref: 00E07263
GetVersionExW.KERNEL32(0000011C,?,?,?), ref: 00E0727E

Strings

@s)u, xrefs: 00E07312

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: Version
String ID: @s)u
API String ID: 1889659487-2295221104
Opcode ID: 035a136524b287075d91a6661ccf6485e6e360b4c6bd9e8f89976387d61f2637
Instruction ID: 316bd7625917200ff26e17086998320b6930cf24646bf0c185d515ea63cfc203
Opcode Fuzzy Hash: 035a136524b287075d91a6661ccf6485e6e360b4c6bd9e8f89976387d61f2637
Instruction Fuzzy Hash: 1521D071E0422C8ADB359B599C09BEA77B4FB09718F006195E685B22E0C3B4BEC49AC0

Function 00E10CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00E10D05
DName::DName.LIBVCRUNTIME ref: 00E10D8A

Strings

A, xrefs: 00E10D6A

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 0a89dad1e038036d1e8d815a6946e4b5b75b70e75a33b7f29751defd2d063032
Instruction ID: cd49631a725fc9e799f3a44db593deab5dde296b3686b2718fba68383125d9aa
Opcode Fuzzy Hash: 0a89dad1e038036d1e8d815a6946e4b5b75b70e75a33b7f29751defd2d063032
Instruction Fuzzy Hash: 77219FB0904208EFDF14DFD8E811AEC7BB5FB84344F249499E4597B296C7B1AAC5CB41

Function 00E0D6AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E0D6CA

Part of subcall function 00E14271: _vsnprintf.LEGACY_STDIO_DEFINITIONS ref: 00E14281

swprintf.LIBCMT ref: 00E0D6ED

Strings

%lf, xrefs: 00E0D6C0, 00E0D6C5, 00E0D6EA

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ___swprintf_l_vsnprintfswprintf
String ID: %lf
API String ID: 3395499991-2891890143
Opcode ID: ebc8ab39cf436ea74cff083f72ad28da57aebdf9748046b436080972700b666c
Instruction ID: a741d47f5d232981edf5a4c5293457cc10d0eb3bfbf853da674c29c6bdd0bff8
Opcode Fuzzy Hash: ebc8ab39cf436ea74cff083f72ad28da57aebdf9748046b436080972700b666c
Instruction Fuzzy Hash: 87F0C2B5500008BADB006B94DC86FFF7FACDF85354F114098F64526292DB715E50D3B5

Function 00E0D70D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E0D726

Part of subcall function 00E14271: _vsnprintf.LEGACY_STDIO_DEFINITIONS ref: 00E14281

swprintf.LIBCMT ref: 00E0D749

Strings

%lf, xrefs: 00E0D71C, 00E0D721, 00E0D746

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: ___swprintf_l_vsnprintfswprintf
String ID: %lf
API String ID: 3395499991-2891890143
Opcode ID: fe6df537cd45beb83f50304e1842a48ffa034c27a28b98bb43584017e122e5de
Instruction ID: 9124360f382c2e581cc76574741064c21e8e1cde00b3d2ef99e7fee023fc390c
Opcode Fuzzy Hash: fe6df537cd45beb83f50304e1842a48ffa034c27a28b98bb43584017e122e5de
Instruction Fuzzy Hash: C3F0F6B11000087ADB007B94DC86FFF3BACDF85354F014058F64926292DB719E40D3B5

Function 00DFB790 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35stringCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,.lnk,74E2F860), ref: 00DFB7B7
lstrcmpiW.KERNEL32(00000000), ref: 00DFB7BE

Part of subcall function 00DFB810: CoCreateInstance.OLE32(00E6A89C,00000000,00000001,00E66D8C,?,0000C356,?), ref: 00DFB83F
Part of subcall function 00DFB810: lstrcpyW.KERNEL32(?,?), ref: 00DFB86B
Part of subcall function 00DFB810: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 00DFB8F2
Part of subcall function 00DFB810: lstrcpynW.KERNEL32(?,?,?), ref: 00DFB90C

Strings

.lnk, xrefs: 00DFB7B1

Memory Dump Source

Source File: 00000000.00000002.1798338705.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1798315670.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798431879.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798457254.0000000000E80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798500300.0000000000E82000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_dZIZhRHDXv.jbxd

Similarity

API ID: CreateEnvironmentExpandExtensionFindInstancePathStringslstrcmpilstrcpylstrcpyn
String ID: .lnk
API String ID: 2874927818-24824748
Opcode ID: e99212b7c475a45d87f42414743d3ee27d80caf011695bd0a4b3294298774695
Instruction ID: eca6a4ea6110da045cd29fcd0a84e0cf152524df9f3b5e43be58e16cff7b0352
Opcode Fuzzy Hash: e99212b7c475a45d87f42414743d3ee27d80caf011695bd0a4b3294298774695
Instruction Fuzzy Hash: 95F02431A00B045BD734BB24EC8A7FF77D4EF98750F85881AE459A6291EFF8488486D2

Analysis Process: dialer.exePID: 7684, Parent PID: 4944COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	1579
Total number of Limit Nodes:	17

Executed Functions

Function 057C9F64 Relevance: 12.1, APIs: 8, Instructions: 122
networkregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 057C9F7B
memset.MSVCRT ref: 057C9FC7
WSARecv.WS2_32(FFE0458D,00000000,00000001,?,00000000,057C21F9,00000000), ref: 057C9FF5
GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 057CA01F
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 057CA02C
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 057CA036
WSAGetLastError.WS2_32(?,?,?,?,?,00000001), ref: 057CA03E
RegisterWaitForSingleObject.KERNEL32(057C2219,30C48300,057C9EAD,057C21E9,000000FF,00000004), ref: 057CA088

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$memset$ObjectRecvRegisterSingleWait
String ID:
API String ID: 2020750497-0
Opcode ID: 0013a77317f393e014d57fd337f873d493ae29f918dad70a3caef98ae0117bb2
Instruction ID: 48d241931cb5ddca7e8c2c37030fa26ff01e4e89d91d24bb6a290c77c5a5c0c9
Opcode Fuzzy Hash: 0013a77317f393e014d57fd337f873d493ae29f918dad70a3caef98ae0117bb2
Instruction Fuzzy Hash: 3D41AA71600708AFE7218F24D849BAABFF8FF05355F10866DE942DA590E770EA44EB90

Function 057C9A57 Relevance: 10.6, APIs: 7, Instructions: 64
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000010,00000001,00000000), ref: 057C9A6C
WSAGetLastError.WS2_32(?,?,?,057C9A53,057CAD04,00000002,057CAD04,00000010,057CAD04,057CAD81), ref: 057C9A79

Part of subcall function 057C9B02: ioctlsocket.WS2_32(057CAD04,8004667E,057CAD81), ref: 057C9B1D
Part of subcall function 057C9B02: WSAGetLastError.WS2_32(?,?,057C9AC7,17E80870,057CAD04,00000000,00000010,00000000,?,?,?,057C9A53,057CAD04,00000002,057CAD04,00000010), ref: 057C9B28

SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,?,?,057C9A53,057CAD04,00000002,057CAD04,00000010,057CAD04,057CAD81), ref: 057C9A94
GetLastError.KERNEL32(?,?,?,057C9A53,057CAD04,00000002,057CAD04,00000010,057CAD04,057CAD81), ref: 057C9A9E
closesocket.WS2_32(00000000), ref: 057C9AB0
bind.WS2_32(50A5A5A5,057CAD04,00000002), ref: 057C9AD7
WSAGetLastError.WS2_32(?,?,?,057C9A53,057CAD04,00000002,057CAD04,00000010,057CAD04,057CAD81), ref: 057C9AE2

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$HandleInformationbindclosesocketioctlsocketsocket
String ID:
API String ID: 2417539845-0
Opcode ID: 72af81a2b74382948aa44b1c449a551d790e0f267145dd46f822bc63ba71f2fd
Instruction ID: 1653e7420bdd4bf24bc21025527c3de1414fbc98aa932753e2862647545c02b8
Opcode Fuzzy Hash: 72af81a2b74382948aa44b1c449a551d790e0f267145dd46f822bc63ba71f2fd
Instruction Fuzzy Hash: 97118E31104700ABDB625E74DC0DB6A7FA6AB49731F10866DF722892E0EB71A450FB60

Function 030702D4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 0307031C

Part of subcall function 030700A0: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 030700C9
Part of subcall function 030700A0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 03070275

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 0307036E
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 030703DD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 030703FD
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 03070424
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0307044C
CloseHandle.KERNELBASE(?), ref: 03070467

Strings

,, xrefs: 0307034C

Memory Dump Source

Source File: 00000001.00000003.1794796397.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_dialer.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction ID: 7eea16197f2bd2c6b7cfc262d04988aae3fddaa190583ab4f9d498b105a92734
Opcode Fuzzy Hash: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction Fuzzy Hash: 3D51FBB5D01209AFCB20DFA5C884ADEBBF8FF08354F148529F959A7240D770A954CBA4

Function 057C8AAD Relevance: 13.6, APIs: 9, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008003), ref: 057C8AB2
WSAStartup.WS2_32(00000202,?), ref: 057CAEA0

Part of subcall function 057CAC49: memset.MSVCRT ref: 057CAC59
Part of subcall function 057CAC49: htons.WS2_32(00000002), ref: 057CAC6A
Part of subcall function 057CAC49: inet_addr.WS2_32(?), ref: 057CAC77

Part of subcall function 057CAC90: memset.MSVCRT ref: 057CACA0
Part of subcall function 057CAC90: htons.WS2_32(?), ref: 057CACB1

socket.WS2_32(00000002,00000001,00000000), ref: 057CAEED
getsockopt.WS2_32(00000000,0000FFFF,00002005,?,?), ref: 057CAF1E
closesocket.WS2_32(00000000), ref: 057CAF31
WSAGetLastError.WS2_32 ref: 057CAF39
socket.WS2_32(00000017,00000001,00000000), ref: 057CAF4E
closesocket.WS2_32(00000000), ref: 057CAF83
WSAGetLastError.WS2_32 ref: 057CAF8B

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: Error$Lastclosesockethtonsmemsetsocket$ModeStartupgetsockoptinet_addr
String ID:
API String ID: 2777411211-0
Opcode ID: c7e81198b955047df010dc561adb9a43bc17cce2038cb2960bd7494fe5edd027
Instruction ID: 333454b97c8f9265b59824ce2004f8bbda119ee9e22c3fe3665aa4f9596582b5
Opcode Fuzzy Hash: c7e81198b955047df010dc561adb9a43bc17cce2038cb2960bd7494fe5edd027
Instruction Fuzzy Hash: BB31F9F1204308ABD221EBA4DC8EFAF7FADFB49721F40455EF6149A1C0EB759904A761

Function 057CA387 Relevance: 10.7, APIs: 7, Instructions: 157
networkregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 057CA3AE
memset.MSVCRT ref: 057CA3BA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,057C427C,00000000,00000000,057C4237,00000000), ref: 057CA3CC
WSASend.WS2_32(?,057C427C,?,00000000,00000000,00000010,00000000), ref: 057CA3F1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 057CA44A
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 057CA457
RegisterWaitForSingleObject.KERNEL32(00000048,?,057CA51C,00000000,000000FF,0000000C), ref: 057CA4E3

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastmemset$CreateEventObjectRegisterSendSingleWait
String ID:
API String ID: 2712206520-0
Opcode ID: 574a6081d358356bddd4681c6cea6f0392694ed538d6eaa1c287c5fbabc4a38d
Instruction ID: d7b29c03abc6547a5dcb4a885457e628059a2c6662699fe499729bb237d172a5
Opcode Fuzzy Hash: 574a6081d358356bddd4681c6cea6f0392694ed538d6eaa1c287c5fbabc4a38d
Instruction Fuzzy Hash: 9C5183B1500B0AAFD724CF29D888A62BFF8FF0831970086ADE956C7650E730F955DB90

Function 057C9B02 Relevance: 7.6, APIs: 5, Instructions: 94
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32(057CAD04,8004667E,057CAD81), ref: 057C9B1D
WSAGetLastError.WS2_32(?,?,057C9AC7,17E80870,057CAD04,00000000,00000010,00000000,?,?,?,057C9A53,057CAD04,00000002,057CAD04,00000010), ref: 057C9B28
CreateIoCompletionPort.KERNELBASE(057CAD04,19751710,057CAD04,00000000,?,?,057C9AC7,17E80870,057CAD04,00000000,00000010,00000000,?,?,?,057C9A53), ref: 057C9B48
SetFileCompletionNotificationModes.KERNEL32(057CAD04,00000003,?,?,057C9AC7,17E80870,057CAD04,00000000,00000010,00000000,?,?,?,057C9A53,057CAD04), ref: 057C9B8A

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: Completion$CreateErrorFileLastModesNotificationPortioctlsocket
String ID:
API String ID: 3397353003-0
Opcode ID: fbe525a5cb9bf22ed67f29fa2b31c1a6be4dd5cd5a504a60e8b4e7aa0b37f77f
Instruction ID: e6a5ffb2de05c1317a66e1f02172e1af5c1d7f1603158eafe5a4140c54f8f477
Opcode Fuzzy Hash: fbe525a5cb9bf22ed67f29fa2b31c1a6be4dd5cd5a504a60e8b4e7aa0b37f77f
Instruction Fuzzy Hash: 48319F31104705FADB619E65DD89B6A7FAAFF40394F1441ACFB0296180EB70FA44E764

Function 057CA0C0 Relevance: 4.6, APIs: 3, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c862c9104abab961222ed0f91ac914c88d237c573d8fed6c891e8fedfec932
Instruction ID: 5c58cc6a199e30a49b1b215122702dbf3523a9d85ec4ef6fa80ba6db2c7bb850
Opcode Fuzzy Hash: 52c862c9104abab961222ed0f91ac914c88d237c573d8fed6c891e8fedfec932
Instruction Fuzzy Hash: A941AFB16102099FDB14CF25C884FA2BBB9FF45325F4481ADED168F256EB31E441EBA0

Function 057CAA5B Relevance: 4.6, APIs: 3, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shutdown.WS2_32(D7FF5605,00000001), ref: 057CAA7E
closesocket.WS2_32(?), ref: 057CAAD4
closesocket.WS2_32(D7FF5605), ref: 057CAB4D

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: closesocket$shutdown
String ID:
API String ID: 3079814495-0
Opcode ID: 68d4176aca07a7568790196ed61f00d325e184016bf3600530355ff23a2982eb
Instruction ID: 2221fa6557e0dc3690252b3e926afb2b7900c4205ca1d85ea84bd568c2dbe8b1
Opcode Fuzzy Hash: 68d4176aca07a7568790196ed61f00d325e184016bf3600530355ff23a2982eb
Instruction Fuzzy Hash: 0D414C70614B098FEB358E65D548B66BFF2FF05366F048A5DE89286A90D730E446EF40

Function 057CA983 Relevance: 3.1, APIs: 2, Instructions: 86
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(?,0000FFFF,00007010,00000000,00000000), ref: 057CA9D7
WSAGetLastError.WS2_32(?,057C8D2F,00000000,00000000,?,00000000,00000000,00000000,057C8BB0,00000000,?,00000000,057C2CE1,?,00000000,?), ref: 057CA9FF

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: 9fa3da7c0c9fd5d8a6afc7caafe329dde9c8fe0c94a35aa5a107ca32b9775731
Instruction ID: 0b9a770ba2b6513755e3b13a93c4361a852fd15cab4fd03e7245e2e14b52efe0
Opcode Fuzzy Hash: 9fa3da7c0c9fd5d8a6afc7caafe329dde9c8fe0c94a35aa5a107ca32b9775731
Instruction Fuzzy Hash: 25319370204B09AFDB20DF25C989E6ABBB4FF09351B04865DFD869B791C730F8119B94

Function 030700A0 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 030700C9
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 03070275

Memory Dump Source

Source File: 00000001.00000003.1794796397.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_dialer.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: c8cbb75dc56fcf1fc09c6aa1114752b928fca445d261703a2f4c13ead114719b
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: 3471AA72E0524ADFCB41CF98C981BEDBBF0AF09314F284595E465FB241C274AA91CF68

Function 057CF03C Relevance: 2.6, APIs: 2, Instructions: 82
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT(74C08559,74C08559,0000414D,00000000,?,00000000,057C4237,057C4300,057C4237,00000000,057C429A,?,00000000,057C4237,00000000,057C4361), ref: 057CF086
strlen.MSVCRT ref: 057CF0EC

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: freestrlen
String ID:
API String ID: 322734593-0
Opcode ID: 93442e4eeaa0d179bd8cea1c0119ac4e79e678d9dbd7bc3b657d3c67f5abf513
Instruction ID: 4e457cd2c3cb29fcbadadc09d1efb635c2acd0a522b24c8dfb4d62f752ba6c3b
Opcode Fuzzy Hash: 93442e4eeaa0d179bd8cea1c0119ac4e79e678d9dbd7bc3b657d3c67f5abf513
Instruction Fuzzy Hash: 7C21A131308704ABDB717B39DD49F4BBBEAFF40B10B05486DF582A2560DA22F850AB24

Function 057C46ED Relevance: 2.5, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 057C46F4
memset.MSVCRT ref: 057C470A

Part of subcall function 057CE798: memset.MSVCRT ref: 057CE7A3

Part of subcall function 057CE7AC: calloc.MSVCRT(00000001,0000414D), ref: 057CE7CF

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: memset$callocmalloc
String ID:
API String ID: 4186080596-0
Opcode ID: a5d238a9b4f98967c8c6547edc4a995f274c1a3b5615251c390752604226eb72
Instruction ID: 6ac57bc3cac3d199be51daefc5233206658410106631e7fc22af55d553806285
Opcode Fuzzy Hash: a5d238a9b4f98967c8c6547edc4a995f274c1a3b5615251c390752604226eb72
Instruction Fuzzy Hash: E4F04F75740700AFD621AB64CD0EF4B7FA9EF85B10F05885CB9596B640C634A900E750

Function 057C9EF3 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,057C21B5,?,057C9762,?,057C21B5,057C21B5,057C4579,?,057C45AE,057C45FA,057C454F,?), ref: 057C9F4D

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID:
API String ID: 2692171526-0
Opcode ID: ed73d682c389628015100ab8e574c72a84a3863358526ff5fddfd0905d015827
Instruction ID: 4fd4a47c8d4fdcf80c10a1ad8b88f1a0287fcbc2b1ed975aa36f8905d1ca1cd6
Opcode Fuzzy Hash: ed73d682c389628015100ab8e574c72a84a3863358526ff5fddfd0905d015827
Instruction Fuzzy Hash: 09014CB4908B01AFE770CE26D444A67BBF5FB88320F04895DE98A86A00E374F845DB50

Function 057CE7AC Relevance: 1.3, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT(00000001,0000414D), ref: 057CE7CF

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: accf3d8817905bfd7331faa0f57120824e45fbc8c1211d219fe70d15b18b62ca
Instruction ID: ef6fbce90d3584df49036c3eb543c121caa130084e4322ff5e8ff18f96575471
Opcode Fuzzy Hash: accf3d8817905bfd7331faa0f57120824e45fbc8c1211d219fe70d15b18b62ca
Instruction Fuzzy Hash: CC21ED71504B00DED721CF2AE881A86FBE8FF94754F20881FE599C7261DBB0A040DF64

Function 057C1BD9 Relevance: 1.3, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 057C1BDE

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: bb7adc56db02b5f241ff60fc2ee37bf05146b6930231ecb0fd04e5ab1d1b9d81
Instruction ID: 556bd0552cbff52f05a1ba6c9d6985fcd66d2fa5d5fd95aaae3d4988e4e07655
Opcode Fuzzy Hash: bb7adc56db02b5f241ff60fc2ee37bf05146b6930231ecb0fd04e5ab1d1b9d81
Instruction Fuzzy Hash: 10F0FEB56042099FCF098F54E854DA93FA5FF48354B4580ADFD094B361D731D820DB60

Non-executed Functions

Function 057C4AB5 Relevance: 31.6, APIs: 25, Instructions: 300COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,057EDEBC,00000001,00000000,?,057C328A,?,?), ref: 057C4AE4
memcmp.MSVCRT(?,057EDEB8,00000002), ref: 057C4B13
memcmp.MSVCRT(?,057EDEB4,00000003), ref: 057C4B53
memcmp.MSVCRT(?,057EDEA0,00000004), ref: 057C4BE8
memcmp.MSVCRT(?,057EDE98,00000005), ref: 057C4C2C
memcmp.MSVCRT(?,057EDE70,00000006), ref: 057C4CEA
memcmp.MSVCRT(?,057EDE58,00000007), ref: 057C4D66
memcmp.MSVCRT(?,057EDE3C,00000008), ref: 057C4DE4
memcmp.MSVCRT(?,057EDE18,00000009), ref: 057C4E60

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: f21b20afc236fc27d2c136454e12b2dbd61378bba67a7a524d7264475040dc4a
Instruction ID: ebb7fafb7ae94df6023f822babcd999907ebbe9965c1b9e040780f19963c36f3
Opcode Fuzzy Hash: f21b20afc236fc27d2c136454e12b2dbd61378bba67a7a524d7264475040dc4a
Instruction Fuzzy Hash: 9581BFB2B4830072DA3051696D5FF362E5E6B2AB0BF4444EDFD09ED156F167E700B682

Function 057C9CA2 Relevance: 16.7, APIs: 11, Instructions: 168networkregistryCOMMON

Download Yara Rule

APIs

socket.WS2_32(0000138A,00000001,00000000), ref: 057C9CCC
SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,?,?,057CA95A,?,00000000,?,00000000,00000000,?,00000000), ref: 057C9D09
closesocket.WS2_32(00000000), ref: 057C9D44
memset.MSVCRT ref: 057C9D5A
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 057C9DBB
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 057C9DC8
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 057C9DD2
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 057C9DDA
closesocket.WS2_32(?), ref: 057C9DFE
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?), ref: 057C9E0C
RegisterWaitForSingleObject.KERNEL32(00000154,?,057C9EAD,00000000,000000FF,00000004), ref: 057C9E49

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$Handleclosesocket$CloseInformationObjectRegisterSingleWaitmemsetsocket
String ID:
API String ID: 1241441197-0
Opcode ID: 32353b74cf431e23fa0fc13cb8eb7aadbadaebc6c30ab1540d590b5f24ab33f0
Instruction ID: 3d1163daaf4d8cedf148a9bf532b61833f0103df8d0022f888100b6a7560d5f3
Opcode Fuzzy Hash: 32353b74cf431e23fa0fc13cb8eb7aadbadaebc6c30ab1540d590b5f24ab33f0
Instruction Fuzzy Hash: 1951AB32610B05EFD7619FA4CC49BA6BFB8FF49311F10826DE616CA180EB34F511AB94

Function 057C2E70 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 263stringCOMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(00000059,00000000,00000020), ref: 057C2EEA
GetUserDefaultLangID.KERNEL32(0000005A,00000000,00000020), ref: 057C2F12
_snwprintf.MSVCRT ref: 057C2FB0
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 057C2FCA
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000080,00000000,00000000), ref: 057C2FF8
strlen.MSVCRT ref: 057C3143

Strings

z, xrefs: 057C3026

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ByteCharDefaultLangMultiUserWide$_snwprintfstrlen
String ID: z
API String ID: 2883371422-1657960367
Opcode ID: 9b638cebb7f64d6c96e0b4442c821ab1db918ad95a54b3853c07b77c23b5c461
Instruction ID: ea8a5ac4c97c8794b97f5c956d3e72b8ee250ff5ae2910dfd342152ff01e950c
Opcode Fuzzy Hash: 9b638cebb7f64d6c96e0b4442c821ab1db918ad95a54b3853c07b77c23b5c461
Instruction Fuzzy Hash: B9A102B1A10309AFDB20DFA4DC89E9D7FB9FB4C304F14C8ADF905AA280DB749545AB51

Function 057C984B Relevance: 12.2, APIs: 8, Instructions: 170networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000001), ref: 057C98C7
WSAGetLastError.WS2_32(?,00000000,?,057C8C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,057C8BB6,00000000,00000000,?,00000000), ref: 057C98D8
closesocket.WS2_32(?), ref: 057C994E
UnregisterWait.KERNEL32(89595908), ref: 057C9993
CloseHandle.KERNEL32(458BF845,00000000,00000000,?,00000000,?,057C8C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,057C8BB6,00000000), ref: 057C99AD
free.MSVCRT ref: 057C99D3
UnregisterWait.KERNEL32(?), ref: 057C99F4
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,?,057C8C46,00000000,00000000,00000000,00000000,00000000,00000000,00000000,057C8BB6,00000000), ref: 057C9A06

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: CloseHandleUnregisterWait$ErrorLastclosesocketfreeshutdown
String ID:
API String ID: 3261266694-0
Opcode ID: e1d7fafc2cf221d04f7030d9903324b16297be3d6ff22d3005697a2ed8fefd8b
Instruction ID: 1af81ff2141e66de29c256f70f72d3317be46490e7974e2e82b46faf41bdcbdc
Opcode Fuzzy Hash: e1d7fafc2cf221d04f7030d9903324b16297be3d6ff22d3005697a2ed8fefd8b
Instruction Fuzzy Hash: F2513871604B018FDB75CF69C588A66BBF1FF48324F048A6DEA968B6A0D730F845DB50

Function 057C2B8F Relevance: 12.1, APIs: 8, Instructions: 140stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 057C2B9F
memset.MSVCRT ref: 057C2BCB
time.MSVCRT(00000000,?,00000000,00000014), ref: 057C2BF4
srand.MSVCRT ref: 057C2BFB
calloc.MSVCRT ref: 057C2C05
strlen.MSVCRT ref: 057C2C43
free.MSVCRT ref: 057C2CF8
free.MSVCRT ref: 057C2D1E

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: callocfree$memsetsrandstrlentime
String ID:
API String ID: 805530809-0
Opcode ID: 8df7ddeea7a58c4449680d5ec35b5c58a00b120bf1e8c9585fecf5002bed7878
Instruction ID: 97abb274f7e861881ca4886cbb565b47ebbdf9149c817afb65a6cadd01d8312a
Opcode Fuzzy Hash: 8df7ddeea7a58c4449680d5ec35b5c58a00b120bf1e8c9585fecf5002bed7878
Instruction Fuzzy Hash: D2513BB5A00704AFDB10DFA5C889A9EBFF8FF08300F50896EF95AD7640D775A9449B60

Function 057CBCF1 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 057CBD08
memset.MSVCRT ref: 057CBD4D
GetLastError.KERNEL32 ref: 057CBDB6
GetLastError.KERNEL32 ref: 057CBE43
WSAGetLastError.WS2_32 ref: 057CBE50
WSAGetLastError.WS2_32 ref: 057CBE5A
WSAGetLastError.WS2_32 ref: 057CBE62

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$memset
String ID:
API String ID: 4054172246-0
Opcode ID: 58181fc20751b5e770e5717c9ca2f925ef4a1910dd70294353fc14e74fdf6177
Instruction ID: 1344da856e8de83f08c7153eb06810ae000fe1b0b45f889d21258a1c983e7ace
Opcode Fuzzy Hash: 58181fc20751b5e770e5717c9ca2f925ef4a1910dd70294353fc14e74fdf6177
Instruction Fuzzy Hash: A0516972500748AFD721DF65C84AB9ABBF8FF09700F10896DF64ADA140EB74E604DBA0

Function 057CB2A0 Relevance: 10.6, APIs: 7, Instructions: 83networksynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,057CBB80,?,000000FF,00000000,00000000), ref: 057CB2C7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,057CBB80), ref: 057CB308
GetLastError.KERNEL32(?,?,?,057CBB80), ref: 057CB313
CloseHandle.KERNEL32(00000000,?,?,?,057CBB80), ref: 057CB31C
WSASetLastError.WS2_32(00000000,?,?,?,057CBB80), ref: 057CB323
CloseHandle.KERNEL32(00000000,?,?,?,057CBB80), ref: 057CB332
WSASetLastError.WS2_32(00000000,?,?,?,057CBB80), ref: 057CB355

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseHandle$CreateEventObjectSingleWait
String ID:
API String ID: 1659421480-0
Opcode ID: 0991e90416662c25cf06a82c612650d54ac554f0adec2a26b85c4182804eebc9
Instruction ID: 68cf7986da0db66117dcf11f7c4721f802f806d97fdef2eb6c9bf709a9e02776
Opcode Fuzzy Hash: 0991e90416662c25cf06a82c612650d54ac554f0adec2a26b85c4182804eebc9
Instruction Fuzzy Hash: 70212932900614ABD7225A74DC8EEAF3F69FB48770F45475CF92AE71C0EA308D44E6A0

Function 057C4F5A Relevance: 8.8, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,057EDDC0,0000000C), ref: 057C4F94
memcmp.MSVCRT(?,057EDDB0,0000000C), ref: 057C4FB6
memcmp.MSVCRT(?,057EDDA0,0000000C), ref: 057C4FD8
memcmp.MSVCRT(?,057EDD80,0000000C), ref: 057C5018
memcmp.MSVCRT(?,057EDD70,0000000C), ref: 057C503A
memcmp.MSVCRT(?,057EDD60,0000000C), ref: 057C505C

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d134dbe006166cb7c6b889e2bbfa6cac9dad9d843ea7d0892bc3f77d7533af64
Instruction ID: 94753fdbbcdfd378df9fb49bad5675390486c5a27143c6bdd5bab433417066a8
Opcode Fuzzy Hash: d134dbe006166cb7c6b889e2bbfa6cac9dad9d843ea7d0892bc3f77d7533af64
Instruction Fuzzy Hash: FB118CF3748725A1E530A2692D1BF3A1E0E5B2AB4AF4441EDFD09E9156E187E700B187

Function 057C34E5 Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,?,00000004), ref: 057C3551
calloc.MSVCRT ref: 057C36DA
memcmp.MSVCRT(?,?,00000020,?,?,?,?,?,?), ref: 057C3926
free.MSVCRT ref: 057C393B

Strings

factfmt RIFFdata, xrefs: 057C359A, 057C359F

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp$callocfree
String ID: factfmt RIFFdata
API String ID: 254810267-2461439165
Opcode ID: e411907253d0d1f837064ef20bf80e9264f9bf8f78c0daee0118acdeef07228e
Instruction ID: 66b02115d609a2fb9cc4d1b129610741ced748c03d8473e44e885d2b83efa00d
Opcode Fuzzy Hash: e411907253d0d1f837064ef20bf80e9264f9bf8f78c0daee0118acdeef07228e
Instruction Fuzzy Hash: 82D1A072E042199BDF24DFA4C888BEEBBB9FF44714F0084AEE545A7241E734DA44DB61

Function 057D51E4 Relevance: 7.8, APIs: 6, Instructions: 347COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 057D51F6
memset.MSVCRT ref: 057D5202
memset.MSVCRT ref: 057D520E
calloc.MSVCRT ref: 057D5273

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: memset$calloc
String ID:
API String ID: 1504270956-0
Opcode ID: ea551b160cd66fe7ad9f7a1cade80fbb58a647f03e27691230362b7b7135a28f
Instruction ID: c0e7b89ee94fdb5be72481e79c61bd6fddc29e45568d973fb780ce8a56072e78
Opcode Fuzzy Hash: ea551b160cd66fe7ad9f7a1cade80fbb58a647f03e27691230362b7b7135a28f
Instruction Fuzzy Hash: B9C11072A00209EBDB11DAA5CD88EEFB7FEBF44244F14456AE946D7140F630EB04AB71

Function 057CC5F6 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 158stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 057CC60B
strchr.MSVCRT ref: 057CC650
strchr.MSVCRT ref: 057CC666

Strings

0123456789abcdef, xrefs: 057CC646, 057CC64C
0123456789ABCDEF, xrefs: 057CC65C, 057CC662

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: strchr$memset
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 3020236661-885041942
Opcode ID: 42cb3bcda0be43ee5a223f1ba12019c4f0c747e570010292cc308e4fc432686a
Instruction ID: 5b945fb7527286c6f40089a9006cb0e631b47d484203cef43227af306739a899
Opcode Fuzzy Hash: 42cb3bcda0be43ee5a223f1ba12019c4f0c747e570010292cc308e4fc432686a
Instruction Fuzzy Hash: 4A51C43190424ADFCF12CFA8C5859EEBFB9FB85354F1440AED86AA7200D7309E85DB90

Function 057C8E11 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,057C8E0E,00000000,057CBB73,057CBBBA,057EEEE0,057CBBC2,057CBB73,00000000), ref: 057C8E1E
InterlockedCompareExchange.KERNEL32(057CBB77,00000000,00000000), ref: 057C8E30
SetEvent.KERNEL32(00000000,?,057C8E0E,00000000,057CBB73,057CBBBA,057EEEE0,057CBBC2,057CBB73,00000000), ref: 057C8E41
CloseHandle.KERNEL32(00000000,?,057C8E0E,00000000,057CBB73,057CBBBA,057EEEE0,057CBBC2,057CBB73,00000000), ref: 057C8E4D
WaitForSingleObject.KERNEL32(057CBB73,000000FF,?,057C8E0E,00000000,057CBB73,057CBBBA,057EEEE0,057CBBC2,057CBB73,00000000), ref: 057C8E58

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: Event$CloseCompareCreateExchangeHandleInterlockedObjectSingleWait
String ID:
API String ID: 4206309166-0
Opcode ID: 046f98369a3d274792d35dfb1e250f251d1c4ec818d475c8aaed6c5a4ad1a5e4
Instruction ID: b048aed48483a14d6b8c920c760d84531d2e069c1971e1860365d62e5209ab9f
Opcode Fuzzy Hash: 046f98369a3d274792d35dfb1e250f251d1c4ec818d475c8aaed6c5a4ad1a5e4
Instruction Fuzzy Hash: 52F08235514304BBDB115FA0DC4EF963FACEB0C771F108515FA0A9A1C1EA7195409B61

Function 057C50CC Relevance: 6.3, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,057EDD30,0000000E), ref: 057C50F7
memcmp.MSVCRT(?,057EDD20,0000000E), ref: 057C5119
memcmp.MSVCRT(?,057EDD10,0000000E), ref: 057C513B
memcmp.MSVCRT(?,057EDD00,0000000E), ref: 057C515D
memcmp.MSVCRT(?,057EDCF0,0000000E), ref: 057C517F

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b840f2df05f93870fdee1edc111a1018bca407ff2eefdaa82045d7a9516142d3
Instruction ID: 240a1c8b4ea894a9dc459cdac3f40a7c37deedbbf15f77c226ca9976d38fd4c3
Opcode Fuzzy Hash: b840f2df05f93870fdee1edc111a1018bca407ff2eefdaa82045d7a9516142d3
Instruction Fuzzy Hash: 9901A2F276838932E53052792E1FF351E4EA718B4AF4449EDBD09F8182F4A7F650B542

Function 057C5199 Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,057EDCE0,0000000F), ref: 057C51BA
memcmp.MSVCRT(?,057EDCD0,0000000F), ref: 057C51D8
memcmp.MSVCRT(?,057EDCC0,0000000F), ref: 057C51FA
memcmp.MSVCRT(?,057EDCB0,0000000F), ref: 057C521C

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 00b309a4f9f5f799ef792975f36afb78c89b63c741e436258e482e9bab178262
Instruction ID: 0da86c5410948ccfb08da3159da1dddc7e2ad9cf6a7cefe0f8adf724ce2d71fe
Opcode Fuzzy Hash: 00b309a4f9f5f799ef792975f36afb78c89b63c741e436258e482e9bab178262
Instruction Fuzzy Hash: C4018BF274871236D53051691D0BF3A2E496B1AB86F4044FDAD09F895AF186EB017187

Function 057CE0E5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 057CE159
calloc.MSVCRT ref: 057CE168

Strings

P, xrefs: 057CE26C

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: callocfree
String ID: P
API String ID: 306872129-3110715001
Opcode ID: 001f240d6f431d2027c3824c4cc299c60711ce3b378b11b2800193439d89e906
Instruction ID: e55cb13928cfb5315d984993b72585a2a7e99ccc67f2b0c57ea32af0ca2d6ef3
Opcode Fuzzy Hash: 001f240d6f431d2027c3824c4cc299c60711ce3b378b11b2800193439d89e906
Instruction Fuzzy Hash: 5D51D532709A009FD7769B28C889F697F9ABF45700F1884ECFC478F292E721E844A755

Function 057C39C1 Relevance: 6.1, APIs: 4, Instructions: 89networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 057C3A01
getaddrinfo.WS2_32(?,00000000,?,00000000), ref: 057C3A24
htons.WS2_32(?), ref: 057C3A8D
FreeAddrInfoW.WS2_32(00000000), ref: 057C3AA4

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: AddrFreeInfogetaddrinfohtonsmemset
String ID:
API String ID: 928751204-0
Opcode ID: ae34b124981f52607683e1800c30586c238b28a46d934abda087d95056acfe5e
Instruction ID: 864c6bbd2be9f2e81f92af07960e11e6ac826d6a27b71779f02bd522b303dfb1
Opcode Fuzzy Hash: ae34b124981f52607683e1800c30586c238b28a46d934abda087d95056acfe5e
Instruction Fuzzy Hash: D7316B71A00205EFDB24DF94C888BAEBBBAFF48310F15889DF4159B211E371EA55DB91

Function 057CA53B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,00000000,?,00000000,00000000), ref: 057CA641
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,?), ref: 057CA6F2

Strings

E', xrefs: 057CA74B

Memory Dump Source

Source File: 00000001.00000002.3000931439.00000000057C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 057C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_57c1000_dialer.jbxd

Yara matches

Similarity

API ID: ErrorLastRecv
String ID: E'
API String ID: 904507345-3751625834
Opcode ID: 3a5b01b889b47b4bd0e19c3df835c29d42ec83b08a46266d78578e6f130c031e
Instruction ID: c45d6cb93f52810f89a8ad91f0d627a7b1bff392a344ffc859c4eab8a1534225
Opcode Fuzzy Hash: 3a5b01b889b47b4bd0e19c3df835c29d42ec83b08a46266d78578e6f130c031e
Instruction Fuzzy Hash: 2B81D47050470CAFDB318F14C888EAA7FF6FF04366F04469DE95696690E731EA85EB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dZIZhRHDXv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
dZIZhRHDXv.exe

Function 00DEA0B0 Relevance: 130.0, APIs: 18, Strings: 56, Instructions: 534
stringCOMMON

Function 00DFE360 Relevance: 93.1, APIs: 43, Strings: 10, Instructions: 336
windowcomregistryCOMMON

Function 00DFEFB0 Relevance: 74.1, APIs: 49, Instructions: 564
windowCOMMON

Function 00E06140 Relevance: 30.1, APIs: 20, Instructions: 137
windowstringCOMMON

Function 00DE9C80 Relevance: 91.2, APIs: 47, Strings: 5, Instructions: 199
stringCOMMON

Function 00DFE910 Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 303
windowstringCOMMON

Function 00DE96A0 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 145
stringCOMMON

Function 00E077E6 Relevance: 28.5, APIs: 12, Strings: 4, Instructions: 501
libraryCOMMON

Function 00DE7440 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 115
memorylibraryCOMMON

Function 00DFDE20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 172
COMMON

Function 00DE6E90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMON

Function 00DE7C00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
COMMON